Tightening of the “BIS Rules” for Connected Vehicle Technologies in the U.S. – Challenge for global Automotive Companies with China-Nexus

Restrictions on “Chinese” vehicle technologies in the U.S. – What’s it about?

On March 17, 2025, regulations came into effect in the U.S. that significantly restrict the import and marketing of “connected vehicle” technologies originating from or related to China (C.F.R. Part 791 Subpart D). The regulations were issued by the Bureau of Industry and Security (BIS), an agency of the U.S. Department of Commerce.

The so-called “BIS Rules” essentially prohibit the following three things for the U.S. market:

1. the import of certain VCS hardware such as telematics control units with ties to China or Russia,
2. the import and sale of complete connected vehicles with specific covered software with a China/Russia connection, as well as
3. the sale of such vehicles by manufacturers that are themselves subject to the jurisdiction or control of China or Russia.

In addition, the regulations restrict manufacturers which are in scope from providing commercial services in the U.S. that use vehicles equipped with Automated Driving Systems (ADS).

The BIS Rules already apply to passenger vehicles, specifically the ban on importing hardware for vehicles with a GVWR under 10,000 lbs effective March 17, 2025, and the ban on selling software for Model Year 2027 vehicles effective September 30, 2026.

Vehicles over 10,000 lbs GVWR—typically trucks, heavy vans, buses, and other commercial vehicles—are still not subject to the BIS regulations. Lawmakers in the U.S., however, are currently working on tightening the regulations, which would then also extend the restrictions to commercial vehicles (see below).

Which vehicle technologies are covered?

The following technologies are subject to the respective restrictions:

1. VCS hardware: Telematics control units, networking/telematics units, cellular modems, Wi‑Fi and Bluetooth modules, satellite communication systems, DSPs, FPGAs, external antennas.
2. ADS: Highway pilot, autonomous stack, object detection/classification/decision making.
3. Software covered: Application, middleware, and system software for VCS or ADS; operating systems and libraries/middleware
4. Communications and OTA architecture: Vehicle-to-cloud, software update infrastructure, remote diagnostics.
5. Telematics/Battery-Related Modules: Battery management systems with cellular modules, infotainment modules with their own connectivity.

Excluded are, among others, technologies such as firmware, true open-source software, pure sensor technology such as LiDAR/radar/video/UWB, GNSS/AM/FM-only, and pure power management functions.

The BIS Rule is not limited to vehicles built in China. It also applies to vehicles assembled in Europe, Mexico, or the U.S. if the relevant software or hardware is “designed, developed, manufactured, or supplied” by PRC- or Russia-controlled companies, or if the manufacturer itself is under their control.

This poses significant challenges, particularly for globally developed platforms: the same vehicle architecture may be approved for Europe but lose access to the U.S. market due to software provenance, corporate control issues, OTA governance, or integrated communication modules.

What obligations do the BIS rules impose on manufacturers?

The BIS Rule provides for a tiered compliance process centered on the obligation to electronically submit a Declaration of Conformity (DoC) to the BIS for each covered vehicle or component at least 60 days prior to the first import or sale.

In this DoC, importers and manufacturers must certify that the relevant hardware and software has no connection to persons controlled by the PRC or Russia (“no PRC/Russia nexus”) and, in particular, was not designed, developed, manufactured, or supplied by such persons.

SBOM and HBOM documentation must be retained for at least 10 years; while it does not need to be routinely submitted with the DoC, it must be made available to the authority immediately upon request (record keeping).

The DoC must be renewed annually for each model year or—if the supply chain remains unchanged—confirmed by submitting a timely confirmation; however, in the event of a material change, particularly in the case of omissions, inaccuracies, or errors regarding the origin of VCS hardware or covered software, an updated DoC must be submitted within 60 days

Violations may be punished with fines, criminal sanctions, and the revocation of export privileges.

Will there be further tightening of the regulations?

Yes. The BIS has already announced this, among other things, for the commercial/utility vehicle sector.

With the Connected Vehicle Security Act of 2026 (S. 4429 (Senate) / H.R. 8730 (House of Representatives)) and the Connected Vehicle National Security Review Act (S. 2040). S. 4429/H.R. 8730) the lawmakers in the U.S. aim to replace the current BIS regime, codify it into law and substantively expanded it: no 10,000-lb limit, Iran and North Korea added as covered countries, or strict ownership thresholds for joint ventures and subsidiaries.

Under the new regulations, the restrictions that have been in place to date would thus also apply to commercial vehicles.

What are the implications of these regulations for OEMs and suppliers?

OEMs and suppliers face three key challenges:

First, software and hardware components must be precisely assigned within complex, multinational corporate R&D and supply chains, whereby the BIS control test criterion (designed, developed, manufactured, or supplied by PRC- or Russia-controlled entities) is decisive. This is particularly challenging in global R&D organisations with shared databases, e.g., for OEMs that partially relocate their development activities to China and have R&D teams in different regions collaborate with one another.

Second, the rules have extraterritorial effect, meaning that vehicles developed and assembled outside of China may also be subject to these regulations if, for example, middleware, telematics modules, OTA governance, or JV control rights are held by a Chinese corporate unit.

Third, multinational software development increases complexity because not only the location where the code is created but also ownership structures, the build environment, maintenance rights, and access to updates are critical for compliance assessment.

In a nutshell: Global R&D processes may result in vehicles, components, or services no longer being marketable in the U.S. in the future if appropriate ring-fencing and segmentation is not implemented. Depending on the strategy, this can have significant implications for global supply chains and distribution channels, which could exacerbate the already tense commercial situation in global automotive markets.

What must affected companies do?

Companies must establish a segmented governance model in the long term that consistently distinguishes between U.S. and non-U.S. platform variants and defines clear responsibilities for reviewing connections to China and Russia — including within the supply chain - and document the corresponding audits and repeated on a regular basis.

If this is not achieved, affected companies not only face market access issues but also operational disruptions caused by short-term re-engineering projects and delayed SOPs or halted imports.

Possible measures within the framework of such a governance model should include the following elements:

1. Product screening: Classify U.S. portfolios based on VCS, ADS, radio modules, and OTA/cloud dependencies.
2. Passenger/Utility Separation: Strictly separate product lines based on GVWR below or above 10,000 lbs and develop a parallel scenario for future commercial vehicle regulations.
3. Supply Chain Mapping: Map for communication modules, software, middleware, ADS, and service providers.
4. SBOM/HBOM: Maintain SBOM/HBOM or equivalent supporting documentation for each model year.
5. Global R&D and System Access: Stricter “clean-room” or access control rules for development contributions related to China .
6. Region-specific OTA solutions: Establish region-specific OTA solutions where they are needed.
7. Corporate Control Review: Check investments, joint ventures, board rights, veto rights, and license and maintenance rights for a PRC/Covered Country nexus.
8. Software Provenance: Document repository governance, build pipelines, code owners, maintenance rights, OTA access, and regional branches.
9. Contract Clauses: Expand supply contracts to include origin, control, access, audit, and remediation clauses.
10. Regulatory Instruments: Prepare Declarations of Conformity early on, Advisory Opinions, and—if necessary— Specific Authorizations and initiate.