Today, the U.S. Department of Commerce’s Bureau of Industry and Security (BIS) announced a final rule prohibiting "certain transactions involving the sale or import of connected vehicles integrating specific pieces of hardware and software, or those components sold separately, with a sufficient nexus to the People’s Republic of China (PRC) or Russia."

CTM reported in February that President Biden had directed BIS to investigate potential national security concerns related to Chinese access to Americans' "connected vehicles." BIS published an Advanced Notice of Proposed Rulemaking (ANPRM), through which it sought public comment on the issue.

Then in September, CTM reported that the Biden administration had issued a Notice of Proposed Rulemaking to address these concerns, pursuant to the Commerce Department's Information and Communications Technology and Services (ICTS) authorities (a White House fact sheet is here).

Today, BIS announced its final rule on this issue. As explained in the announcement, BIS and its Office of Information and Communications Technology and Services (OICTS) "have found that certain technologies originating from the PRC or Russia present an undue and unacceptable risk to U.S. national security." (Given the scale of Chinese and Russian production, the rule targets Chinese products rather than Russian ones). The rule sets out the core problem it is trying to address as follows:

the PRC and Russia are able to leverage domestic legislation and regulatory regimes to compel companies subject to their jurisdiction, including carmakers and their suppliers, to cooperate with security and intelligence services. Such control over companies and their products and services means that their equipment is easily exploitable by PRC and Russian authorities. The privileged access that the PRC and Russia may gain to connected vehicles through their components, including software and hardware, could enable those foreign adversaries to (1) exfiltrate sensitive data collected by connected vehicles and (2) allow remote access and manipulation of connected vehicles driven by U.S. persons.

As part of the announcement, National Security Advisor Jake Sullivan said: "Connected vehicles yield many benefits, but software and hardware sources from the PRC and other countries of concern pose grave national security risks. Today, we are taking strong action to protect Americans against these national security risks by safeguarding our critical infrastructure and automotive supply chain. President Biden has been clear: we will not hesitate to take needed action to protect the safety of the American people."

A White House fact sheet explains that "foreign adversary involvement in the supply chains of connected vehicles poses a significant threat in most cars on the road today, granting malign actors unfettered access to these connected systems and the data they collect." As Chinese automakers "aggressively seek to increase their presence in American and global automotive markets, through this final rule," President Biden is "delivering on his commitment to secure critical American supply chains and protect our national security."

According to the BIS announcement, the final rule "establishes that hardware and software integrated into the Vehicle Connectivity System (VCS) and software integrated into the Automated Driving System (ADS), the systems in vehicles that allow for external connectivity and autonomous driving capabilities, present an undue and unacceptable risk to national security when designed, developed, manufactured, or supplied by persons with a sufficient nexus to the PRC or Russia." According to BIS, "[m]alicious access to these critical supply chains could allow our foreign adversaries to extract sensitive data, including personal information about vehicle drivers or owners, and remotely manipulate vehicles."

In response to these concerns, today’s final rule "prohibits the import of VCS hardware or connected vehicles containing such hardware, and the import and sale of vehicles containing VCS or ADS software, with a sufficient nexus to the PRC or Russia." The rule also prohibits manufacturers "with a sufficient nexus to the PRC or Russia" from "selling new connected vehicles that incorporate VCS hardware or software or ADS software in the United States, even if the vehicle was made in the United States."

BIS noted that, "[a]t this time, given the complexity of the commercial vehicle supply chain, the final rule applies only to passenger vehicles (defined as those under 10,001 pounds)." However, BIS noted that it "intends to issue a separate rulemaking addressing the technologies present in connected commercial vehicles – including in trucks and buses – in the near future."

The software-related prohibitions will take effect for Model Year 2027, and the hardware-related prohibitions will take effect for Model Year 2030 (or January 1, 2029, for units without a model year). Prohibitions on the sale of connected vehicles by manufacturers with a sufficient nexus to China or Russia, even if manufactured in the United States, take effect for Model Year 2027.  

The final rule will become effective 60 days after publication, on March 17, 2025.

Former Biden administration trade official Peter Harrell called the new rule a "[w]in for U.S. national security."