Update: as of today (14 January 2025), the final version is available.
There is one significant change to the first draft: lorries, buses and co. are exempt from the regulation, while it still applies to (regular) cars and their components. This will have far-reaching consequences for European OEMs and suppliers. In order to avoid negative effects, you should evaluate the issue immediately and check to what extent you are affected. You can find the full text of the decision here.
Feel free to get in touch, we are happy to support you.
The U.S. Department of Commerce’s Bureau of Industry and Security (BIS) recently published a proposal for a regulation that would prohibit the sale and import of connected vehicles and related (software) components – in all U.S. states if they have a significant connection to Russia or China. With this trade restriction, the American government wants to compensate for the competitive disadvantages for the USA on the one hand, and prevent possible data protection violations or even cyber-attacks on the other. It can be assumed that the far-reaching restrictions will affect almost all companies in the automotive industry.
Content and objective of the trade restriction
The government’s goal is to include almost all new vehicles from the 2027 model year onwards with regard to software, and from the 2030 model year with regard to hardware under the new regulation. Therefore, the term ‘connected vehicle’ is defined independently: it is not primarily important that vehicles can communicate with each other, but it is sufficient that they are capable of Bluetooth, WiFi or satellite reception, for example. A few exceptions are foreseen, for example, with regard to vehicles that do not drive on the road (agricultural vehicles or mining vehicles).
The ban is intended to refer to software or hardware that primarily enables communication to and from networked vehicles and can also control subordinate systems in the vehicle. This applies in particular to ‘VCS’ (‘vehicle connectivity systems’) and ‘ADS’ (‘automated driving systems’), i.e., vehicle networking systems and automated driving systems. This is exactly where the US government sees risks if people (natural or legal) from the two countries were ‘involved’ in development or production – the terms have so far been defined very broadly. It goes even further and includes in the definition, software that supports these functions and software in which there is a foreign property interest of any kind. This means that virtually any type of software that was not fully developed by US companies in the USA can be affected by the regulation.
Specifically, the (knowing) sale of connected vehicles containing VCS hardware or other covered software will be prohibited in the USA in the future if the seller is in any way connected to China or Russia, even if the vehicle was manufactured or completed in the USA. If such vehicles are equipped with software that comes ‘from the pen’ of people with ties to Russia or China, the import of these vehicles is also prohibited. If VCS hardware has been designed, developed, manufactured or supplied by persons associated with China or Russia, it may also not be imported into the USA. It is important to note that these can also be subsidiaries of US companies, provided that they are based in Russia or China and are founded and organised according to the law applicable there.
Associated new compliance requirements
Importers of VCS hardware and vehicle manufacturers will be obliged to submit declarations of conformity for vehicles that use VCS hardware or contain the affected software. In particular, it must be assured that it has not been involved in any prohibited transaction – as described above. Records related to the declaration of conformity must be kept for ten years. In addition, the records should be attached to each relevant transaction, as well as other supporting documents (contracts, import documents, sales invoices, etc.).
Outlook
Affected companies will have to thoroughly review their supply chains. In this context, it will be necessary to change the product portfolio and/or acquire new suppliers who have no connection to Russia or China. However, also with a view to the focus on supply chain responsibility, a due diligence review will probably have to be carried out and a compliance management system for the supply chain will need to be developed, which in turn will require appropriate certification. Currently, the first draft of the regulation is being revised, one should look forward to the upcoming publication on a revision, which will then be introduced into the legislative process. We will report on this.
Conclusion
The Biden administration’s proposal had received bipartisan approval; therefore, it is not to be expected that the ban will be overturned by the new government from January, but rather, that the proposal will come into force with possible slight amendments.
A detailed article on the topic can be found on the website of our cooperation law firm Foley Lardner LLP.
Related links:
> A detailed article on this topic can be found on the website of our partner law firm Foley Lardner LLP. A corresponding update was published on January 15.
> Office of Information and Communications Technology and Services (OICTS)
> Federal Register: Securing the Information and Communications Technology and Services Supply Chain: Connected Vehicles
> Federal Register: Connected Vehicles Rule