On Sept. 26, the Department of Commerce’s Bureau of Industry and Security (BIS) and Office of Information and Communications Technology and Services (OICTS) published a Notice of Proposed Rulemaking (NPRM) entitled, “Securing the Information and Communications Technology and Services Supply Chain: Connected Vehicles.” The rule, if finalized as proposed, would ban the import of Vehicle Connectivity System (VCS) software or hardware—the systems that enable vehicles to connect to GPS, Bluetooth, cellular, satellite, and Wi-Fi—that are designed, manufactured, or supplied by persons or companies subject to the jurisdiction of the People’s Republic of China or the Russian Federation. The rule as proposed would also impose compliance obligations on importers and manufacturers of connected vehicles and related components.
This new BIS rule (RIN: 0694-AJ56) marks the next step in a process that President Joe Biden first announced in February 2024. The Biden Administration is concerned with the national security risks associated with “connected vehicles”—vehicles that integrate systems dedicated to connectivity with external networks or devices—designed and manufactured by foreign adversaries. The Biden Administration is particularly concerned that malicious actors could use VCS to conduct surveillance and sabotage of critical infrastructure. BIS issued an Advanced Notice of Proposed Rulemaking (ANPRM) on March 1 which solicited public comment on certain definitions, capabilities of connected vehicles, and potential consequences to U.S. national security. After reviewing and incorporating stakeholder feedback, BIS published the new NPRM on Sept. 26 with a 30-day public comment period. BIS likely hopes to finalize the rule before President Biden leaves office.
The import bans will apply to VCS hardware and software “designed, developed, manufactured, or supplied by persons owned, controlled by, or subject to the jurisdiction or direction of the People’s Republic of China, including the Hong Kong Special Administrative Region (PRC), or the Russian Federation (Russia).” This definition includes manufacturers incorporated under the laws of a foreign adversary, manufacturers with majority ownership by a foreign adversary, and potentially manufacturers with minority ownership by a foreign adversary, given the minority has veto power. The rule also suggests that BIS may grant exceptions for certain parties, such as small producers. Prohibitions of VCS software will take effect in Model Year 2027, while hardware prohibitions take effect in Model Year 2030.
If finalized and given effect, the rule will cover all types of “connected vehicles” and related components. “Connected vehicles” is defined under the proposed rule as an on-road vehicle that “integrates onboard networked hardware with automotive software systems to communicate via dedicated short-range communication, cellular telecommunications connectivity, satellite communication, or other wireless spectrum connectivity with any other network or device.” This includes any vehicles with VCS, such as passenger vehicles, motorcycles, buses, small and medium trucks, class 8 commercial trucks, and recreational vehicles. The breadth of the definition is intended to capture future trends in vehicle development so that the rule will ultimately affect “all new vehicles sold in the United States,” as indicated by BIS.
While the proposed regulation does not provide guidance as to what constitutes persons who have “designed, developed, manufactured, or supplied” VCS for purposes of compliance, BIS’s commentary on the proposed rule indicates that engaging in such activities in whole or in part are both prohibited. Therefore, even a small amount of involvement would trigger the rule’s prohibitions and lead to penalties. BIS seeks to penalize knowing violations according to the knowledge standard set forth in the Export Administration regulation (15 C.F.R. § 772.1), with penalties including both monetary and injunctive relief. Before being penalized, however, violators could expect to receive a pre-penalty notice, allowing them to respond within 30 days before an official issuance of a finding of violation. Monetary penalties can range up to $368,136 per violation for civil penalties, and up to $1 million and/or imprisonment up to 20 years for willful violation for criminal penalties.
Compliance obligations are imposed on importers and manufacturers of covered hardware and vehicles containing covered software and extend also to original equipment manufacturers and components suppliers. Targeted parties will be required to file declarations certifying their compliance at least 60 days before importing or selling covered items into the United States. A Declaration of Conformity would require the declarant to certify that it has not knowingly engaged in a transaction prohibited under the rule and to provide detailed information regarding the hardware and/or software to be imported or sold, including providing documentation of supply chain due diligence conducted to verify compliance. Any material changes to a prior deceleration must be reported within 30 days. The proposed rule also requires maintenance of record related to the Declaration of Conformity for a period of 10 years.
Interested parties may submit comments on the NPRM until Oct. 28. BIS already sought comments on how to craft the rule in its ANPRM. Commenters touched on what specific parties would be targeted by the rule, the challenge of implementing an import ban, the potential difficulty of sourcing alternative providers, and negative impacts regulation could have on U.S. innovation and competitiveness, among other topics. Stakeholders with opinions on these or other relevant topics may submit comments by the Federal eRulemaking Portal at docket number BIS-2024-0005 or by email directly to connectedvehicles@bis.doc.gov with “RIN 0694-AJ56” in the subject line.
