BIS Proposes Rules to Protect from Chinese and Russian Connected Vehicle Technology

On September 23, 2024, the Department of Commerce’s Bureau of Industry and Security (BIS) released for public inspection a Notice of Proposed Rulemaking that seeks to prohibit the sale or import of connected vehicles (CVs) with certain hardware and software that have a sufficient nexus to the People’s Republic of China (PRC) or Russia. If the Vehicle Connectivity System (VCS) hardware and the VCS and Automated Driving System (ADS) software are designed, developed, manufactured or supplied by persons owned by, controlled by, or subject to the jurisdiction or direction of the PRC or Russia, the transactions outlined below would be prohibited.

This proposed rule, which will be formally published in the Federal Register on September 26, builds on a related Advance Notice of Proposed Rulemaking (ANPRM) issued by BIS earlier this year. The fast-moving evolution of the regulations suggests the Biden Administration is viewing “the threats caused by foreign automobiles and supply chains” as a priority. The public has 30 days after the publication date (with an expected deadline of October 28) to submit comments on the NPRM.

The VCS is the set of systems that allow the vehicle to communicate externally, including telematics control units, Bluetooth, cellular, satellite and Wi-Fi modules. The ADS includes the components that collectively allow a highly autonomous vehicle to operate driver-less. Together, the VCS and ADS have significant control over and access to critical vehicle functions. In the NPRM, BIS expressed concerns about malicious, remote manipulation of CVs on U.S. roads and collection of sensitive U.S. data, including data on U.S. critical infrastructure through these CVs.

If the VCS hardware and the VCS/ADS software (collectively referred to as “covered software”) are designed, developed, manufactured or supplied by persons owned by, controlled by, or subject to the jurisdiction or direction of the PRC or Russia, the transactions outlined below would be prohibited:

1. VCS Hardware Importers from knowingly importing into the United States certain hardware for VCS;
2. CV manufacturers from knowingly importing into or selling within the United States completed CVs that incorporate covered software; and
3. CV manufacturers who are owned by, controlled by, or subject to the jurisdiction or direction of the PRC or Russia from knowingly selling into the United States completed CVs that incorporate VCS hardware or covered software.

BIS defines “person owned by, controlled by, or subject to the jurisdiction or direction of a foreign adversary” as:

• any person, wherever located, who acts as an agent, representative or employee, or any person who acts in any other capacity at the order, request, or under the direction or control, of a foreign adversary or of a person whose activities are directly or indirectly supervised, directed, controlled, financed or subsidized in whole or in majority part by a foreign adversary;
• any person, wherever located, who is a citizen or resident of a foreign adversary or a country controlled by a foreign adversary, and is not a U.S. citizen or permanent resident;
• any corporation, partnership, association or other organization with a principal place of business in, headquartered in, incorporated in, or otherwise organized under the laws of a foreign adversary or a country controlled by a foreign adversary; or
• any corporation, partnership, association or other organization, wherever organized or doing business, that is owned or controlled by a foreign adversary, to include circumstances in which any person identified in paragraphs (a) through (c) possesses the power, direct or indirect, whether or not exercised, through the ownership of a majority or a dominant minority of the total outstanding voting interest in an entity, board representation, proxy voting, a special share, contractual arrangements, formal or informal arrangements to act in concert, or other means, to determine, direct or decide important matters affecting an entity.

This would include not only companies based in the PRC or Russia, but other entities subject to control by the PRC or Russia. For example, Company A, that is majority owned in aggregate by multiple state-owned enterprises and state-owned investment funds of the PRC or Russia would be considered “owned by” the PRC or Russia. Another example is if Company A were incorporated in the United States, but is a wholly owned subsidiary of Company B, which is a state-owned enterprise of the PRC or Russia. Because Company B is a state-owned enterprise, Company A would be considered “owned by” the PRC or Russia.

Should a final rule be issued in line with the NPRM, the prohibitions on software would take effect for Model Year 2027 and the prohibitions on hardware would take effect for Model Year 2030, or January 1, 2029 for units without a model year, providing industry allegedly enough time to adjust their existing supply chains and plans for future supply chains. BIS anticipates the rule to primarily impact market participants who could be considered VCS hardware importers or CV manufacturers, such as original equipment manufacturers (OEMs) and importers of completed CVs, as well as Tier 1 and Tier 2 suppliers of VCS hardware. However, automotive manufacturers and the broader automotive supply chain would need to be aware of and plan for the potential supply chain impacts of these rules.