Navigating New BIS Regulations: Compliance for Connected Vehicles

Early this year, the Department of Commerce Bureau of Industry and Security (“BIS”) finalized a rule intended to mitigate national security risks associated with information and communications technology and services (“ICTS”) in connected vehicles. This rule targets both software and hardware supporting vehicle connectivity systems and software enabling Automated Driving Systems (“ADS”) in passenger cars, SUVs, and pickup trucks. The rule is part of BIS’s recent efforts to protect hardware, software and communications infrastructure in critical, national security sensitive industries and continues a recent trend of imposing trade restrictions on China and Russia. This alert summarizes the rule's key provisions, compliance obligations, and implications for the mobility and supply chain sector, particularly concerning companies with ties to the People's Republic of China (the "PRC") and Russia. Key compliance elements include strict import prohibitions, certification requirements, and enhanced supply chain due diligence. For additional background information see Honigman’s client alert on the proposed rule.

Software Restrictions and Compliance Deadlines

• Effective with the 2027 model year, vehicle manufacturers are prohibited from importing into the U.S. connected vehicles containing software that supports vehicle connectivity (e.g., Wi-Fi, Bluetooth) or autonomous driving capabilities, if such software is developed, manufactured, or supplied by companies affiliated with the PRC or Russia. Manufacturers must provide BIS with certificates of conformity for all 2027 model year and later connected vehicles containing software with any foreign interest at least 60 days prior to first sale or importation. This requirement and the requirement applicable to hardware applies even if the foreign interest does not involve the PRC or Russia. An exclusion exists for legacy code developed before March 17, 2026, provided it has not been modified by a PRC or Russian-affiliated entity after that date.

Hardware Restrictions and Compliance Deadlines

• Beginning with the 2030 model year, manufacturers are prohibited from importing vehicles containing connectivity hardware or importing connected vehicle hardware components if developed, manufactured, or supplied by companies affiliated with the PRC or Russia. This prohibition excludes specific hardware components, such as sensors supporting autonomous driving (lidar, radar, cameras), key fob hardware, unidirectional communication hardware (satellite radio, GPS, AM/FM radio), and power supply hardware for connected vehicle systems.
• Effective January 1, 2029, the importation of connected vehicle hardware not assigned to a specific vehicle model year is prohibited if developed, manufactured, or supplied by companies affiliated with the PRC or Russia. Manufacturers and importers of connected vehicle hardware with any foreign interest must provide BIS with a certificate of conformity 60 days prior to importation for 2030 model year vehicles or 60 days before the start of the calendar year for hardware not associated with a specific model year. BIS did clarify that if the only foreign interest in the connected vehicle software or hardware is an equity interest held by a foreign person without any corresponding rights to control, a declaration of conformity is not required. This exception does not, however, extend to entities affiliated with the PRC or Russia. A connected vehicle manufacturer owned by an entity affiliated with the PRC or Russia who does not hold any control rights could still be subject to the rule’s prohibitions.

Due Diligence and Certification Requirements

• BIS has indicated that existing supply chain reporting, which focuses on country-of-origin information, is insufficient for the rule's national security objectives. Consequently, the certificate of conformity mandates manufacturers to attest to their robust due diligence efforts in analyzing software and hardware supply chains. While the final rule does not require submission of bills of materials, companies must retain documentation demonstrating their certification of due diligence. Manufacturers may rely on third-party suppliers for certifications if those suppliers agree to provide underlying documentation to BIS upon request. Companies in the automotive supply chain should consider increased investments in supply chain reviews and audits to meet these new compliance responsibilities.

Broad Scope and Strategic Considerations

• Corporate business arrangements that could trigger these prohibitions, include direct ownership by PRC or Russian nationals, PRC or Russian state owned enterprises, being organized under the laws of, or headquartered in, the PRC or Russia, or having PRC or Russian nationals on a company’s board of directors. The rule’s prohibition also extends to U.S. subsidiaries of entities affiliated with the PRC or Russia.  Any software or hardware which is protected intellectual property or by other contractual rights ultimately held by a covered PRC or Russian person or entity is restricted. Given the rule's expansive application, manufacturers should consider requesting an advisory opinion from BIS if questions arise regarding whether the prohibitions apply to a particular entity or contemplated transaction. This proactive approach can help mitigate compliance risks.

Recommended Actions for Connected Vehicle Manufacturers

To prepare for the rule’s import prohibitions and compliance certification requirements, beginning with the 2027 model year, compliance teams should consider the following actions:

• Manufacturers of connected vehicles should consult existing supplier contracts to confirm they include sufficient supply chain mapping, record-keeping, information-sharing, and reporting requirements to meet the new BIS standards.
• Suppliers of connected vehicle software and components containing connected vehicle software should anticipate and prepare to address inquiries from their customers regarding their supply chain compliance.

For specific questions regarding your obligations under this rule, or to discuss its potential impact on your business, please contact Angela Gamalski, Tom Healy, Glynis Talley, or your Honigman attorney.