At a Glance
- The BIS proposed rule prohibits knowingly importing or selling automated vehicles and vehicles with connective services like Bluetooth or Wi-Fi if the automated or connected service hardware or software comes from a company owned by, controlled by, or subject to the jurisdiction or direction of China or Russia.
- These prohibitions go into effect for software starting Model Year (MY) 2027 and MY 2030 for hardware or after January 1, 2029, if the product is not connected to a MY.
- The proposed rule is estimated to impact $2.23 billion in automotive industry inputs, a decrease in car sales and an increase in car prices.
- Companies in the automotive industry will need to analyze their full supply chain to determine if any parts incorporate hardware or software that would prevent the sale of cars in the United States.
- Comments on the BIS proposed rule are due on October 28, 2024.
What Happened?
On September 26, 2024, the U.S. Department of Commerce’s Bureau of Industry and Security (BIS) published a proposed rule titled, “Securing the Information and Communications Technology and Services Supply Chain: Connected Vehicles.”
If finalized, the rule would prohibit the sale or import of cars that incorporate certain hardware or software manufactured in countries of concern, specifically China and Russia. (BIS also identified Cuba, Iran, North Korea and Venezuela’s Nicholas Maduro as foreign adversaries.) BIS estimates that this rule would significantly impact the U.S. automotive marketplace, increase government oversight of the U.S. car supply chain, and make American companies less competitive globally.
What Are the Impacts of This Rule?
BIS estimates that the proposed rule would impact $2.32 billion in inputs for the U.S. automotive industry and directly impact hundreds of companies. Additionally, BIS estimates that the total number of vehicles sold in the U.S. will decrease by 26,000 and the costs of vehicles will increase.
Finally, BIS estimates that this rule will make American companies less competitive in the global market.
Which Companies Are Impacted by This Rule?
The entire car vehicle supply chain is potentially impacted by this rule — from the original equipment manufacturers (OEMs) who have supply chain agreements to companies that manufacture or design various parts of vehicles.
Specifically, any VCS hardware importer or connected vehicle manufacturer is directly impacted by this rule. If a VCS hardware importer or connected vehicle manufacturer is “owned by, controlled by, or subject to the jurisdiction or direction of China or Russia” (emphasis added), it is prohibited from selling vehicles in the United States that incorporate vehicle connectivity system (VCS) hardware or software. Specifically, VCS hardware or software prohibitions apply when they are designed, developed, manufactured, or supplied by companies subject to Chinese or Russian influence.
BIS further defines a company that is “owned by, controlled by, or subject to the jurisdiction or direction of a foreign adversary” as a company that is any of the following:
- Under financial control by a foreign adversary
- A citizen of a foreign adversary and not the United States
- Any corporation that is at the behest of the laws of a foreign adversary
- Any corporation that is owned by a foreign adversary
This means that companies will need to analyze their full supply chain to determine if any part of their supply chain meets these requirements. Only companies that do not fit the description above or do not utilize software and hardware from foreign adversaries are able to sell vehicles in the United States.
VCS hardware importers and connected vehicle manufacturers have three compliance mechanisms:
- Declarations of conformity that allow companies to self-certify once per calendar or model year to BIS that the company has not engaged in prohibited transactions
- General authorizations that allow VCS hardware importers or connected vehicle manufacturers to engage in otherwise prohibited transactions without needing to notify or seek approval from BIS
- Specific authorizations that allow VCS hardware importers or connected vehicle manufacturers to engage in otherwise prohibited transactions that do not meet a general authorization by showing that the activity does not present an undue or unacceptable risk to U.S. national security
When Do the Requirements Go Into Effect?
- Connected vehicle manufacturers who are owned by, controlled by, or subject to the jurisdiction or direction of China or Russia would be prohibited to sell in the United States starting in MY 2027.
- VCS hardware importers who are owned by, controlled by, or subject to the jurisdiction or direction of China or Russia would be prohibited from importing starting in MY 2030, or if the VCS hardware is not associated with a vehicle MY, would be prohibited from importing starting January 1, 2029.
What Is BIS’s Justification for the Proposed Rule?
BIS’s justification for proposing this rule is to address undue or unacceptable risks to national security involving information and communications technology and services (ICTS).
This proposed rule follows an advance notice of proposed rulemaking and BIS investigation into the risks and vulnerabilities associated with components critical to the functioning of connected vehicles. BIS raises concerns that VCS and automated driving systems (ADS) are vulnerable to manipulation when they are designed, developed, manufactured or supplied by foreign governments. Additionally, BIS states there currently are no regulations addressing the potential risks to national security or to the security and safety of Americans from VCS and ADS systems.
Important Definitions
Connected Vehicle
BIS defines a connected vehicle as “[a] vehicle driven . . . primarily for use on public streets, roads, and highways, that integrates onboard networked hardware with automotive software systems to communicate via dedicated short-range communication, cellular telecommunications connectivity, satellite communication, or other wireless spectrum connectivity with any other network or device.” Connected vehicles are primarily used on public roadways that feature systems that enable telecommunication connectivity over short or long ranges. Vehicles operated only on a rail line are not included in this definition.
Connected Vehicle Manufacturer (CVM)
BIS defines a connected vehicle manufacturer to mean Americans that (1) manufacture or assemble completed connected vehicles in the United States or (2) import completed connected vehicles for sale in the United States.
Vehicle Connectivity System (VCS)
BIS defines a vehicle connectivity system as “a hardware or software item for a completed connected vehicle that has the function of enabling the transmission, receipt, conversion, or processing of radio frequency communications at a frequency over 450 megahertz.” Simply, the VCS collects data from onboard sensors such as GPS, accelerometers, and gyroscopes, as well as wireless technology such as Bluetooth and Wi-Fi. Some systems use cameras and microphones to facilitate facial recognition of drivers, or to respond to voice commands of drivers.
Vehicle Connectivity System (VCS) Hardware Importer
BIS defines a VCS hardware importer as a person who imports VCS hardware for further manufacturing, integration, resale or distribution.
Automated Driving Systems (ADS)
BIS defines automated driving systems as “hardware and software that, collectively, are capable of performing the entire dynamic driving task for a completed connected vehicle on a sustained basis, regardless of whether it is limited to a specific operational design domain (ODD).”
When Are Comments Due to BIS?
Comments to BIS on the proposed rule are due on October 28, 2024.
