Clifford Chance

Set to go into effect March 16, 2025, the U.S. Department of Commerce's Bureau of Industry and Security (BIS) now Final Rule aims to secure the supply chains of Connected Vehicles from the People's Republic of China (PRC) and Russia – by prohibiting the import or sale of certain connected vehicle systems designed, developed, manufactured, or supplied by entities with a sufficient nexus to the PRC or Russia.

Connected Vehicles utilize specific pieces of hardware and software that allow for both Vehicle Connectivity Systems (VCS) and Automated Driving Systems (ADS). By virtue of permitting external connectivity, these vehicles are allegedly more vulnerable to malicious operators who can access and collect sensitive data and remotely manipulate cars on American roads. Thus, the Department of Commerce has issued the final rule to remedy this loophole in domestic security. Notably, this rule introduces several new requirements and modifications compared to the Notice of Proposed Rulemaking (NPRM), which we wrote about in our briefing: New Barriers to Entry: The Department of Commerce's Proposed Rule to Ban Imports of Chinese or Russian "Connected" Vehicles and Parts.

PROHIBITED TRANSACTIONS

The Department of Commerce now deems VCS and ADS software and hardware as technologies that pose an undue or unacceptable risk of sabotage to BIS's Office of Information and Communications Technology and Services (OITCS) under Executive Order 13873. The term, VCS, includes the set of systems that allow the vehicle to communicate externally, along with its telematics control units, Bluetooth, cellular, satellite, and Wi-Fi modules. The ADS includes the components that collectively allow a highly autonomous vehicle to operate without a driver behind the wheel.

The final prohibitions generally restrict VCS hardware importers and connected vehicle manufacturers from knowingly importing into the United States VCS hardware that is designed, developed, manufactured, or supplied by persons owned by, controlled by, or subject to the jurisdiction or direction of the PRC or Russia. However, BIS emphasizes that the determination of the nationality of persons who own or control the hardware or software is not based solely on the country of citizenship of one or more natural persons who are employed by, contracted by, or otherwise similarly engaged in such actions through the entity designing, developing, manufacturing, or supplying the software. In addition, connected vehicle manufacturers are prohibited from knowingly selling within the United States completed connected vehicles using software designed or supplied by persons of the PRC or Russia, and from offering commercial services in the US that utilize completed connected vehicles that incorporate ADS.

The software prohibitions will go into effect for Model Year 2027 vehicles and the hardware prohibitions will take effect for Model Year 2030 vehicles. Although not explicit, the prohibitions implicitly exclude vehicles not used on public roads such as agricultural and mining vehicles. Notably, the final rule, in a change from the NPRM, excludes commercial vehicles and vehicles with a gross-vehicle weight of over 10,000 pounds.

DECLARATION REQUIREMENTS FOR IMPORTERS AND MANUFACTURERS

In the final rule, BIS updated the Declarations of Conformity requirement to clarify the certification, narrow the information required to be submitted, and add recordkeeping requirements. The final rule continues to require VCS hardware importers to submit annual Declarations of Conformity to BIS at least 60 days prior to the import of such hardware; connected vehicle manufacturers must submit the same at least 60 days prior to the first sale or import of each model year of a completed connected vehicle in the US created with the covered software.

Entities may also now certify to BIS that they have conducted due diligence into their covered software and VCS hardware supply chains without needing to submit supporting documentation. In addition, BIS will only require retention of minimal documentation related to products for which a Declaration of Conformity is submitted.

Connected vehicle manufacturers and VCS hardware importers may, in lieu of submitting a new Declaration of Conformity each year, submit a confirmation that the prior Declaration of Conformity remains accurate and associates the relevant new model year of vehicles (if known).

No Declaration of Conformity is required if the only foreign interest in a transaction arises from a foreign person’s equity ownership of a U.S. person, whether through ownership of public shares or otherwise. This exemption has no effect on transactions where a foreign interest arises from a foreign entity’s design, development, manufacture, or supply of VCS hardware or covered software for a U.S. person or where equity ownership allows a foreign person to exercise control over the U.S. person.

The final rule includes further exemptions, including for parts that are imported for purposes of warranty or repair of a completed connected vehicle with a model year prior to 2030.

AUTHORIZATIONS FOR OTHERWISE PROHIBITED TRANSACTIONS

The NPRM enumerated general authorizations under which a regulated entity would be permitted to engage in an otherwise prohibited transaction without need to notify BIS. In the final rule, BIS simplified the general authorizations procedure such that importers and manufacturers can simply refer to BIS's website for details about their general authorizations as such permissions are determined and published. Further, the final rule permits VCS hardware importers and connected vehicle manufacturers to rely on a general authorization to engage in an otherwise prohibited transaction if they meet the stated requirements or conditions identified in the general authorization and are not subject to restrictions.

Under the final rule, BIS may approve specific authorizations for a period of less than one calendar year on a case-by-case basis under the following circumstances:

• 2027 model years that include covered software and are actively being sold or imported as of the effective date of this rule
• Covered software and VCS hardware supply chains that are affected by force majeure events
• As a result of a corporate merger, investment, acquisition, joint venture, or conversion of equity (such as from debt) that occurs during model year production
• As a result of the closure or relocation of facilities involved in the production of covered software or VCS hardware; and v) Other instances as determined by BIS.

BIS further emphasized that the use of third parties to assist with compliance checks is generally voluntary but may be required by BIS as a condition for granting a specific authorization.

RECORDKEEPING AND REPORTING

The final rule continues to require connected vehicle manufacturers and VCS hardware importers to maintain complete records related to any transaction for which a Declaration of Conformity, general authorization, or specific authorization would be required, for a period of 10 years.

ENFORCEMENT

The final rule only re-ordered the listing of enforcement actions, but the substance of the enforcement actions and procedures remains the same. Subsequently, if BIS determines a willful violation has occurred, the agency will issue a pre-penalty notice informing the alleged violator of BIS’s intent to impose a monetary penalty. A pre-penalty notice can be issued either in writing, electronically, or by mail. Thereafter, BIS may impose civil or criminal penalties of not more than $1,000,000, or if a natural person, for not more than 20 years imprisonment, or both.

POTENTIAL IMPACT ON GLOBAL BUSINESS

As the final rule comes into force, more details will emerge to demonstrate how this final rule could impact global supply chains. Thus, it seems that the final rule could force manufacturers in third-party countries like Germany, South Korea, and Japan to find suppliers other than China or Russia for they key technology-related component parts. For now, impacted companies should evaluate whether they qualify for any exemptions, continue to map their supply chains, undertake the necessary due diligence and consider how to prepare the Declaration of Conformity.