BIS Issues Final Rule to Address Connected Vehicle National Security Concerns

The U.S. Department of Commerce’s Bureau of Industry and Security (BIS) published a final rule to address the national security risks associated with connected vehicles. The final rule maintains the prohibitions established in its proposed rulemaking relating to the sale or import of connected vehicles that incorporate certain information and communication technology and services (ICTS) that are designed, developed, manufactured, or supplied, by persons owned by, controlled by, or subject to the jurisdiction or direction of China or Russia. Although these general prohibitions (which we analyzed in a previous Insight) are unchanged, the final rule incorporates several notable revisions and clarifications in response to public comments. We address these key changes below. The final rule goes into effect on March 17, 2025.

Prohibitions Under Final Rule

Broadly, the final regulations include the following sales and imports restrictions:

1. Prohibit the knowing importation into the United States of certain hardware for Vehicle Connectivity Systems (“VCS Hardware”);
2. Prohibit connected vehicle manufacturers from knowingly importing into the United States completed connected vehicles incorporating certain software that supports the function of VCS or automated driving systems (ADS) (“covered software”);
3. Prohibit connected vehicle manufacturers from knowingly selling within the United States completed connected vehicles that incorporate covered software; and
4. Prohibit connected vehicle manufacturers who are owned by, controlled by, or subject to the jurisdiction or direction of China or Russia from knowingly selling in the United States completed connected vehicles that incorporate VCS hardware or covered software.

The first three prohibitions apply to transactions when such VCS hardware or covered software is designed, developed, manufactured, or supplied by persons owned by, controlled by, or subject to the jurisdiction of China or Russia. The fourth prohibition applies regardless of whether such VCS hardware or covered software is designed, developed, manufactured, or supplied by persons owned by, controlled by, or subject to the jurisdiction or direction of China or Russia.

Revisions from Proposed Rule

Although the above-listed prohibitions remain unchanged from the proposed rulemaking, revised definitions and additional clarification have been provided by BIS in the final rule. Some key changes include the following:

• Revising the definition of “connected vehicle” to clarify that the commercial vehicle sector is not covered (e., vehicles with a gross vehicle weight rating (GVWR) of over 10,000 pounds). This means that most RVs and agricultural, construction, and mining equipment are excluded from the definition of “connected vehicles.” BIS intends to issue a new proposed rule to address the commercial vehicle sector. BIS also further clarifies that motorcycles are covered by the final rule.
• Clarifying that persons that integrate ADS into otherwise completed vehicles are included in the definition of “connected vehicle manufacturer,” and that contracting operations could, but may not necessarily, qualify as “sales” under the rule. Third-party manufacturers who are owned by, controlled by, or subject to the jurisdiction of China or Russia are subject to this rule.
• Added specificity to the definition of “covered software” to explicitly include application, middleware, and system software, while continuing to exclude firmware. The revised definition also excludes legacy code that is designed, developed, manufactured, or supplied prior to March 17, 2026, thus protecting products that have already gone to market and providing regulated entities time to transfer intellectual property rights and otherwise come into compliance with the covered software prohibition.
• BIS will no longer require a Hardware Bill of Materials (HBOM) to be supplied with Declarations of Conformity; however, entities will need to maintain primary business records related to their certification that due diligence was conducted in analyzing their VCS hardware supply chains, which could include HBOMs.
• BIS changed the definition of Software Bill of Materials (SBOM) to remove several elements from the minimum documentation requirements necessary to apply for a specific authorization; the requirement to submit an SBOM with a Declaration of Conformity has also been removed.
• BIS amended the definition of VCS to add a variety of function-based exclusions to exclude certain low-risk use cases, including automotive sensing (which includes LiDAR, radar, cameras, and ultrawideband); global navigation satellite system (GNSS); and satellite, AM, and FM radio.
• BIS explicitly states that the related prohibited transactions provision in section 791.304 prohibits connected vehicle manufacturers who are themselves owned by, controlled by, or subject to the jurisdiction or direction of China or Russia from offering commercial services that utilize completed connected vehicles that incorporate ADS. BIS anticipates that these services will include both robotaxi and rideshare services.
• General authorizations will no longer be enumerated in the regulations, but will instead be issued on the BIS website and in the Federal Register.

These changes provide greater clarity for connected vehicle manufacturers and VCS hardware importers, and in some cases reduce their due diligence burdens. Nevertheless, these prohibitions require significant scrutiny of supply chains for items with a nexus to China or Russia. Businesses should review the applicability of this rule to their operations, the potential impact on their supply chains, and the steps they will need to take to be compliant with these requirements.

Additionally, the Executive Memorandum on America First Trade Policy signed last week by President Trump requires the Secretary of Commerce to review and recommend appropriate action with respect to this final rule, and to “consider whether controls on ICTS transactions should be expanded to account for additional connected products.” As such, additional ICTS restrictions relating to connected vehicles, as well as to other sectors, may be forthcoming.

Contact us if you have questions about the changes in this final rule or related compliance issues.