On January 16, 2025, the U.S. Department of Commerce’s Bureau of Industry and Security (BIS) published a final rule prohibiting the sale and importation of connected vehicles incorporating certain hardware and software components (or those components sold separately) with a sufficient nexus to the People’s Republic of China (PRC) or Russia. The new prohibitions go into effect on March 17, 2025.

BIS’s action follows its proposed rule released in September 2024. Unlike the proposed version, the final rule excludes from the scope of the prohibitions any vehicle with a gross vehicle weight rating (GVWR) of over 10,000 pounds. BIS warned, however, that this was simply due to the complexity of the commercial vehicle supply chain, and that it intends to issue a separate rulemaking addressing the national security risks presented in the commercial vehicle supply chain, “including trucks and buses,” in the near future.

The final rule prohibits (i) the importation of vehicle connectivity system hardware (or vehicles containing such hardware) and (ii) the importation and sale of vehicles that contain vehicle connectivity system or automated driving system software with sufficient nexus to the PRC or Russia. According to BIS’s press release, vehicle connectivity systems covered by the rule include “telematics control units, Bluetooth, cellular, satellite, and Wi-Fi modules.” As such, any software-enabled or programmable hardware component that directly enables the function of and is directly connected to vehicle connectivity systems would be covered by the prohibitions. The final rule would also prohibit transactions involving any “covered software,” which encompasses software-based components enabling the function of vehicle connectivity systems or automated driving systems at the vehicle level, to the extent such covered software has a sufficient nexus to China or Russia.

Notably, the final rule also prohibits manufacturers of connected vehicles who are owned by, controlled by, or subject to the jurisdiction or direction of the PRC or Russia, from knowingly selling in the United States any connected vehicles that incorporate vehicle connectivity system hardware or covered software, regardless of whether such software or hardware components were designed or developed by a person with sufficient nexus to the PRC or Russia.

BIS’s prohibition of the sale and importation of covered software takes effect with Model Year 2027. Hardware-related prohibitions will take effect with Model Year 2030, or January 1, 2029 for units without a model year. To facilitate compliance with the rules, BIS requires importers and manufacturers to submit annual declarations of conformity to the BIS. The final rule allows BIS to issue general authorizations for certain type of transactions. Regulated parties can also seek specific authorizations from BIS to engage in transactions otherwise prohibited by the final rules or advisory opinions for BIS to address the legality of prospective transactions.