On Jan. 16, 2025, US BIS published final rule in federal register, Mar. 17, 2025 effect.
On Sep. 23, White House reported proposal on connected vehicle risk.
White House issued fact sheet on Commerce Department's US BIS proposed rule to secure connected vehicle technology, supply chains from countries of concern.
Prohibit sale or import of connected vehicles that incorporate certain technology and import of particular components from countries of concern, specifically CHI and RUS.
Proposed rule made amendments by adding subpart D to 15 CFR Part 791, Securing the information and communications technology and services supply chain.
Follows BIS Mar. 2024 advance notice of proposed rulemaking (ANPRM), see #202776.
Background
Connected vehicles provide many benefits but also pose new and growing threats.
Vehicles’ connectivity creates opportunities to collect and exploit sensitive information.
Opportunities for malicious actors to disrupt operations of infrastructure or vehicles.
Proposed Rule
Prohibit import or sale of certain connected vehicle systems designed, developed, manufactured, supplied by entities with sufficient nexus to the PRC or Russia.
Covers vehicle connectivity systems (VCS), systems, components connect to outside, e.g. via Bluetooth, WiFi; automated driving systems (ADS), operate without driver.
On imports, sales of vehicles using VCS and ADS software, imports of VCS hardware.
Proposed procedures to let certain parties, such as small producers of vehicles, receive exemptions from prohibitions on exceptional basis, to minimize disruption to industry.
Prohibitions on software take effect for Model Year 2027, and prohibitions on hardware would take effect for Model Year 2030, or on Jan. 1, 2029 for units without model year.
Consultation
BIS soliciting comments on NPRM, due 30 days from publication in the federal register.
Sep. 2024 Fed Reg Proposal
On Sep. 26, 2024, US BIS issued notice of proposed rulemaking in federal register.
Comments for NPRM on connected vehicle technology are due by Oct. 28, 2024.
Jan. 2025 US BIS Final Rule, White House Fact Sheet
On Jan. 14, 2025, US BIS reported final rule prohibiting transactions involving sale, import of connected vehicles integrating specific pieces of hardware and software.
Or components sold, with a nexus to the People’s Republic of China (PRC) or Russia.
Software-related prohibitions take effect for model year 2027; hardware prohibitions take effect for model year 2030, or Jan. 1, 2029, for units without model year.
Prohibitions on sale of connected vehicles by manufacturers with sufficient nexus to the PRC or Russia, even if manufactured in US, take effect for model year 2027.
The final rule will become effective 60 days after publication, on Mar. 17, 2025.
On the same day, White House issued a fact sheet on safeguarding America from national security risks of connected vehicle technology from Russia and China.
Rule will help the US defend against PRC’s cyber espionage and intrusion operations, which continue to pose significant threat to US critical infrastructure and public safety.
Rule ensures infrastructure is not exposed to risk of foreign adversary-controlled supply chains that could provide bad actors with means to disrupt US infrastructure.
Jan. 16, 2025 US BIS Fed Reg Final Rule
On Jan. 16, 2025, US BIS published final rule in federal register, Mar. 17, 2025 effect.
