Buckle Up! New Supply Chain Rules for Connected Vehicles and ADS

Department of Commerce Proposes Supply Chain Rules for Connected Vehicles and Automated Driving System Technology

Alert

The Department of Commerce Bureau of Industry and Security (“BIS”) recently proposed a rule aimed at mitigating national security risks associated with information and communications technology and services (“ICTS”) in connected vehicles. The proposed rule targets both software and hardware that supports vehicle connectivity systems and software that supports Automated Driving Systems (“ADS”). The proposed rule only applies to motor vehicles, i.e. vehicles that are permitted by states to be driven on public roads. This excludes golfcarts, other off-road vehicles, and vehicles that operate on rails.

As soon as the 2027 model year, vehicle manufacturers would be prohibited from importing connected vehicles containing software and ultimately hardware that support connectivity, such as Wi-Fi, Bluetooth, Sat Nav and other wireless communications that are developed, manufactured or supplied by companies affiliated with the People’s Republic of China (the “PRC”) and Russia. The prohibitions would also apply to vehicles manufactured in the U.S. which incorporate connected vehicle hardware and software from the PRC or Russia.

The proposed rule, designed to address national security concerns arising from the PRC’s and Russia’s involvement in this sector, has landed in the middle of a wave of uncertainty, as shifting US trade policy and projected tariff increases are already forcing businesses to scrutinize their supply chains and brace for potential disruptions. However, while current proposed tariff policies largely impact costs, the proposed rule creates an import authorization process and otherwise blocks imports of covered goods and software. At the heart of the issue lies BIS’s concern that foreign adversaries could exploit vulnerabilities in Vehicle Connectivity Systems (“VCS”) and ADS to compromise sensitive data, disrupt critical infrastructure, or even manipulate vehicle functions. This translates to immediate action for a vast network of players in the connected vehicle supply chain. Original Equipment Manufacturers (“OEMs”), importers, Tier 1 and Tier 2 suppliers all must adapt to the new landscape.

Supply Chain Transparency Takes Center Stage

The proposed rule prohibits certain transactions involving VCS hardware and covered software, which this summary addresses in greater detail in the following sections. This sweeping change will necessitate adjustments across the entire supply chain, impact OEMs, Tier 1 and Tier 2 suppliers, and potentially reshape existing business relationships. The proposed rule’s broad definition of “person owned by, controlled by, or subject to the jurisdiction or direction of a foreign adversary” casts a wide net, potentially affecting contracts and collaborations with foreign entities beyond direct ownership.

The proposed rule will compel U.S. businesses to re-evaluate their supply chains and potentially seek alternative sources for components that fall under the prohibitions. This shift could lead to increased costs and production delays. It may also incentivize a move towards increased domestic production of VCS hardware and covered software, potentially boosting U.S. manufacturing but also presenting challenges related to capacity and workforce development. While the rule may pose some positive benefits, the challenges companies must overcome will be steep, making the journey to the light at the end of the tunnel long and arduous.

Above all, the proposed rule sharply highlights the need for heightened due diligence practices throughout the supply chain. Companies must establish robust mechanisms to verify the origins of their components to ensure compliance with the new regulations. They should carefully assess the proposed rule’s implications for their specific operations and take proactive steps to ensure compliance while mitigating potential disruptions to their supply chains.

In the following sections, we will delve into the specific technology restrictions, the scope of the impacted suppliers, the timeline for compliance, and the steps U.S. companies should take to prepare for these new regulations.

Technology Restrictions

The proposal is expected to ultimately affect the vast majority of vehicles imported into or manufactured in the United States given the ubiquitous nature of Wi-Fi, Bluetooth and other connected vehicle systems in today’s vehicles. 

The proposal defines ADS as vehicle automation levels 3, 4 and 5 as defined by SAE International standard J3016, but does not impact level 2 driver assistance systems, which is the highest level of automation commercially available today. According to the proposal, connected vehicle hardware includes the controllers that support vehicle connectivity, networking or telematics units, cellular modems, Wi-Fi modules, Bluetooth modules, satellite navigation systems, satellite communication systems and other wireless communications or antennas. However, vehicle sensors necessary for ADS and vehicle control units that do not support vehicle connectivity are not subject to the proposal.  Vehicle key fobs are also not included in the proposal.

The proposal includes exceptions for low volume manufacturers of connected vehicles and connected vehicle hardware where:

• the connected vehicle will be operated infrequently on public roads;
• the connected vehicle will be used for display, testing, or research that will not be used on public roads; or
• the connected vehicles or connected vehicle hardware is imported for repair, alteration or competition off public roads and will be reexported within one year.

These exceptions are designed to ease the burden on smaller companies that might not have the same resources to comply with the new regulations. For example, a small startup company that produces a niche line of high end connected sportscars or connected electric delivery vehicles might qualify for the exception, allowing them to continue their operations without the same level of regulatory scrutiny as a major car manufacturer.

There is also a process for companies to apply to BIS for additional exemptions for the use of connected vehicle software or hardware from suppliers affiliated with the PRC or Russia based on a showing that the risks associated with the use of the hardware or software have been mitigated.

Scope of Impacted Suppliers

The proposed rule provides a number of examples of corporate structures that could result in a company being deemed “under the control of” the PRC or Russia. Prohibited suppliers could include companies organized under the laws of the PRC or Russia or with a principal place of business in the PRC or Russia, companies outside of the PRC or Russia which are directly or indirectly owned by a parent company which is subject to the laws of the PRC or Russia, and even the wholly-owned subsidiaries of U.S. companies formed under the laws of the PRC or Russia. Suppliers could also become prohibited through the affiliations of senior executives, board members, or minority investors.

However, the proposal is also designed to limit the burden on companies utilizing foreign nationals in their U.S.-based workforce. The prohibitions on affiliations with the PRC or Russia do not apply to persons employed by, or who contract with, manufacturers of connected vehicles or importers of connected vehicle hardware affiliated with the PRC or Russia solely based on their country of citizenship.

Timeline

The proposed rule deploys in phases. All vehicle hardware and software developed for model years prior to 2027 are exempt from this prohibition. 

• Software: The proposed rules would apply to connected vehicles with covered software beginning with the 2027 vehicle model year.
• Hardware: The proposed ruled would apply to connected vehicle hardware and vehicles incorporating connected vehicle hardware beginning with the 2030 model year. However, for vehicle hardware not associated with a particular model year, the proposed rule would apply beginning January 1, 2029.

Preparing for Compliance

In order to monitor compliance, the proposed rule would require anyone importing connected vehicle hardware or connected vehicles to submit a declaration of conformity to BIS. Only when a connected vehicle is manufactured in the U.S. without any foreign affiliation in the vehicle’s covered software, would a declaration of conformity not be required. 

The declaration of conformity requires identifying information about the vehicle or connected vehicle hardware, a certification that the declarant has not knowingly engaged in a prohibited transaction, a software bill of materials or a hardware bill of materials depending on whether the certification applies to a connected vehicle or connected vehicle hardware, and the manufacturer’s due diligence efforts to ensure that the connected vehicle software or hardware does not involve persons or entities affiliated with the PRC or Russia. 

What does this mean for your business?

With compliance potentially required in as little as two years, manufacturers of connected vehicles and ADS vehicles should start mapping their software sourcing to identify any affiliations with the PRC or Russia. Additionally, manufacturers may want to consider conducting a risk assessment of their current supply chain and begin evaluating existing contracts with suppliers to ensure appropriate clauses are included to address compliance with the proposed rule or negotiate new terms. Supply chain mapping is a critical activity for U.S. importers to undertake, given a wide range of legal authorities that restrict the import of goods into the U.S., including for forced labor concerns.

What comes next?

BIS is seeking further comment on technologies, software, and supply chain relationships that should be prohibited or exempt from this proposed rule. Given the shortened comment period, it appears BIS intends to move quickly to finalize the proposal. Be on the lookout for BIS to issue a final rule early next year.

If you have questions about how the proposed rule might affect your business you can reach out to Angela Gamalski, Tom Healy or Glynis Talley, or your Honigman attorney.