U.S. Finalizes Restrictions on Connected Vehicle Imports from China, Russia

January 24, 2025
U.S. Finalizes Restrictions on Connected Vehicle Imports from China, Russia

The U.S. Department of Commerce Bureau of Industry and Security (BIS) Office of Information and Communications Technology and Services (OICTS) has finalized a set of regulations that impose significant restrictions on the importation and sale of connected vehicles (CVs) and related hardware and software from China and Russia. These new rules, published on January 16, 2025, are designed to safeguard national security by significantly limiting the involvement of China and Russia in the U.S. automotive supply chain. The strategic intent behind these measures is to mitigate potential risks associated with critical automotive technologies being excessively influenced or controlled by foreign entities, particularly those representing geopolitical adversaries.

Scope of the Final Rule

The new regulations have a far-reaching impact on the entire U.S. automotive industry, imposing strict guidelines on the importation, sale, and distribution of connected vehicles containing specific vehicle communication systems (VCS) hardware or software, as well as automated driving systems (ADS) software, if these components are linked to China or Russia. This stringent measure implies that every new on-road vehicle, including motorcycles but excluding commercial vehicles over 10,000 pounds, electric scooters, and e-bikes, must adhere to these regulations. The aim is to prevent technologies that could pose potential security threats from infiltrating the U.S. market, ensuring that critical vehicle functions remain secure and independently controlled.

A phased implementation approach has been adopted for these rules, beginning with Model Year (MY) 2027 for software and extending to MY 2030 for hardware. This staggered timeline is purposed to minimize disruptions within the supply chain, allowing manufacturers ample time to adjust their operations and ensure compliance with the new regulations. By introducing a gradual rollout, the BIS intends to balance the urgency of national security concerns with the practical realities faced by automakers, ultimately giving the industry the necessary time to fully incorporate these changes without undue pressure.

Prohibited Activities and Penalties

Under the newly established regulations, it is strictly prohibited to knowingly import into the U.S. or sell within the U.S. any VCS hardware or completed CVs that incorporate VCS or ADS software connected to China or Russia. To ensure compliance with these rules, the associated penalties for violations are severe, encompassing both civil and criminal charges under the International Emergency Economic Powers Act (IEEPA) and fraud provisions in Title 18 of the United States Code. These legal repercussions are designed not only to penalize non-compliance but also to act as a deterrent, compelling companies to take these new regulations seriously.

The primary objective of these prohibitions is to avert national security threats by restricting foreign entities from engaging with and influencing critical automotive technologies within the United States. By imposing stringent consequences, the U.S. government aims to underscore the seriousness of these restrictions, ensuring that companies implement robust measures to verify the origins of their components and software. This not only strengthens the integrity of the automotive supply chain but also reassures the public and stakeholders that measures are in place to protect against foreign interference.

Key Terms and Revisions

To provide clarity and incorporate industry feedback, the final rule includes several defined and revised key terms. The term “connected vehicle” has been thoroughly revised to encompass all new, on-road vehicles except commercial vehicles over 10,000 pounds, explicitly including motorcycles but excluding electric scooters and e-bikes. This broad definition ensures that the regulations cover a wide range of vehicles that may be integrated with potentially sensitive technologies.

Additionally, the definition of “connected vehicle manufacturer” now includes those who install ADS software into otherwise completed CVs for sale within the U.S. This expanded definition ensures that entities involved in the final integration of automated driving technologies are also subject to compliance, thus tightening the loop on potential vulnerabilities. The term “covered software” has been refined to exclusively refer to components that directly enable the function of VCS or ADS, thereby excluding firmware and open-source software. Legacy subcomponents produced before March 17, 2026, have been granted exemptions, reflecting the BIS’s consideration for existing inventory and future adjustments.

The definitions of “VCS” and “VCS hardware” have undergone refinement to focus on components that “directly enable” radio frequency communications, deliberately excluding low-risk functions. These revisions aim to harmonize the necessity for robust security measures with the practical needs of the automotive industry, ensuring that undue burdens are not placed on uncritical functions while maintaining a tight grip on potential security vulnerabilities.

Compliance Obligations and Due Diligence Requirements

To align with the new regulations, manufacturers must adhere to several stringent compliance obligations, notably including the annual submission of certifications known as Declarations of Conformity. These certifications serve to confirm that neither the VCS hardware nor the covered software used is connected to China or Russia. To support these declarations, manufacturers are required to maintain comprehensive due diligence records, which must be preserved for a decade. This extensive record-keeping requirement underscores the importance placed on transparency and accountability within the supply chain, ensuring that manufacturers can unequivocally demonstrate their adherence to the new regulations.

The due diligence process itself demands significant efforts to verify compliance, necessitating a thorough documentation process. This level of scrutiny emphasizes the critical importance of maintaining a robust, secure supply chain and acts as a deterrent to potential infringements. By mandating rigorous documentation and long-term record retention, the BIS aims to ensure that every step within the supply chain is verifiable and accountable, significantly reducing the risk of non-compliant components entering the U.S. market.

Exemptions and Authorizations

Recognizing the complexity and diversity within the automotive industry, the final rule incorporates several exemptions and authorizations designed to minimize the regulatory burden on lower-risk transactions and specific scenarios. General and specific authorizations are offered for certain activities, and exemptions are available for small businesses and vehicles produced before the MY 2027/2030 deadlines. These provisions aim to strike a balance between maintaining stringent security measures and accommodating practical industry needs.

These exemptions are especially important for smaller entities that may lack the resources to rapidly adapt to the new regulations. By including these accommodations, the BIS acknowledges the diverse nature of the automotive supply chain and the varying capacities of different stakeholders to implement security measures. This approach allows for flexibility where the national security risk is minimal, ensuring that the overarching goal of protecting against foreign interference is achieved without undue hardship on smaller participants in the market.

Future Considerations

The U.S. Department of Commerce’s Bureau of Industry and Security (BIS) Office of Information and Communications Technology and Services (OICTS) has issued new regulations targeting the import and sale of connected vehicles (CVs) and related hardware and software originating from China and Russia. Published on January 16, 2025, these new rules are intended to bolster national security by significantly curtailing the involvement of China and Russia within the U.S. automotive supply chain. The main goal of these regulations is to decrease the risks linked with the potential control or excessive influence of critical automotive technologies by foreign entities, especially those from geopolitical rivals.

The restrictions address growing concerns about the infiltration of sensitive technologies by adversarial nations, which could potentially compromise national security and consumer privacy. By limiting the participation of Chinese and Russian companies in the U.S. market, the government seeks to protect critical infrastructure and maintain technological sovereignty. These measures reflect deepening tensions and the U.S. drive to secure autonomous, cyber-secure, and resilient automotive systems against foreign interference. The strategic approach underscores the significance of securing emerging automotive technologies and maintaining a competitive edge on the global stage, especially in light of the increasing geopolitical complexities.

Subscribe to our weekly news digest.

Join now and become a part of our fast-growing community.

Invalid Email Address
Thanks for Subscribing!
We'll be sending you our best soon!
Something went wrong, please try again later