US Department of Commerce issues proposed rule limiting imports of Chinese and Russian connected vehicles and equipment

On September 26, 2024, the US Department of Commerce (Commerce) published a Notice of Proposed Rulemaking (NPRM) that would restrict the importation and sale of connected vehicles and related equipment of Chinese and Russian origin.

The rule would prohibit the import or sale in the US of certain “Vehicle Connectivity Systems” (VCS) and Automated Driving Systems (ADS) related software and hardware, and completed connected vehicles that contain such software or hardware – if they are designed, manufactured, or supplied by persons or entities located, controlled, or under the jurisdiction of either the People’s Republic of China (China) or the Russian Federation (Russia). The rule also creates new regulatory requirements for companies importing VCS or completed connected vehicles, even if that VCS or completed connected vehicle does not originate from China or Russia.

According to the White House, the key objective of the proposed rule is to prevent connected vehicles of Chinese or Russian origin from using connect vehicle technology to collect data and information on US critical infrastructure and to prevent the respective governments from disrupting the operation of that infrastructure and connected vehicles. The Commerce Department proposal asserts that the connected technologies of today’s vehicles could be used for foreign surveillance, to sabotage and undermine US national security, and for other malicious purposes.

The software-related import and sale prohibitions of the proposed rule would take effect in vehicle model year 2027. Hardware prohibitions would take effect in vehicle model year 2030, or on January 1, 2029 for units that do not have a model year. The deadline for submission of public comments on the proposed regulations is October 28, 2024.

Overview of proposed rule

The NPRM would prohibit the import or sale in the US of specified hardware, software, and connected vehicles that are “designed, developed, manufactured, or supplied by persons owned by, controlled by, or subject to the jurisdiction of” the China or Russia. Vehicles, equipment, and technology subject to the import and sale prohibitions would include:

• VCS hardware – broadly defined by the NPRM as certain software-enabled or programmable components that support the function of VCS or are part of an item that supports the function of VCS. “Software-enabled or programmable components” include “microcontroller, microcomputers or modules, systems on a chip, networking or telematics units, cellular modem/modules, Wi-Fi microcontrollers or modules, Bluetooth microcontrollers or modules, satellite navigation systems, satellite communication systems, other wireless communication microcontrollers or modules, and external antennas.”


• VCS is defined as a hardware or software item for a connected vehicle that has the function of enabling the transmission, receipt, conversion, or processing of radio frequency communications at a frequency over 450 megahertz.


• Covered software – including software-based components that support functions of a VCS or ADS, and operating systems, such as real-time operating systems (RTOS) and general-purpose operating systems. Firmware and open-source software are not covered.


• Completed connected vehicles containing covered software. The ban on sales in the US includes completed connected vehicles manufactured in the US that contain covered software, hardware, or equipment.

Additionally, Chinese and Russian vehicle manufacturers are prohibited from selling completed connected vehicles that incorporate VCS hardware or covered software in the US.

The proposed rule would establish four categories of persons owned by, controlled by, or subject to the jurisdiction or direction of China or Russia. They are:

1. Relationship with the foreign adversary: Any person, wherever located, who acts as an agent, representative, or employee, or any person who acts in any other capacity at the order, request, or under the direction or control, of a foreign adversary. Additionally, a person whose activities are directly or indirectly supervised, directed, controlled, financed, or subsidized in whole or in part by a foreign adversary would be included within this definition.


2. Citizenship or residency: Any person who is a citizen or resident of a foreign adversary or country controlled by a foreign adversary and is not a US citizen or permanent resident.


3. Corporation’s location: Any corporation, partnership, association, or other organization with a principal place of business in, headquartered in, incorporated in, or otherwise organized under the laws of a foreign adversary.


4. Corporation’s ownership: Any corporation, partnership, association, or other organization, wherever organized or doing business, that is owned or controlled by a foreign adversary.

New compliance requirements

In addition to the import and sale prohibitions, the proposed rule would create new requirements for all US importers of VCS, ADS, and connected vehicles. The proposed new regulations would require manufacturers of VCS hardware and completed connected vehicles to submit Declarations of Conformity (Declarations) with the new limits, as a condition to their import into the US.

While the requirements of a Declaration of Conformity vary depending on the item, all Declarations will require detailed supply chain information, including bills of materials. Additionally, VCS hardware importers and connected vehicle manufacturers will be required to provide a description of the due diligence process they have conducted to ensure that the product complies with the new prohibitions. Due diligence would include analyzing the hardware bill of materials for VCS hardware and the software bill of materials for covered software in order to prove that the respective importer took steps to verify that the transaction complies with the provisions of the rule. However, aside from this step, the rule does not mandate particular due diligence requirements, but instead seeks to allow VCS hardware importers and connected vehicle manufacturers to provide evidence of their efforts that are tailored to the unique operations of the importers.

A Declaration would be required to be submitted by the connected vehicle manufacturer or the VCS hardware importer to Commerce’s Bureau of Industry and Security (BIS) 60 days prior to the first sale or import of completed connected vehicles of a model year of completed connected vehicles, grouped by make, model, and trim, or 60 days prior to the import of the VCS hardware for each model year for units associated with a vehicle model year, or calendar year for units not associated with a vehicle model year. The entity making the Declaration must notify BIS of any material change in the contents of a previously submitted Declaration by submitting a revised Declaration within 30 days of any changes.

General and specific authorizations: Exceptions to prohibitions

The NPRM contains a series of “general authorizations” pursuant to which VCS hardware importers and connected vehicle manufacturers may engage in otherwise prohibited transactions. VCS hardware importers and connected vehicle manufacturers may self-certify that they qualify for the general authorizations, but must maintain detailed records of the transactions for a period of ten years.

The NPRM provides four general authorizations for:

1. Connected vehicle manufacturers or VCS hardware importers who produce fewer than 1,000 units in a total model year. This 1,000-unit limit applies to parent companies and subsidiaries collectively – the total number of eligible units for a parent and its subsidiaries is 1,000 units in a total model year.


2. Completed connected vehicles that will be used on public roadways for fewer than 30 calendar days in a calendar year.


3. Completed connected vehicles that will be used solely for purposes of display, testing, or research, and that will not be used on public roadways.


4. Completed connected vehicles that are imported solely for purposes of repair, alteration, or competition on non-public roads, and that will be re-exported within one year.

Additionally, the NPRM contains a process by which a manufacturer or importer may apply for a specific authorization to allow for engagement in otherwise prohibited activities. Specific authorizations would be issued by Commerce and would apply only to the applicant manufacturer or importer and the specific factual scenario articulated in the authorization. Please reach out to a DLA Piper attorney if you are interested in more information on specific authorizations.

Enforcement authority

Violations of provisions of the proposed regulations may be subject to both civil and criminal penalties. Civil penalties currently could amount to $368,136 per violation (to be adjusted for inflation in future years), and criminal penalties of as much as $1million and/or imprisonment for up to 20 years.

The NPRM also provides for a process by which Commerce’s BIS may notify an alleged violator of an alleged violation with a pre-penalty notice, giving the alleged violator 30 days to respond to the violation allegations. The response must be submitted within 30 days and may contain an assessment by the alleged violator that the alleged conduct did not occur by contesting the facts through the provision of documented exculpatory evidence.

Conclusion

The NPRM could significantly limit the ability of Chinese and Russian manufacturers to import vehicles and vehicle hardware and software into the US, and places increased information gathering and compliance requirements on importers of VCS, ADS, and completed connected vehicles. We are happy to work with companies interested in establishing appropriate compliance practices or submitting comments on the proposed rule. We will continue to monitor and report on developments on the proposed and final rule.

DLA Piper has a foreign direct investment, sanctions, and export controls practice that provides global coverage and experience with complex compliance, licensing, and enforcement matters. Our transportation and vehicle regulation practice is led by former NHTSA Chief Counsel Paul Hemmersbaugh. Please find out more about the implications of these new restrictions for your business and compliance obligations by contacting any of the authors, or any of the partners in the National Security and Global Trade practice: Christine Daya, Melanie Garcia, Nicholas Klein, Richard Newcomb, and Ignacio E. Sanchez.