Commerce's Connected Vehicle Rule: China, Russia and the Model Year 2027 and 2030 Prohibitions in 15 CFR Part 791

The ICTS Authority Behind the Rule

The connected vehicle rule is not a privacy law and does not regulate how vehicle data is collected, used or shared with anyone. It is a national security control on the supply chain for information and communications technology and services, or ICTS. Its stated purpose, in 15 CFR § 791.300, is to prohibit transactions involving certain software and hardware from persons tied to the People's Republic of China or Russia that directly enable a connected vehicle's Automated Driving System or Vehicle Connectivity System.

The legal chain runs through the International Emergency Economic Powers Act. In Executive Order 13873 of May 2019, the President declared a national emergency over foreign adversary ICTS and delegated IEEPA authority to the Secretary of Commerce. The Bureau of Industry and Security (BIS) issued an advance notice in March 2024 (89 FR 15066), a proposed rule in September 2024 (89 FR 79088), and the final rule on January 16, 2025 at 90 FR 5360. It took effect on March 17, 2025.

Data figures in the rule's reasoning, as one of several risks. The preamble describes an adversary using persistent connectivity to trigger engine shutdown, brake activation or electrical system deactivation, and corrupted systems that could "collect, exfiltrate, and exploit personally identifiable information (PII) or even protected health information (PHI)." BIS's connected vehicles page summarizes the concern as companies from these countries being compelled to share data or allow remote access to vehicles in the United States. The remedy, though, is to exclude the technology, not to set rules for the data.

Section 791.4 lists six foreign adversaries for part 791 as a whole: China (including the Hong Kong and Macau Special Administrative Regions), Cuba, Iran, North Korea, Russia and the Maduro regime. The connected vehicle subpart uses only two of them, the PRC and Russia.

Vehicle Connectivity and Automated Driving Systems Defined

Section 791.301 supplies the definitions, and they set the rule's reach more than the prohibitions do.

• Connected vehicle: a vehicle driven or drawn by mechanical power, manufactured primarily for use on public streets, roads and highways, that communicates over dedicated short-range, cellular, satellite or other wireless connectivity. Rail-only vehicles and vehicles with a gross vehicle weight rating above 4,536 kilograms (10,000 pounds) are excluded
• Vehicle Connectivity System (VCS): a hardware or software item installed in or on a completed connected vehicle that directly enables transmission, receipt, conversion or processing of radio frequency communications above 450 megahertz. Items that exclusively handle automotive sensing such as LiDAR or radar, ultrawideband key fobs, receive-only bands such as GNSS, satellite radio and AM/FM, or power supply are excluded
• VCS hardware: software-enabled or programmable components that directly enable VCS, including telematics units, cellular modems, Wi-Fi and Bluetooth modules, satellite systems, external antennas, systems on a chip and field-programmable gate arrays, but not brackets, fasteners or passive electronics
• Automated Driving System (ADS): hardware and software that together can perform the entire dynamic driving task on a sustained basis. The preamble states that the rule regulates ADS software and not ADS hardware
• Covered software: application, middleware and system software, in which there is a foreign interest, executed by the primary processing unit of an item that directly enables VCS or ADS. Firmware is excluded, as is open-source software unless modified for proprietary purposes and not redistributed, and so are software subcomponents supplied before March 17, 2026 that are not maintained or altered by an adversary-linked entity after that date

Two regulated roles carry the obligations. A connected vehicle manufacturer is a U.S. person that manufactures or assembles completed connected vehicles in the United States for sale here, imports completed connected vehicles for sale here, or integrates ADS software on a completed connected vehicle for sale here. A VCS hardware importer is a U.S. person that imports VCS hardware for integration into a completed connected vehicle, or imports it already installed. The rule defines "knowingly" to include awareness of a high probability, inferred from conscious disregard or willful avoidance of facts.

The nexus test is the four-part definition of a person owned by, controlled by, or subject to the jurisdiction or direction of a foreign adversary: agents and those acting at an adversary's direction; citizens or residents of an adversary country who are not U.S. citizens or permanent residents; organizations headquartered, incorporated or principally doing business there; and organizations owned or controlled by any of those, including through a dominant minority interest, board seats or contract. Sections 791.302(b) and 791.303(c) add that the citizenship of individual employees or contractors, standing alone, does not bring technology within the prohibitions. The preamble records that BIS declined commenters' requests to import a fixed percentage ownership threshold.

The Software and Hardware Prohibitions and Their Model Years

There are three prohibitions, and section 791.308 sets when each starts to bite. Until then, a transaction is exempt both from the prohibition and from the Declaration of Conformity requirement.

The hardware exemption extends to imports of VCS hardware for repair or warranty work on a vehicle with a model year before 2030. The preamble explains the later hardware date: BIS rejected a broader legacy hardware exclusion because hardware stays in service for decades, and described the January 1, 2029 and model year 2030 dates as a middle ground. The section 791.304 prohibition is the one aimed at manufacturers rather than components. The preamble ties its commercial services clause to rideshare and robotaxi services.

The eCFR version history for subpart D shows the text in force since March 17, 2025 with one later change, dated July 23, 2026, to section 791.308. Compared side by side, the July 2026 text alters the form of a cross-reference to sections 791.306 and 791.307 and leaves the model years unchanged.

Declarations of Conformity and Specific Authorizations

Section 791.305 is the compliance engine. Absent an exemption or authorization, a VCS hardware importer files a Declaration of Conformity before importing VCS hardware, and a connected vehicle manufacturer files one before importing or selling completed connected vehicles with covered software. Each declaration certifies that the hardware or software was not designed, developed, manufactured or supplied by a PRC- or Russia-linked person and that the declarant conducted due diligence, and identifies who holds the supporting documentation (a hardware or software bill of materials or otherwise). The certification is signed under the penalties of 18 U.S.C. 1001.

• Timing: at least 60 days before the first import or first sale for each model year, or each calendar year for hardware with no model year; a single declaration may cover vehicles sharing the same software, grouped by make, model and VIN series
• Annual updates: where nothing material has changed, a confirmation that the prior declaration remains accurate may be filed in place of a new one
• Material changes: a revised declaration within 60 days of discovering an omission, inaccuracy or error that could mislead as to the source of hardware or software, with the duty ending 10 years after the original declaration; software updates alone are not a material change
• Change in circumstance: if articles are no longer eligible, prohibited conduct must stop and a specific authorization application must be filed within 30 days

Two kinds of authorization permit an otherwise prohibited transaction. General authorizations under section 791.306 are published by BIS and are unavailable to anyone that is itself PRC- or Russia-linked. The BIS general authorizations page lists three as active: General Authorization 1 (Amended), Limited Use Cases, last updated June 18, 2026; General Authorization 2 (Amended), Temporary Importation, dated November 19, 2025; and General Authorization 3, Approved Supplier Registry, issued June 18, 2026.

General Authorization 1 lets a connected vehicle manufacturer import completed connected vehicles without a specific authorization or declaration where they will be used on public roads fewer than 30 days in a twelve-month period solely for testing, used only for display, testing or research off public roads, or temporarily imported for repair, alteration or sporting competition and exported within a year. General Authorization 3 creates a route for suppliers to apply directly for approval of their hardware or software; a manufacturer or importer may then use a listed supplier's listed product without a specific authorization, declaring it in its Declaration of Conformity. The authorization states that the registry itself "will be published at a later date."

Specific authorizations under section 791.307 are case by case. An application must describe the parties and beneficial ownership, the technology and its function, supporting documentation such as an ISO/SAE 21434 threat analysis where available, the applicant's ability to limit PRC or Russian government access or influence, and proposed mitigations. BIS states it will decide within 90 days unless it extends that period, decisions are not made public, and an authorization generally lasts at least one model or calendar year. Records for transactions under a declaration or any authorization must be kept for at least 10 years under section 791.312. Violations carry IEEPA civil penalties and, for willful violations, criminal fines up to $1,000,000 and imprisonment up to 20 years under section 791.318.

Which Vehicles Fall Outside

The exclusions come from the definitions, the exemptions and the general authorizations rather than from a single list.

• Vehicles with a gross vehicle weight rating over 10,000 pounds. The preamble states BIS excluded commercial vehicles such as buses from this rule and intended to propose a separate rule for that sector
• Vehicles operated only on rail, and vehicles not manufactured primarily for public streets and highways; the preamble cites agricultural, construction and mining equipment as falling outside the definition
• Completed connected vehicles with covered software manufactured before model year 2027, and VCS hardware tied to vehicles before model year 2030
• Technology that is not covered at all: firmware, unmodified open-source software, ADS hardware, receive-only radio and navigation components, and automotive sensing that does not itself communicate
• Limited uses under General Authorization 1, such as testing, display, research and temporary imports for repair or competition

BIS's Small Entity Compliance Guide states that the rule has no small business exception. The proposed rule had included general authorizations for producers of fewer than 1,000 vehicles or units; the final rule moved general authorizations out of the regulatory text and into documents BIS issues separately.

How It Relates to the DOJ Bulk Data Rule

The Justice Department's bulk sensitive data rule at 28 CFR part 202 also rests on IEEPA and also reaches China and Russia, among other countries. The two operate on different objects. The DOJ rule governs data transactions: as the BIS preamble describes it, it prohibits and restricts certain transactions that could give countries of concern access to bulk sensitive personal data or U.S. government-related data. The BIS rule governs components: whether certain hardware and software from two countries may be imported or sold in passenger vehicles at all, with no data volume threshold.

The connected vehicle preamble draws the line itself. Asked to adopt the DOJ proposal's 50 percent ownership test for identifying covered persons, BIS declined, noting that the DOJ rule addresses access to bulk sensitive personal data and government-related data and that connected vehicle supply chains are complex and opaque, with varying ownership structures. A company can therefore be a covered person under one regime and outside the other, and compliance with one says nothing about the other. Neither regime is a consumer privacy statute, and neither gives a driver any right with respect to the data a vehicle produces.

Frequently Asked Questions