Connected vehicles use technology to communicate wirelessly with other vehicles, roadside infrastructure, and pedestrians. Adaptive cruise control, remote diagnostics, and in-vehicle entertainment are examples of connected vehicle capabilities. By 2030, it’s estimated that about 95 percent of new vehicles sold globally will be connected.
The U.S. has long been concerned with the national security risks posed by interference with connected vehicles by foreign adversaries. This concern is behind a new ruling by the U.S. Department of Commerce’s Bureau of Industry and Security (BIS). The rule, released on January 14, 2025, prohibits specific transactions involving the import or sale of connected vehicles and certain hardware and software with “a sufficient nexus” to the People’s Republic of China (PRC) or Russia. The rule is effective as of March 17, 2025.
>> Discover how one auto manufacturer accelerated supplier risk prioritization <<
What is impacted by the new BIS ruling?
Acknowledging the complexity of the commercial vehicle supply chain, BIS has limited the rule to passenger vehicles only (defined as those under 10,001 pounds), but has indicated they intend “to issue a separate rulemaking addressing the technologies present in connected commercial vehicles — including in trucks and buses — in the near future.”
In addition to restricting the import and sale of certain finished vehicles, the rule also places restrictions on:
- Vehicle Connectivity Systems (VCS): the hardware components and software in a vehicle that allow it to communicate offboard.
- Automated Driving Systems (ADS): the software that allows an autonomous vehicle to operate without driver input.
BIS is implementing three categories of prohibitions:
- Beginning with Model Year 2027, companies with a sufficient nexus to the PRC or Russia will not be permitted to sell certain connected vehicles in the U.S. This includes companies that are not based in the PRC or Russia but are owned and controlled by PRC or Russian companies.
- Starting in Model Year 2027, manufacturers will not be permitted to import for sale or sell in the U.S. connected vehicles that incorporate VCS and/or ADS software from companies with a sufficient nexus to the PRC or Russia.
- Beginning in Model Year 2030 (or January 1, 2029, for components that don’t have a model year), importers will not be permitted to import VCS hardware or components that are designed, developed, manufactured, or supplied by companies with a sufficient nexus to the PRC or Russia.
Requirements for due diligence
The BIS ruling will significantly impact OEMs and suppliers across all tiers of the automotive sector supply chain who import connected vehicles and specified components into the U.S. To ensure imports do not have a “sufficient nexus” to the PRC or Russia, OEMs and suppliers will need to ensure these imports are not “designed, developed, manufactured, or supplied by persons owned by, controlled by, or subject to the jurisdiction or direction” of the PRC or Russia.
Importers and connected vehicle manufacturers will be required to certify that they have conducted due diligence on their supply chain, and they must maintain records documenting these efforts. Importers of VCS hardware and importers and manufacturers of completed connected vehicles must submit annual Declarations of Conformity to BIS to attest that they are complying with the rule.
At the time of the final rule’s publishing, the maximum civil penalty for violations is $368,136 per violation and the maximum criminal penalty is $1,000,000.
>> Learn how to achieve sub-tier supply chain visibility to meet regulatory requirements <<
Tracing corporate ownership and mapping supply chains to comply with BIS ruling
In their response to comments, the BIS acknowledges the basic challenge in vetting the complete supply chain: “Connected vehicle manufacturers typically have strong relationships with their immediate suppliers … however, their understanding of the deeper supply chain, such as who is supplying their suppliers (e.g., tier two, tier three) is substantially weaker.”
Getting insight beyond immediate suppliers — including the sometimes-murky details of corporate ownership — is key because the BIS ruling applies not just to companies based in the PRC or Russia but those companies owned and controlled by the PRC and Russia.
Purpose-built technology can help address this lack of visibility into supply chains and illuminate ownership structures. By layering corporate ownership data with import-export information from 75+ reporting countries, Sayari makes it easy for auto supply chain teams to validate intelligence gathered from direct suppliers, vet sub-tier suppliers, determine corporate ownership, and build product-specific multi-tier supply chain maps. This comprehensive outside-in view of the supply chain provides procurement and compliance teams with broader context surrounding their suppliers and increased confidence in decision making.
Learn more about how Sayari can help your supply chain team meet the due diligence requirements of the BIS connected vehicles rule. Get started with a free scan of your automotive supply chain.
