Starting today, March 17, 2025, new U.S. regulations impose sweeping restrictions on the importation and sale of connected vehicles (CV) and related components with ties to China and Russia. Issued by the Bureau of Industry and Security (BIS), the Connected Vehicles Rule (CV Rule) aims to curb potential national security threats posed by foreign-made vehicle connectivity and automated driving systems. These restrictions, which will be phased in over the coming years, require businesses to conduct rigorous supply chain assessments and file compliance declarations. Importers and manufacturers must act now to ensure compliance and avoid steep penalties for violations.

Key components of the CV Rule are as follows:

Controls. The CV Rule focuses on two main categories: vehicle connectivity systems (VCS) and automated driving systems (ADS). VCS includes hardware and software that “directly enables” the transmission, reception, or processing of radio frequencies over 450 MHz. ADS encompasses hardware and software capable of performing the entire dynamic driving task for a connected vehicle.

Scope. Consistent with the Notice of Proposed Rulemaking published in September 2024 (NPRM), the CV Rule prohibits the import or sale of CVs and VCS hardware or ADS with a defined nexus, significant connection, or association to the People’s Republic of China (PRC) and Russia. This means the CV, VCS, or ADS was either (i) manufactured in the PRC or Russia, (ii) developed by companies based in the PRC or Russia, or (iii) supplied by entities with substantial ties to the PRC or Russia.

Implementation. Starting with Model Year (MY) 2027 for covered software and MY 2030 for VCS hardware, the CV Rule will be gradually implemented over the next several years to minimize supply chain disruptions. Specifically, the CV Rule will not apply to legacy software and components designed, developed, manufactured, or supplied in or from the PRC or Russia prior to March 17, 2026.

Declarations. Importers should conduct a supply chain assessment to document the origin of all hardware and software used in a connected vehicle. This supply chain assessment will allow for the identification and mitigation of risks while forming the basis for the BIS Declarations of Conformity (Declarations). BIS will require Declarations from importers and CV manufactures to certify compliance annually prior to importing or selling CVs with VCS hardware or covered software in the US.

Declarations may be filed using forms to be made available on the BIS website and should include:

• Confirmation that the VCS hardware or covered software is not designed, developed, manufactured, or supplied by persons owned by, controlled by, or subject to the jurisdiction or direction of the PRC or Russia.
• The importer has conducted due diligence to inform the Declaration and maintains supporting documents.
• The importer has taken all possible measures to ensure all information is furnished to the BIS upon request.
• The importer will submit material changes to Declarations within 60 days.
• The importer will maintain records for 10-years.

Authorization. The BIS will issue general authorizations for parties to engage in otherwise prohibited transactions, provided the party meets certain conditions. The general authorizations and conditions will be published on the BIS website. Expected general authorizations include exemptions for (i) small businesses, (ii) CVs not used on public roads, (iv) CVs imported for display, testing, or research, and (iv) CVs imported for repair. Specific authorizations may also be provided by the BIS following an application and approval process. These specific authorizations may be granted for higher-risk transactions, where importers and manufacturers apply to the BIS for permission to engage in transactions that would otherwise be prohibited.

Advisory Opinions. Importers and manufacturers that remain unsure whether a transaction is subject to a prohibition or requirement under the CV Rule may request an Advisory Opinion from the BIS’s Office of Information and Communications Technology and Services.

Penalties. Persons who violate, attempt to violate, conspire to violate, or knowingly cause a violation of the CV Rule may be subjected to civil and/or criminal penalties under the International Emergency Economic Powers Act. The maximum civil penalty is currently $368,136 per violation with the maximum criminal penalty of $1,000,000. If the BIS has reason to believe a violation has occurred, then BIS will inform the alleged violator with a written notice of the intent to impose a penalty. Alleged violators will then have 30 days to respond in writing and provide additional information to contest the penalty.

For importers of CVs, VCS, or ADS planning and supply chain due diligence will be critical in adapting to this new final rule.