The U.S. Department of Commerce’s Bureau of Industry and Security (BIS) has promulgated a Final Rule prohibiting the import and sale of connected vehicles and related components linked to the People’s Republic of China (PRC) and Russia, citing critical national security concerns. These rules represent a pivotal shift in U.S. automotive supply chain regulations, emphasizing the need for vigilance and proactive compliance by stakeholders across the industry.

Expanded Compliance Obligations

Although the final rule does not mandate formal certification, suppliers are now required to scrutinize the origins of Vehicle Connectivity Systems (VCS) hardware and Automated Driving Systems (ADS) software to ensure compliance. Suppliers must exclude components with links to the PRC or Russia, with significant implications for sourcing practices and operational processes.

To address these challenges, many suppliers are exploring partnerships with third-party certification firms to assist in supply chain mapping and regulatory compliance. These firms provide specialized support to ensure alignment with U.S. regulations:

• Regulatory Compliance Consultants
  • Offer tools, training, and industry-specific strategies for supply chain compliance.
  • Assist in establishing robust processes for meeting evolving regulatory requirements.
• Cybersecurity and IT Compliance Firms
  • Evaluate and certify software and hardware for security vulnerabilities.
  • May expand their offerings to include BIS-specific compliance as the rule is fully enacted.
• Automotive-Specific Compliance Firms
  • Focus on connected vehicle systems, offering cybersecurity testing and risk assessments tailored to the automotive industry.

Limited OEM Guidance

Original Equipment Manufacturers (OEMs) have provided limited direction on how they will interpret and implement the final rule. However, several have engaged in the rulemaking process through public comments and requests for compliance extensions. OEMs may eventually require declarations or certifications from their supply base, even in the absence of a formal BIS mandate. This highlights the importance of proactive supplier engagement and preparation to meet potential OEM requirements.

Implications for Automotive Suppliers

The final rule is poised to profoundly impact automotive suppliers, particularly those sourcing components from the PRC or Russia. As we previously advised, key considerations include:

• Supply Chain Transparency: Suppliers must conduct thorough due diligence to identify components with links to the PRC or Russia. This requires comprehensive mapping of supply chains and ensuring traceability down to sub-suppliers.
• Increased Costs: Transitioning to alternative suppliers or technologies may drive up costs and disrupt existing contracts.
• Collaboration Challenges: Suppliers must work closely with OEMs and industry organizations to navigate evolving requirements.

Recommendations for Compliance

To mitigate risks and align with the new regulations, automotive stakeholders should take the following steps:

• Conduct a Supply Chain Assessment
  • Map the origins of all hardware and software used in connected vehicles.
  • Identify and mitigate risks associated with PRC- or Russia-linked components.
• Engage Third-Party Certification Firms
  • Partner with firms specializing in supply chain mapping, cybersecurity evaluations, and compliance certifications to streamline processes and ensure regulatory alignment.
• Collaborate with Industry Groups
  • Engage with organizations like the Alliance for Automotive Innovation and Motor & Equipment Manufacturers Association (MEMA) to share insights and develop collective strategies for compliance.
• Prepare for OEM Requirements
  • Anticipate the possibility of OEM-mandated certifications and declarations, and begin preparing the necessary documentation and processes to meet these demands.

While the regulatory landscape remains dynamic, proactive planning, thorough due diligence, and strategic collaboration will be critical for suppliers and manufacturers to adapt to the BIS’s final rule. By aligning their practices now, companies can minimize disruptions and position themselves for long-term compliance and competitiveness in a rapidly evolving market.

Elizabeth Morales-Saucedo contributed to this article