From model year 2027, a car maker selling in the United States must be able to prove, component by component, that the software running its telematics and automated driving systems has no prohibited link to China or Russia. The Bureau of Industry and Security (BIS) connected vehicles rule, published at 90 FR 5360 on 16 January 2025 and codified in 15 CFR part 791 subpart D, prohibits certain transactions involving vehicle connectivity system (VCS) hardware and covered software, and requires annual Declarations of Conformity backed by bills of materials. This guide explains scope, prohibitions, dates, declarations, penalties and the practical supply chain work for OEMs, importers and tier 1 and tier 2 suppliers. Status checked on 27 October 2026 against the eCFR, the Federal Register and bis.gov. For vehicle security engineering in general see the Connected and Autonomous Vehicle Security Guide.
Key takeaways
- Three prohibitions: importing VCS hardware with a China or Russia nexus (791.302), importing or selling completed connected vehicles with such covered software (791.303), and sales by manufacturers that are themselves China or Russia linked (791.304).
- Software first, hardware later: software prohibitions bite from model year 2027; hardware from model year 2030, or 1 January 2029 for hardware units not tied to a model year.
- Declarations need bills of materials: a Declaration of Conformity must be filed at least 60 days before first import or sale of each model year, with an SBOM or equivalent identifying author, timestamp, component and supplier.
- Records for ten years: 791.312 requires records to be available for examination for at least 10 years after the transaction.
- Penalties follow IEEPA: civil penalties up to the IEEPA maximum, and for wilful violations fines of up to $1,000,000 and up to 20 years' imprisonment for individuals (791.318).
Scope: who and what is covered
The rule was issued under Executive Order 13873 on securing the ICTS supply chain and is administered by the BIS Office of Information and Communications Technology and Services (OICTS). It took effect on 17 March 2025.
| Term | Meaning under 15 CFR 791.301 and BIS guidance |
|---|---|
| Connected vehicle | A vehicle driven or drawn by mechanical power, manufactured primarily for public roads, excluding vehicles with a gross vehicle weight rating over 10,000 pounds (4,536 kg). Commercial vehicles such as buses are outside the final rule. |
| VCS | Hardware or software that directly enables radio frequency communication at a frequency over 450 MHz, with exclusions for sensing, physical access, unidirectional bands and power. Hardware examples in BIS guidance: cellular modules, Wi-Fi and Bluetooth modules, telematics units. |
| ADS | Hardware and software capable of performing the entire dynamic driving task on a sustained basis. |
| Covered software | Software that directly enables the function of VCS or ADS. It does not include firmware, and the eCFR text excludes open-source software and certain subcomponents designed, developed, manufactured or supplied before 17 March 2026 unless later altered by a linked entity. |
| Connected vehicle manufacturer | A US person that manufactures or assembles a connected vehicle in the US, imports one for sale, or integrates ADS software into one for sale or operation in the US. |
| VCS hardware importer | A US person importing VCS hardware for installation, sale or operation in the US, including hardware already built into an imported vehicle. |
| Nexus | Designed, developed, manufactured or supplied by a person owned by, controlled by, or subject to the jurisdiction or direction of China or Russia. Citizenship of individual employees alone does not create the link (791.302(b)). |
The rule is a supply chain provenance rule, not a vehicle cybersecurity standard. It does not tell you how to secure a telematics unit; it tells you whose software and hardware you may not use in it. Pair it with engineering standards such as ISO/SAE 21434. See the ISO/SAE 21434 Automotive Cybersecurity Engineering Guide.
Key obligations
Prohibited transactions
| Section | Who it binds | What is prohibited (knowingly, absent authorisation) | Applies from |
|---|---|---|---|
| 791.302 | VCS hardware importers | Importing VCS hardware with a China or Russia nexus | Model year 2030; 1 Jan 2029 for units without a model year |
| 791.303 | Connected vehicle manufacturers | Importing or selling completed connected vehicles incorporating covered software with a nexus | Model year 2027 |
| 791.304 | Manufacturers that are themselves China or Russia linked | Selling connected vehicles incorporating VCS hardware or covered software in the US, whoever supplied it, including commercial services such as robotaxis using such vehicles | Model year 2027 (BIS compliance guide) |
The phase-in comes from the exemptions in 791.308: VCS hardware is exempt if associated with a model year before 2030, or, for units not tied to a model year, if imported before 1 January 2029; covered software is exempt for vehicles manufactured before model year 2027. The Federal Register preamble adds exemptions for parts imported for warranty or repair of vehicles with a model year before 2030.
Declarations of Conformity (791.305)
- Who: VCS hardware importers and connected vehicle manufacturers engaging in transactions involving covered software or VCS hardware in which there is a foreign interest (any interest of a non-US person, direct or indirect).
- When: at least 60 days before the first import or first sale of each model year for covered software, and at least 60 days before import for VCS hardware; certified once a year or whenever material changes occur.
- Hardware content: importer identity and contact, FCC ID and make and model where known, with documentation maintained through an HBOM or otherwise.
- Software content: make, model, trim and VIN series, with documentation through an SBOM or otherwise sufficient to identify author name, timestamp, component name and supplier name.
- How: submitted through the Compliance Application and Reporting System (CARS) at cars.bis.gov.
See the Hardware and Firmware SBOM Guide and the SBOM Guide.
Authorisations and other mechanisms
| Mechanism | Section | Use |
|---|---|---|
| General authorisations | 791.306 | Published by BIS for a narrow set of lower risk circumstances; users must monitor continued eligibility |
| Specific authorisations | 791.307 | Needed before an otherwise prohibited transaction; granted only where it does not present undue or unacceptable risk, possibly with mitigation conditions |
| Advisory opinions | 791.310 | Guidance on whether a prospective transaction is prohibited |
| "Is-informed" notices | 791.311 | BIS informs a party that a transaction requires authorisation |
| Third-party verification and assessments | 791.315 | Independent checks supporting declarations and authorisations |
| Recordkeeping and reports on demand | 791.312, 791.313 | Records kept at least 10 years; BIS can demand reports |
Timeline and current status
| Date | Event |
|---|---|
| 14 Jan 2025 | Final rule issued by BIS |
| 16 Jan 2025 | Published at 90 FR 5360 (FR Doc. 2025-00592) |
| 17 Mar 2025 | Rule effective |
| 16 Dec 2025 | Date in the file name of the BIS Small Entity Compliance Guide |
| Model year 2027 | Covered software prohibitions (791.303) and linked manufacturer sales prohibition (791.304) |
| 1 Jan 2029 | VCS hardware without a model year loses exemption |
| Model year 2030 | VCS hardware prohibition (791.302) |
When checked on 27 October 2026, BIS had published CARS submission guidance last updated 24 June 2026 and FAQs on declarations, and the eCFR text was current. Model year vehicles usually go on sale before the calendar year they are named after, so the 60-day lead time means many model year 2027 software declarations fall due in 2026. Check bis.gov for new general authorisations and FAQs before each filing.
Enforcement and penalties
Under 791.318, civil penalties may not exceed the amount set in section 206 of the International Emergency Economic Powers Act (50 U.S.C. 1705), which is adjusted for inflation; check the current figure. A person who wilfully commits, attempts or conspires to commit a violation may be fined not more than $1,000,000 and, if a natural person, imprisoned for not more than 20 years. Sections 791.316 to 791.320 set the process: finding of violation, pre-penalty notice and settlement, penalty imposition and referral to the Department of Justice for collection. Because the prohibitions turn on "knowingly", due diligence records are the main defence: the BIS compliance guide says preparing a declaration requires thorough due diligence of existing supply chains.
What it means for AI agents and non-human identities
- Telematics credentials: VCS hardware carries device certificates, SIM profiles and cloud API keys. Replacing a module to meet the hardware deadline means re-provisioning every one of those machine identities and revoking the old ones. See the Machine Identity, PKI and Certificate Lifecycle Guide.
- Remote access paths: BIS's rationale is that linked companies could be compelled to share data or allow remote access. Inventory every backend service, OTA channel and diagnostic tool that holds credentials into the vehicle, including supplier-operated ones. See the Uptane and Vehicle OTA Security Guide.
- ADS software and AI models: covered software includes software enabling ADS functions. Treat model files, inference runtimes and their update pipelines as components in the SBOM with named suppliers.
- Build pipeline identities: SBOM fields such as author and timestamp are only trustworthy if signing keys and CI identities are controlled. See the Non-Human Identity (NHI) Guide.
Compliance steps
- Map every VCS and ADS function per vehicle platform: which modules transmit above 450 MHz and which software enables them or the driving task.
- Request supplier declarations down the chain: ownership, control and jurisdiction of each entity that designed, developed, manufactured or supplied each component.
- Build SBOMs and HBOMs with author, timestamp, component and supplier fields populated, and keep them per model year and trim.
- Screen for nexus using ownership data, not employee nationality, and record the reasoning.
- Decide remediation: replace, re-source, seek a specific authorisation or rely on a general authorisation or exemption, by component.
- File in CARS at least 60 days before first import or sale of each model year, and refile on material change.
- Keep records for 10 years and be ready for reports on demand and third-party assessment.
- Plan the 2029 and model year 2030 hardware cut-over now: module redesign, validation and type approval take years.
What a due diligence evidence pack should hold
Because liability turns on knowledge, build one evidence pack per platform and model year that an investigator could follow without your engineers in the room. Practical contents: the component list mapped to VCS and ADS functions; supplier ownership and control attestations with dates and signatories; the SBOM and HBOM versions used for the declaration; the CARS submission receipt; any general authorisation relied on, with the eligibility check performed; correspondence on advisory opinions or specific authorisations; and the change log showing when material changes triggered a refile. Keep it in a system that preserves versions, because the 10-year retention period will outlive most programme teams.
Decision guidance
- Replace versus authorise: specific authorisations carry mitigation conditions and uncertainty; for long-lived platforms, re-sourcing is often the more predictable path.
- OEM versus supplier: OEMs carry the declaration duty for vehicles; suppliers carry it when they import VCS hardware. Contract terms should push nexus attestations and SBOM delivery to suppliers either way.
- Small firms: BIS published a Small Entity Compliance Guide and accepts general inquiries about scenarios that may fit a general authorisation.
Common failure patterns
- Stopping at tier 1: the software that enables a telematics unit often comes from tier 2 or tier 3 suppliers.
- Treating firmware as covered software: the definition excludes firmware, but hardware rules still apply to the module.
- SBOMs without supplier identity: component lists that name packages but not the supplier entity cannot answer the nexus question.
- One declaration for all trims: the software declaration is per make, model, trim and VIN series.
- Forgetting connected services: commercial services using linked manufacturers' vehicles are caught by 791.304.
- Leaving old credentials live: swapping a module without revoking its certificates and backend keys.
Detection and measurement
- Component coverage: share of VCS and ADS components with a completed supplier nexus attestation.
- SBOM completeness: share of covered software with author, timestamp, component and supplier populated.
- Filing lead time: days between CARS submission and first import or sale (minimum 60).
- Open remediation items per platform against the model year 2030 and 1 January 2029 dates.
- Credential hygiene: retired module certificates and keys revoked within a set number of days.
Framework mapping
| Rule activity | NIST SP 800-53 r5 | NIST CSF 2.0 |
|---|---|---|
| Supplier nexus screening | SR-6 Supplier Assessments and Reviews | GV.SC (Cybersecurity Supply Chain Risk Management) |
| SBOM and HBOM provenance | SR-4 Provenance | ID.AM (Asset Management) |
| Supply chain risk plan | SR-2 Supply Chain Risk Management Plan | GV.SC |
| Component inventory per platform | CM-8 System Component Inventory | ID.AM |
| Credential re-provisioning | IA-5 Authenticator Management | PR.AA |
Practitioner checklist
- Every VCS and ADS component per platform is identified and owned.
- Supplier ownership and control attestations exist for each component.
- SBOMs and HBOMs carry author, timestamp, component and supplier.
- Declarations are filed in CARS at least 60 days before each model year's first import or sale.
- Material changes trigger a refile.
- Records are retained for at least 10 years.
- A hardware cut-over plan exists for 1 January 2029 and model year 2030.
- Module replacement includes revoking old certificates, SIM profiles and API keys.
Standards and references
- eCFR: 15 CFR part 791 subpart D, Connected Vehicles
- Federal Register: Securing the ICTS Supply Chain: Connected Vehicles (final rule)
- BIS: Connected Vehicles
- BIS: Declarations of Conformity
- BIS: Connected Vehicles Small Entity Compliance Guide
- NIST: SP 800-53 Rev. 5 Security and Privacy Controls
Related NHI Mgmt Group resources: Connected and Autonomous Vehicle Security Guide · Automotive Cybersecurity Guide · FCC Covered List and Secure Networks Act Guide · DOJ Data Security Programme Guide. This guide summarises the BIS connected vehicles rule in 15 CFR part 791 subpart D and is not legal advice.