In September 2024, the US Department of Commerce’s Bureau of Industry and Security (BIS) published a proposal for a US-wide ban on the sale and import of ‘connected vehicles’ and corresponding (software) components if they have a significant connection to Russia or China. With these trade restrictions, the US government aims to compensate for competitive disadvantages for the US and to prevent possible data protection violations or even cyber attacks. It can be assumed that the far-reaching restrictions will affect almost all US companies in the automotive industry and their supply chains. On 16 January 2025, the final text of this regulation was published in the Federal Register of the US government and includes some adjustments compared to the draft.
(Initially) only passenger cars affected
The US government’s original aim was to cover almost all new vehicles under the regulation, with regard to software from model year 2027 and with regard to hardware from model year 2030 (for vehicle units without a model year from 1 January 2029). The final version limits the scope of application exclusively to passenger cars weighing up to 4,536 kilograms or 10,000 pounds.
This means that commercial vehicles, such as buses or trucks, are not covered by the regulation. In addition, vehicles that do not primarily use public roads (agricultural vehicles or mining vehicles) are excluded. However, the BIS already announced separate regulations for those types of vehicles that are not affected by the current regulation.
A broad understanding of ‘connected vehicles’ and connections to Russia and China
According to the US government, risks arise if (natural persons or legal entities from Russia or China have been ‘involved’ in the development or manufacture of certain vehicle components. In this context, subsidiaries of US companies are also covered if they are based in Russia or China and are established and organised under the laws of those countries. In the future, the (intentional) sale of connected vehicles in the US will be prohibited if they contain certain hardware or software components that are designed, developed, manufactured or supplied by persons with a sufficient nexus to China or Russia. The regulation applies even if the vehicle was manufactured or completed in the US. The ban also extends to the import of such vehicles and the import of VCS hardware.
The broad definition of ‘connected vehicles’ means that it does not matter whether vehicles can communicate with each other. Rather, it is sufficient that they are capable of Bluetooth, WiFi or satellite reception, for example. This includes software or hardware that primarily enables communication from and to connected vehicles and can also control subordinate systems in the vehicle. In particular, this applies to ‘VCS’ (vehicle connectivity systems) and ‘ADS’ (automated driving systems). The definition includes, for example, software that is subject to foreign ownership interests of any kind. By contrast, software that merely supports these functions is no longer covered by the final regulation. Similarly, ADS hardware is excluded from the scope of application.
New compliance requirements
Importers of VCS hardware and manufacturers of vehicles that use VCS hardware or contain the affected software are required to submit Declarations of Conformity. It must be assured that the company has not been involved in any prohibited activity. Records related to the Declarations of Conformity must be retained for ten years. In addition, the records should be attached to each relevant transaction, together with further supporting documents (contracts, import documents, sales invoices, etc.).
Outlook
Affected companies will immediately have to thoroughly review their supply chains. Any determined connection to Russia or China (which will be prohibited in the future) can have significant consequences. It may be necessary to change the product portfolio and/or switch suppliers at short notice. Supply chain risk assessments and compliance management systems will also have to take these aspects into account as a preventive measure.
Conclusion
The Biden administration’s proposal of September 2024 had already received bipartisan approval; therefore, it is not to be expected that the ban will be overturned by the new goverment from January, but rather, that it will take effect in mid-March 2025. A detailed article, which, however, still deals with the proposal of the regulation from September 2024, can be found on the website of our cooperation law firm Foley Lardner LLP.
The BIS press release on the final version is available at the following link.
back