BIS Connected Vehicles Rule: Supply Chain Due Diligence Required

Your tier-1 supplier assures you their components are not made in China or Russia. The problem is, you’ve never asked about who owns them. That assumption-that country of manufacture suffices for national security compliance-no longer holds. On January 14, 2025, the Bureau of Industry and Security released its final rule governing connected vehicles, fundamentally reframing supply chain due diligence for automotive manufacturers and suppliers. The rule, effective March 17, 2025, requires that every company involved in the design, development, manufacturing, or supply of connected vehicle systems must now certify that their entire supply chain-from ownership and control, down through multiple tiers-maintains no “sufficient nexus” to the People’s Republic of China or Russia. By 2030, an estimated 95% of new vehicles sold globally will be connected, making this an existential supply chain challenge for every major automotive manufacturer.

The BIS rule is historically aggressive. It targets passenger vehicles under 10,001 pounds and covers two critical technologies: Vehicle Connectivity Systems (VCS)-hardware and software enabling offboard communication-and Automated Driving Systems (ADS)-software enabling autonomous vehicle operation. The Department of Commerce noted that future rulemaking will extend to commercial vehicles, trucks, and buses. The trajectory is clear: scope will expand.

Compliance with the BIS rule is not optional, and the timelines are compressed. Manufacturing and sales restrictions phase in across three periods with escalating restrictions. For Model Year 2027, manufacturers cannot sell connected vehicles into the U.S. market if owned by, controlled by, or subject to PRC or Russian entities. The same year, VCS software and ADS software with sufficient nexus to these jurisdictions become prohibited. By Model Year 2030 (or January 1, 2029 for components without model year), VCS hardware with sufficient nexus to PRC or Russia is banned. This three-phase approach gives manufacturers a window to redesign supply chains, but only if they act immediately.

What the Rule Actually Requires From Supply Chains

What “sufficient nexus” means in practice is more complex than simple country of origin. Under the rule, an import is prohibited if it is “designed, developed, manufactured, or supplied by persons owned by, controlled by, or subject to the jurisdiction or direction of” the PRC or Russia. This requires tracing ownership through corporate structures, identifying controlling interests, and assessing whether any company in the supply chain-no matter the tier-falls under Chinese or Russian state direction or private investment. A Czech-based manufacturer with partial Chinese state ownership, a German components supplier acquired by a Russian oligarch, or a Taiwanese semiconductor producer receiving Beijing direction-all fall within the prohibition’s scope.

The practical burden falls squarely on Original Equipment Manufacturers and their supply base. Each OEM must ensure that suppliers at every tier submit annual Declarations of Conformity certifying that their products and supply chains meet the rule’s requirements. VCS hardware importers and connected vehicle manufacturers face the strictest scrutiny; they must maintain detailed records of ownership, control, and sourcing decisions. The Department of Commerce has outlined civil penalties of $368,136 per violation and criminal penalties reaching $1,000,000 for willful violations. But the challenge is even greater: BIS acknowledged that automotive manufacturers have “substantially weaker” understanding of tier-2 and tier-3 suppliers compared to direct tier-1 relationships. That weakness is now a compliance liability.

The Challenge of Mapping “Sufficient Nexus”

Mapping the full supply chain requires moving beyond traditional procurement systems. OEMs and suppliers must now identify every company involved in the design, development, and manufacturing of VCS and ADS components, including semiconductor manufacturers, software developers, integrators, and subcontractors. Each entity must be vetted for ownership structure: shareholders, state-owned enterprises, government direction or control, and subsidiary relationships with entities on the BIS Entity List. For suppliers operating across 75+ trade data reporting countries, cross-referencing corporate ownership with trade databases becomes essential.

The rule’s language about control is deliberately broad. Control is not limited to majority ownership; it encompasses the ability to direct decisions through minority stakes, board representation, contractual arrangements, or regulatory authority. A venture capital fund based in Hong Kong holding a minority stake in a German software company could trigger sufficient nexus if it is understood to be a vehicle for Chinese state investment. A contract with performance clauses allowing a Russian parent company to direct operations could constitute control. The rule requires manufacturers and suppliers to map not just legal ownership but the practical mechanisms of corporate governance and decision-making.

Why Tier-2 and Tier-3 Vendors Are the Compliance Gap

The path forward demands immediate action on multiple fronts. Manufacturers must commission detailed audits of their supply chains, focusing first on VCS and ADS components-the technologies subject to earliest restrictions. These audits should identify all suppliers, sub-suppliers, and component sources, then cross-reference each against available corporate ownership records and trade data. For tier-2 and tier-3 suppliers with limited transparency, this may require direct engagement, contractual information requests, or third-party compliance partners who maintain updated corporate ownership databases. BIS acknowledged the “substantially weaker” understanding manufacturers have of deeper supply chain tiers, signaling that suppliers with better visibility will have a compliance advantage. For companies relying on decades-old supplier relationships with limited ownership change documentation, the challenge is acute. Remediation-substituting suppliers, redesigning components, or securing supply chain exclusions-requires planning that cannot wait for the 2027 prohibition date.

Building a Defensible Compliance Program Before 2027

The connected vehicle rule represents a watershed moment in how governments regulate global automotive supply chains. It moves beyond traditional export controls focused on where things are made to a more invasive standard: who controls the entities that make them. For trade compliance practitioners, general counsel, and supply chain executives at automotive OEMs and suppliers, the implication is clear-country-of-origin verification is no longer sufficient. Today’s automotive supply chains span dozens of countries and include hundreds of sub-tier suppliers in jurisdictions with opacity around ownership and control. Navigating this environment requires tools that integrate corporate ownership data with trade records, allowing manufacturers to build a defensible picture of their supply chains before the Model Year 2027 prohibitions take effect.

Understanding the full ownership structure of your supply chain is now a non-negotiable element of automotive compliance. For a comprehensive view of your supply chain and the tools needed to manage BIS connected vehicles compliance, explore Sayari’s sourcing and procurement solution, which enables manufacturers to trace ownership across multiple tiers and validate supply chain due diligence against evolving regulatory requirements. Learn more about how trade compliance software helps teams stay current with BIS and other export control mandates. For more details, see the BIS Final Rule: Connected and Autonomous Vehicles (January 14, 2025, effective March 17, 2025) and the BIS Entity List.

To get started, request a demo or visit our supply chain compliance resources to see how organizations are managing the connected vehicles rule in practice.