```

[Federal Register Volume 90, Number 10 (Thursday, January 16, 2025)]
[Rules and Regulations]
[Pages 5360-5424]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2025-00592]

[[Page 5359]]

Vol. 90

Thursday,

No. 10

January 16, 2025

Part X

Department of Commerce

-----------------------------------------------------------------------

Bureau of Industry and Security

-----------------------------------------------------------------------

15 CFR Part 791

Securing the Information and Communications Technology and Services 
Supply Chain: Connected Vehicles; Final Rule

Federal Register / Vol. 90 , No. 10 / Thursday, January 16, 2025 / 
Rules and Regulations

[[Page 5360]]

DEPARTMENT OF COMMERCE

Bureau of Industry and Security

15 CFR Part 791

[Docket No. 250107-0005]
RIN 0694-AJ56

Securing the Information and Communications Technology and 
Services Supply Chain: Connected Vehicles

AGENCY: Bureau of Industry and Security, Department of Commerce.

ACTION: Final rule.

-----------------------------------------------------------------------

SUMMARY: This final rule, published by the Department of Commerce's 
(Department) Bureau of Industry and Security (BIS), sets forth 
regulations and procedures to address undue or unacceptable risks to 
national security and U.S. persons posed by classes of transactions 
involving information and communications technology and services (ICTS) 
that are designed, developed, manufactured, or supplied by persons 
owned by, controlled by, or subject to the jurisdiction or direction of 
certain foreign adversaries and that are integral to connected vehicles 
as defined herein.

DATES: This final rule goes into effect on March 17, 2025.

FOR FURTHER INFORMATION CONTACT: Marc Coldiron, U.S. Department of 
Commerce, telephone: (202) 482-3678. For media inquiries: Office of 
Congressional and Public Affairs, Bureau of Industry and Security, U.S. 
Department of Commerce: [email protected].

SUPPLEMENTARY INFORMATION: 

I. Background

    In this final rule, BIS prohibits transactions involving Vehicle 
Connectivity System (VCS) hardware and covered software designed, 
developed, manufactured, or supplied by persons owned by, controlled 
by, or subject to the jurisdiction or direction of the People's 
Republic of China, including the Hong Kong Special Administrative 
Region and the Macau Special Administrative Region, (PRC); or the 
Russian Federation (Russia). It follows an advance notice of proposed 
rulemaking (ANPRM), 89 FR 15066 (March 1, 2024), and a notice of 
proposed rulemaking (NPRM), 89 FR 79088 (September 26, 2024). In the 
ANPRM, BIS sought public comment to inform a rulemaking that would 
address the undue or unacceptable risks, as identified in Executive 
Order (E.O.) 13873, ``Securing the Information and Communications 
Technology and Services Supply Chain,'' 84 FR 22689 (May 17, 2019), 
posed by a class of transactions that involve ICTS designed, developed, 
manufactured, or supplied by persons owned by, controlled by, or 
subject to the jurisdiction or direction of a foreign adversary and 
integral to connected vehicles. The NPRM proposed a rule to address the 
undue or unacceptable risks identified in the ANPRM and solicited 
public comment. BIS has considered the comments received during both 
rounds of public comment, and is making revisions, from the proposed 
rule, that address significant portions of that feedback.
    In E.O. 13873, the President delegated to the Secretary of Commerce 
(Secretary), to the extent necessary to implement the Order, the 
authority granted under the International Emergency Economic Powers Act 
(IEEPA) (50 U.S.C. 1701, et seq.), ``to deal with any unusual and 
extraordinary'' foreign threat to the United States' national security, 
foreign policy, or economy, if the President declares a national 
emergency with respect to such threat. 50 U.S.C. 1701(a). In E.O. 
13873, the President declared a national emergency with respect to the 
``unusual and extraordinary'' foreign threat posed to the ICTS supply 
chain and has, in accordance with the National Emergencies Act (NEA), 
extended the declaration of this national emergency in each year since 
E.O. 13873's publication. See Continuation of the National Emergency 
With Respect to Securing the Information and Communications Technology 
and Services Supply Chain, 85 FR 29321 (May 14, 2020); Continuation of 
the National Emergency With Respect to Securing the Information and 
Communications Technology and Services Supply Chain, 86 FR 26339 (May 
13, 2021); Continuation of the National Emergency With Respect to 
Securing the Information and Communications Technology and Services 
Supply Chain, 87 FR 29645 (May 13, 2022); Continuation of the National 
Emergency With Respect to Securing the Information and Communications 
Technology and Services Supply Chain, 88 FR 30635 (May 11, 2023); 
Continuation of the National Emergency With Respect to Securing the 
Information and Communications Technology and Services Supply Chain, 89 
FR 40353 (May 9, 2024).
    Specifically, the President identified the ``unrestricted 
acquisition or use in the United States of ICTS designed, developed, 
manufactured, or supplied by persons owned by, controlled by, or 
subject to the jurisdiction or direction of foreign adversaries'' as 
``an unusual and extraordinary'' foreign threat to the national 
security, foreign policy, and economy of the United States that 
``exists both in the case of individual acquisitions or uses of such 
technology or services, and when acquisitions or uses of such 
technologies are considered as a class.'' See E.O. 13873, and 50 U.S.C. 
1701(a)-(b).
    Once the President declares a national emergency, IEEPA empowers 
the President to, among other acts, investigate, regulate, prevent, or 
prohibit, any ``acquisition, holding, withholding, use, transfer, 
withdrawal, transportation, importation or exportation of, or dealing 
in, or exercising any right, power, or privilege with respect to, or 
transactions involving, any property in which any foreign country or a 
national thereof has any interest by any person, or with respect to any 
property, subject to the jurisdiction of the United States.'' 50 U.S.C. 
1702(a)(1)(B).
    To address the identified risks to national security from ICTS 
transactions, the President in E.O. 13873 imposed a prohibition on 
transactions that the Secretary, in consultation with relevant agency 
heads, has determined involve foreign adversary ICTS and pose certain 
risks to U.S. national security, including U.S. technology and critical 
infrastructure, or the security and safety of U.S. persons. 
Specifically, to fall within the scope of the prohibition, the 
Secretary must determine that a transaction: (1) ``involves [ICTS] 
designed, developed, manufactured, or supplied, by persons owned by, 
controlled by, or subject to the jurisdiction or direction of a foreign 
adversary,'' defined in E.O. 13873 as ``any foreign government or 
foreign non-government person engaged in a long-term pattern or serious 
instances of conduct significantly adverse to the national security of 
the United States or security and safety of United States persons, 
which, pursuant to E.O. 13873's implementing regulations at 15 CFR 
791.4 are the PRC, Republic of Cuba (Cuba), Islamic Republic of Iran 
(Iran), Democratic People's Republic of Korea (North Korea), Russia, 
and Venezuelan politician Nicol[aacute]s Maduro (Maduro Regime); and 
(2):
    A. ``Poses an undue risk of sabotage to or subversion of the 
design, integrity, manufacturing, production, distribution, 
installation, operation, or maintenance of information and 
communications technology or services in the United States;''
    B. ``Poses an undue risk of catastrophic effects on the security or

[[Page 5361]]

resiliency of United States critical infrastructure or the digital 
economy of the United States;'' or
    C. ``Otherwise poses an unacceptable risk to the national security 
of the United States or the security and safety of United States 
persons.''
    Factors A through C are collectively referred to as ``undue or 
unacceptable risks.'' In addition, section 1(b) of E.O. 13873 grants 
the Secretary the authority to design or negotiate mitigation measures 
to allow an otherwise prohibited transaction.
    The President also delegated to the Secretary the ability to 
promulgate regulations that, among other things, establish when 
transactions involving particular technologies may be categorically 
prohibited. E.O. 13873 section 2(a)-(b); see also 3 U.S.C. 301-02. 
Specifically, the Secretary may issue regulations establishing 
criteria, consistent with section 1 of E.O. 13873, by which particular 
technologies or market participants may be categorically included in or 
categorically excluded from prohibitions established pursuant to E.O. 
13873.

II. Introduction

    Today's vehicles contain a myriad of connected components that 
provide greater convenience for consumers and increase road safety for 
both drivers and pedestrians, such as Wi-Fi, Bluetooth, cellular, and 
satellite connectivity. However, the incorporation of progressively 
more complex hardware and software systems that facilitate these 
features has also increased the attack surfaces through which malign 
actors and foreign adversaries may exploit vulnerabilities to gain 
access to a vehicle. As BIS outlined in its March 1, 2024, ANPRM and 
its September 26, 2024, NPRM, certain ICTS integral to connected 
vehicles present an undue or unacceptable risk to U.S. national 
security when those systems are designed, developed, manufactured, or 
supplied by persons owned by, controlled by, or subject to the 
jurisdiction or direction of a foreign adversary.
    In the Securing the Information and Communications Technology and 
Services Supply Chain interim final rule, 86 FR 4909 (Jan. 19, 2021), 
the Secretary determined that certain foreign governments or foreign 
non-government persons--the PRC, Cuba, Iran, North Korea, Russia, and 
the Maduro Regime--constitute foreign adversaries for purposes of E.O. 
13873 and regulations promulgated pursuant to E.O. 13873. See 15 CFR 
791.4 (to the extent that the list of foreign adversaries identified in 
15 CFR 791.4 is updated to add or remove governments or non-government 
persons, this final rule intends to reflect the most up-to-date 
designations of foreign adversaries). Additionally, section 2(b) of 
E.O. 13873 provides that the Secretary may issue rules that identify 
particular technologies or countries with respect to transactions 
involving ICTS that warrant particular scrutiny. For the purposes of 
this final rule regarding transactions involving ICTS integral to 
connected vehicles, BIS is focusing its regulatory efforts on ICTS that 
are designed, developed, manufactured, or supplied by persons owned by, 
controlled by, or subject to the jurisdiction or direction of the PRC 
or Russia. BIS has identified that, for the purposes of addressing the 
national security risks posed by connected vehicles, these two foreign 
adversaries pose particular undue and unacceptable risks to U.S. 
national security because of these adversaries' legal, political, and 
regulatory regimes, combined with their current and anticipated growth 
and involvement in the connected vehicles sector.
    As discussed below, the PRC and Russia are able to leverage 
domestic legislation and regulatory regimes to compel companies subject 
to their jurisdiction, including carmakers and their suppliers, to 
cooperate with security and intelligence services. Such control over 
companies and their products and services means that their equipment is 
easily exploitable by PRC and Russian authorities. The privileged 
access that the PRC and Russia may gain to connected vehicles through 
their components, including software and hardware, could enable those 
foreign adversaries to (1) exfiltrate sensitive data collected by 
connected vehicles and (2) allow remote access and manipulation of 
connected vehicles driven by U.S. persons. Pursuant to E.O. 13873, BIS 
has determined that certain classes of transactions that can facilitate 
the exfiltration of data and remote manipulation of connected vehicles 
by the PRC and Russia pose undue or unacceptable risks to U.S. national 
security and to the safety and security of U.S. persons. These risks, 
moreover, present an urgent national security risk to the safety and 
security of technology used in the United States and to U.S. persons.
    The PRC has pre-positioned malware on U.S. information technology 
and critical infrastructure networks. The PRC has also set objectives 
for the completion of the People's Liberation Army's (PLA) 
modernization and other military and technology goals by 2027, which--
in light of the PLA's military-civil fusion strategy and the growing 
prevalence of PRC dual-use technologies in U.S. commercial supply 
chains, including in the auto industry--presents additional risks to 
U.S. national security. Mounting evidence of threats such as these to 
U.S. critical infrastructure, data security, and broader national 
security necessitates this urgent action by the U.S. government to 
address the risk of foreign adversary supply chains in the connected 
vehicles sector.

a. Overview of the Advance Notice of Proposed Rulemaking (ANPRM)

    BIS issued an ANPRM, 89 FR 15066 (Mar. 1, 2024), seeking public 
comment to inform a rulemaking that would address the undue or 
unacceptable risks posed by a class of transactions that involve ICTS 
designed, developed, manufactured, or supplied by persons owned by, 
controlled by, or subject to the jurisdiction or direction of a foreign 
adversary and integral to connected vehicles. In the ANPRM, BIS posed 
35 questions to the public for comment and feedback. The questions 
related to potential definitions used in the rulemaking, the degree of 
foreign adversary involvement in the connected vehicle supply chain, 
which systems should be the focus of a potential rulemaking, and what 
the economic impacts of a potential rulemaking might be, among other 
questions. BIS identified six systems as the potential focus for a 
future rule: (1) vehicle operating systems (OS), (2) telematics 
systems, (3) advanced driver assistance systems (ADAS), (4) automated 
driving systems (ADS), (5) satellite or cellular telecommunications 
systems, and (6) battery management systems (BMS). BIS received 57 
comment submissions in response to the ANPRM from a variety of parties, 
including original equipment manufacturers (OEMs), component suppliers, 
two foreign governments, nonprofit organizations, and individual 
respondents. Five comments contained Confidential Business Information 
(CBI), and one comment was retracted at the request of the commenter. 
The comments generally urged BIS to narrow the scope of a future 
regulation and to limit the systems to be regulated to only those 
posing significant national security risks. Commenters also urged BIS 
to provide industry stakeholders with sufficient lead time to comply. 
BIS considered each comment in developing the NPRM outlined in the next 
section.

b. Overview of the Notice of Proposed Rulemaking (NPRM)

    BIS then issued an NPRM, 89 FR 79088 (Sept. 26, 2024), that 
identified a smaller subset of systems in connected

[[Page 5362]]

vehicles that pose the most significant undue or unacceptable risk to 
national security when designed, developed, manufactured, or supplied 
by persons owned by, controlled by, or subject to the jurisdiction or 
direction of the PRC or Russia. Below is a summary of the proposed 
rule.
Regulated Systems
    The proposed rule identified (1) VCS, which is composed of the 
hardware and software that enable a connected vehicle to communicate 
off-board above 450 MHz, and (2) ADS, as subject to regulation by BIS. 
This determination was based, in part, on public comments requesting 
BIS narrow the scope of the rule, as a regulation that impacted all six 
of the listed automotive systems would be overbroad. The ANPRM listed 
ADS, operating systems, telematic systems, automated driving assistance 
systems, satellite and communication systems, and battery management 
systems as potential automotive systems that could be regulated in the 
subsequent proposed rule. Public comment as well as BIS's analysis 
suggested that automotive telematics functions were one of the primary 
means for a foreign adversary to exploit automotive data and actuation 
systems. BIS also determined, based on public comment as well as 
internal analysis, that the term ``telematics'' generally refers to 
systems that operate on cellular band protocols. As BIS intended to 
regulate multiple automotive connectivity systems, not just automotive 
cellular systems, BIS chose to use the broader term of ``VCS'' to 
encompass cellular, Wi-Fi, Bluetooth, and potentially satellite 
communications. The NPRM proposed to regulate both the hardware and 
software in VCS and solely the software in ADS.
Prohibited Transactions
    The NPRM proposed to (1) prohibit VCS hardware importers from 
knowingly importing into the United States certain hardware for VCS; 
(2) prohibit connected vehicle manufacturers from knowingly importing 
into the United States completed connected vehicles incorporating 
covered software, which was defined in the NPRM as certain software 
that supports the function of VCS or ADS; and (3) prohibit connected 
vehicle manufacturers from knowingly selling within the United States 
completed connected vehicles that incorporate software that supports 
the function of VCS or ADS. These prohibitions included in the NPRM 
applied when such VCS hardware or covered software was designed, 
developed, manufactured, or supplied by persons owned by, controlled 
by, or subject to the jurisdiction or direction of the PRC or Russia. 
The NPRM also proposed to (4) prohibit connected vehicle manufacturers 
who are owned by, controlled by, or subject to the jurisdiction or 
direction of the PRC or Russia from knowingly selling in the United 
States completed connected vehicles that incorporate VCS hardware or 
covered software, even when that hardware or software did not have a 
nexus to the PRC or Russia.
Declarations of Conformity
    The NPRM proposed that VCS hardware importers and connected vehicle 
manufacturers would submit to BIS, once per calendar year or model 
year, Declarations of Conformity attesting that they had not engaged in 
prohibited transactions involving VCS hardware or covered software. The 
NPRM would have mandated that VCS hardware importers and connected 
vehicle manufacturers submit a substantial amount of information with 
their Declarations of Conformity, including a hardware bill of 
materials (HBOM) or software bill of materials (SBOM), and a list of 
external endpoints to which the VCS hardware connected. In the final 
rule, BIS has changed the Declarations of Conformity requirement to 
clarify the certification, narrow the information required to be 
submitted, and add recordkeeping requirements.
Authorizations
    The NPRM enumerated general authorizations under which a regulated 
entity would be permitted to engage in an otherwise prohibited 
transaction without need to notify BIS. Under the NPRM, general 
authorizations would have been available to small business VCS hardware 
importers and connected vehicle manufacturers. Specifically, general 
authorizations applied if (1) the connected vehicle manufacturer or VCS 
hardware importer produced fewer than 1,000 connected vehicles or VCS 
hardware units; (2) the completed connected vehicle was used on public 
roadways for fewer than 30 calendar days in a year; (3) the completed 
connected vehicle or VCS hardware was used solely for purposes of 
display, testing, or research; or (4) the completed connected vehicle 
was imported solely for repair, alteration, or competition off public 
roads and would have been exported within one year of import. In the 
final rule, BIS has revised the general authorizations provision so 
that the above-mentioned general authorizations are not provided in the 
rule text itself. Instead, BIS will issue general authorizations 
through its website and the Federal Register.
    The NPRM also provided a process for specific authorizations. 
Following an application to and approval from BIS, a specific 
authorization granted VCS hardware importers and connected vehicle 
manufacturers the ability to engage in otherwise prohibited 
transactions not eligible for a general authorization, subject to 
certain conditions imposed by BIS.
Exemptions
    The NPRM permitted VCS hardware importers to engage in otherwise 
prohibited transactions involving VCS hardware and exempted them from 
certain requirements so long as: (1) for VCS hardware not associated 
with a model year, the import of the VCS hardware had taken place prior 
to January 1, 2029; or (2) the VCS hardware unit was associated with a 
vehicle model year prior to 2030 or the VCS hardware was integrated 
into a connected vehicle (completed or incomplete) with a model year 
prior to 2030. In the NPRM, connected vehicle manufacturers were 
permitted to engage in otherwise prohibited transactions involving 
covered software and exempt from certain requirements so long as the 
completed connected vehicle that was imported, or sold within the 
United States, was of a model year prior to 2027. Lastly, connected 
vehicle manufacturers that are owned by, controlled by, or subject to 
the jurisdiction or direction of the PRC or Russia were permitted to 
sell completed connected vehicles with a model year prior to 2027 that 
incorporated VCS hardware or covered software. The final rule includes 
new exemptions for parts that are imported for the purpose of warranty 
or repair of a completed connected vehicle with a model year prior to 
2030.
Advisory Opinions, Is-Informed Notices, and Appeals
    The NPRM provided an advisory opinion mechanism by which regulated 
entities could seek guidance from BIS as to whether specific 
prospective transactions were subject to the proposed rule's 
prohibitions. The mechanism included in the NPRM applied to actual, as 
opposed to hypothetical, transactions in which all parties are 
identified. Additionally, the NPRM permitted BIS to issue certain ``Is-
Informed'' notices to VCS hardware importers and connected vehicle 
manufacturers to inform them that a specific authorization was required 
for an activity. The NPRM also included an

[[Page 5363]]

appeal process by which any person whose application for a specific 
authorization was denied, whose specific authorization was suspended or 
revoked, or who received a written notification of ineligibility for a 
general authorization could appeal that decision to the Under Secretary 
for Industry and Security (Under Secretary). In the final rule, BIS has 
added a 60-day timeline for BIS to respond to advisory opinion requests 
and clarified procedural requirements of submitting an appeal request.
Recordkeeping and Reporting
    The NPRM proposed that regulated entities keep a ``full and 
accurate record'' for a period of 10 years after each transaction for 
which a Declaration of Conformity, general authorization, or specific 
authorization was required, regardless of whether the transaction was 
effected pursuant to such an authorization. In the NPRM, VCS hardware 
importers and connected vehicle manufacturers were required to furnish 
``complete information'' relevant to any transaction involving the 
import of VCS hardware or covered software, irrespective of any 
authorization granted by BIS.
Violations
    The NPRM additionally outlined the framework by which BIS 
determined a violation took place, the procedure by which BIS notified 
an affected party of such a violation (including the party's right to 
respond or to settle), the specific penalties BIS was permitted to 
impose on violators, and the administrative collection of those 
penalties.

c. Overview of Final Rule

    The final rule benefits from the responses received during the 
public comment periods for the ANPRM and the NPRM and incorporates 
significant portions of that feedback. For example, BIS considered 
public feedback to define the scope of connected vehicles, identify 
ICTS integral to connected vehicles, and better understand the effects 
of any potential prohibition. As stated in the NPRM, determining the 
scope of the prohibitions required a balancing of the need to address 
the undue or unacceptable risk posed by foreign adversary involvement 
in the connected vehicles supply chain with the impact on the public 
and industry. For a detailed discussion of how the final rule has 
changed from the NPRM, refer to Section V: Discussion of the Final Rule 
and Section VI: Revisions from the Proposed Rule and Response to 
Comments.

III. Comments on the Notice of Proposed Rulemaking

    BIS received 101 comments on the NPRM.\1\ Many commenters agreed 
with BIS's risk assessment of foreign adversary connected vehicle 
technology as described in Section IV of the NPRM and supported the 
decision to address these risks through supply chain regulation. 
Commenters' concerns with the NPRM centered on the broad scope of the 
regulation and the potentially onerous and disruptive nature of the 
compliance process, particularly the submission of Declarations of 
Conformity. Some commenters disagreed with the NPRM's inclusion of the 
commercial vehicle market, arguing that definitions proposed in the 
NPRM did not as easily apply to this sector compared to the passenger 
vehicle market. Commenters also warned that the wide scope of the NPRM 
across the connected vehicle market may have significant economic 
impact and that the current implementation timeline could not easily be 
met by industry.
---------------------------------------------------------------------------

    \1\ This includes four written submissions received after the 
close of the public comment period, all of which were considered and 
posted on regulations.gov.
---------------------------------------------------------------------------

    Commenters requested that BIS implement alternative methods of 
compliance, such as a self-certification model; provide greater detail 
on the HBOM and SBOM submission requirements; and describe how BIS 
intends to protect any submitted data. Commenters also voiced 
apprehension over any requirement to share proprietary information with 
customers and the government. For a more thorough discussion of the 
comment submissions and BIS's responses, please see Section IV: Risks 
Associated with Vehicle Connectivity Systems and Automated Driving 
Systems When Designed, Developed, Manufactured, or Supplied by Persons 
Owned by, Controlled by, or Subject to the Jurisdiction or Direction of 
the PRC and Russia and Section V: Discussion of the Final Rule.

IV. Risks Associated With Vehicle Connectivity Systems and Automated 
Driving Systems When Designed, Developed, Manufactured, or Supplied by 
Persons Owned by, Controlled by, or Subject to the Jurisdiction or 
Direction of the PRC and Russia

    BIS received multiple comments related to the risks stemming from 
VCS and ADS when designed, developed, manufactured, or supplied by 
persons owned by, controlled by, or subject to the jurisdiction or 
direction of the PRC or Russia. Commenters agreed with the risks posed 
by PRC and Russian involvement in the connected vehicle supply chain as 
laid out in the NPRM, and BIS reiterates those same risks in this 
section. For instance, one commenter acknowledged that allowing 
adversarial suppliers into the automotive supply chain poses direct 
threats to data integrity, consumer safety, and national security. In 
contrast, another commenter critiqued the proposed rule as overly broad 
and characterized the threats as hypothetical in nature, underscoring 
that PRC and Russian companies are incentivized to avoid exploiting 
vulnerabilities in connected vehicles in order to avoid conflict. BIS 
recognizes that many of the risks laid out in the NPRM and final rule 
are forward-looking, and this rulemaking is an attempt to proactively 
address these risks before PRC and Russian actors are able to leverage 
them to harm U.S. national security. Moreover, while BIS agrees that 
action by the PRC or Russia to leverage vulnerabilities in VCS or ADS 
could feasibly cause undesired conflict, the strategic benefit of 
exploiting vulnerabilities may outweigh other types of harm it causes 
and thus is unlikely to preclude such an action altogether from the 
perspective of the PRC and Russia. Another commenter highlighted that 
the rule does not apply retroactively to address any of the data 
already collected by connected vehicle manufacturers that may have 
already been legitimately transferred to the PRC or other foreign 
adversaries and may be informing foreign intelligence analysis. BIS 
recognizes that some connected vehicle and component manufacturers may 
already transfer vehicle data abroad, a point that is reiterated later 
in this final rule. However, BIS believes that retroactive application 
of this rule would not reduce or alleviate any of the harm that has 
already occurred as a result of foreign intelligence organizations 
gaining access to that data. Following consideration of the comments 
received on the NPRM, and further consideration of the risks and 
vulnerabilities associated with various ICTS components that are 
critical to the operation of connected vehicles, BIS has decided to 
retain the proposed rule's focus on two integral ICTS systems--VCS and 
ADS--when designed, developed, manufactured, or supplied by persons 
owned by, controlled by, or subject to the jurisdiction or direction of 
two foreign adversaries--the PRC and Russia. Below, BIS provides its 
findings of the undue and unacceptable risks associated with these 
particular systems, and these particular foreign

[[Page 5364]]

adversaries, following this latest round of public comments.

a. Vulnerabilities Associated With Vehicle Connectivity Systems and 
Automated Driving Systems

1. Vehicle Connectivity Systems
    The term VCS encompasses hardware and software systems--such as the 
telematics control units (TCU), cellular modems and antennas, and other 
automotive components--that integrate various radio frequency (RF) 
communication technologies and enable connected vehicles to access 
external data sources, facilitate vehicle-to-vehicle communication, and 
provide enhanced services to users through seamless connectivity 
options. For example, as the primary automotive VCS component, a TCU 
acts as the primary interface between the internal network and external 
communication channels. It collects data from onboard sensors such as 
Global Positioning Systems (GPS), accelerometers, gyroscopes, BMS, and 
other Electronic Control Units via wired networks like Controller Area 
Network (CAN) bus, Local Interconnect Network (LIN), FlexRay, 
Automotive Ethernet and K-Line, as well as wireless protocols such as 
Bluetooth and Wi-Fi. Some systems use cameras and microphones to 
facilitate facial recognition of drivers or to respond to voice 
commands of drivers. Once gathered, the TCU converts this internal data 
into radio frequency signals suitable for transmission over the chosen 
wireless protocol. In other words, as the vast array of sensors on a 
connected vehicle collect information about a driver's location, speed, 
voice patterns, battery state of charge, or other vehicle diagnostic 
and operational information, the TCU converts that data into a format 
that can be transmitted to systems outside the vehicle and then enables 
that transmission. Sensing systems, such as radar, audio, video, or 
Light Detection and Ranging (LiDAR) hardware and software, are not VCS. 
Based on a number of comments to the proposed rule, BIS recognizes a 
national security risk posed by LiDAR, but it concludes that focusing 
this regulation on VCS hardware and software systems, which ultimately 
enable the external communication of end-point sensors, is an 
appropriate scope at this time. For a more thorough discussion on the 
exclusion of PRC or Russian LiDAR from this rule, please see Section VI 
below.
    While the increased degree of vehicle connectivity offers benefits 
to both consumers and manufacturers, it also increases risks to 
consumers and manufacturers due to the number of access points into the 
internal connected vehicle network. Each access point may present 
multiple new software vulnerabilities for adversaries to exploit. See 
Cabell Hodge, Konrad Hauk, Shivam Gupta, and Jess Bennett, Vehicle 
Cybersecurity Threats and Mitigation Approaches, National Renewable 
Energy Laboratory, at 4-5 (Aug. 2019), https://www.nrel.gov/docs/fy19osti/74247.pdf. Such compromise of VCS software could occur at 
various points of the software development lifecycle where software 
functionality can be accessed and altered, including tool development, 
source code repositories, open-source dependencies, software updates, 
and shipment interdiction. For instance, Upstream's 2024 Global 
Automotive Cybersecurity Report documented a case where security 
researchers installed malicious software on the VCS by performing a 
simulated jailbreak attack of an OEM's VCS using a voltage fault 
injection on the chipmaker's processor. This malicious software 
unlocked features to manipulate the vehicle, such as acceleration and 
heated seats. Upstream, 2024 Global Automotive Cybersecurity Report, at 
62 (Feb. 2024), https://upstream.auto/reports/global-automotive-cybersecurity-report. The software also provided access to private user 
data and enabled decryption of encrypted Non-Volatile Memory Express 
(NVMe) storage, manipulation of the car's identity, and extraction of 
the vehicle-unique credential used for authenticating and authorizing 
the OEM's internal service network. See id. By compromising software or 
its dependencies, malign actors may surveil, disrupt, damage, or 
otherwise exploit the data or systems of those who use the software. 
See National Counterintelligence and Security Center, Software Supply 
Chain Attacks, (Mar. 2021), https://www.dni.gov/files/NCSC/documents/supplychain/Software_Supply_Chain_Attacks.pdf.
    The threat of such a cyber operation by malicious actors can grow 
significantly when firmware or hardware components are intentionally 
designed with vulnerabilities. Access to the hardware supply chain for 
VCS provides an avenue for threat actors to manipulate or insert, with 
malicious intent, hardware, or firmware modules into telematics 
hardware components such as modems, Systems on Chip (SoC), Printed 
Circuit Boards (PCB), Central Processing Units, and antennae. 
Manipulating or modifying hardware and associated firmware in the 
supply chain could also allow foreign adversaries to insert a backdoor, 
granting them control over the VCS. See Cybersecurity & Infrastructure 
Security Agency, Defending Against Software Supply Chain Attacks, at 6 
(Apr. 2021), https://www.cisa.gov/sites/default/files/publications/defending_against_software_supply_chain_attacks_508.pdf; National 
Counterintelligence and Security Center, Software Supply Chain Attacks, 
(Apr. 2023), /www.dni.gov/files/NCSC/documents/supplychain/Software_Supply_Chain_Attacks.pdf">https://www.dni.gov/files/NCSC/documents/supplychain/Software_Supply_Chain_Attacks.pdf">https://www.dni.gov/files/NCSC/documents/supplychain/Software_Supply_Chain_Attacks.pdf. For instance, cellular and satellite 
telecommunications transceivers are pivotal connectivity components in 
the VCS, utilizing radio frequency (RF) energy to facilitate the 
transmission and reception of data between a vehicle and the external 
world. If these transceivers are designed, developed, manufactured, or 
supplied by persons owned by, controlled by, or subject to the 
jurisdiction or direction of the PRC or Russia, such actors would have 
the means and capability to introduce vulnerabilities that could be 
exploited to intercept and/or compromise the information exchanged 
between the connected vehicle and the external world.
2. Automated Driving Systems
    The complexity of ADS software, the large foundation of data 
sources, and the driving responsibilities inherent to ADS render it a 
valuable target for exploitation. An ADS encompasses the upper end of 
the spectrum of autonomy levels that dictate the vehicle's 
independence, and the extent of driver intervention required. The 
primary standard setting organization for automotive autonomy is the 
global mobility standard-setting body SAE International. SAE 
International sets standards that affect many aspects of automotive 
production and maintenance, often in concert with the International 
Standards Organization (ISO). SAE International's Taxonomy and 
Definitions for Terms Related to Driving Automation Systems for On-Road 
Motor Vehicles (SAE J3016) is the current industry norm for evaluating 
standard levels of vehicle autonomy. SAE J3016 autonomy levels range 
from Level 0 (no automation) where the driver controls all aspects of 
driving, to Level 5 (full automation) where the vehicle can operate 
independently under all conditions without human intervention. Levels 1 
and 2 offer driver assistance through systems that control either 
steering or acceleration and braking, while Levels 3 through 5 (which 
generally comprise ADS)

[[Page 5365]]

progressively increase the system's responsibility for driving tasks. 
Level 4 requires the ability to complete all driving functions on a 
sustained basis within defined operational design domains (ODDs), while 
Level 5 requires the ability to complete all driving functions 
unconditionally. As the autonomy level increases, the reliability and 
safety of the ADS become increasingly reliant on the system's 
operational performance, safety protocols, and cybersecurity measures. 
See SAE J3016_02104, Taxonomy and Definitions for Terms Related to 
Driving Automation Systems for On-Road Motor Vehicles, SAE 
International, at 31-32 (Apr. 2021), https://www.sae.org/standards/content/j3016_202104/.
    An ADS must be able to execute Dynamic Driving Tasks (DDTs) within 
specific ODDs. DDTs include critical tasks such as steering, braking, 
acceleration, and Object and Event Detection, Classification and 
Response (OEDCR). OEDCR enables an ADS to perceive and respond to 
surrounding objects and events, a responsibility that shifts 
progressively from the driver to the ADS itself as the degree of 
vehicle autonomy increases. See id. at 17; Edward Griffor, David 
Wollman, and Christopher Greer, Automated Driving System Safety 
Measures Part 1: Operating Envelope Specification, NIST Special 
Publication 1900-301, at 2 (2021), https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.1900-301.pdf.
    An ADS relies on a large foundation of connected information 
sources for decisions and outputs which, in turn, could create inherent 
vulnerabilities. For example, a user of a vehicle, or even an OEM 
purchaser of ADS likely does not know the sum total of what data the 
ADS was trained on, or how, specifically, the ADS makes its decisions. 
It is not possible to find single lines of code that dictate how an ADS 
responds to specific scenarios in modern ADS systems. Rather, leading 
ADS are controlled by complex software that can include a neural net 
that references training data and previous decisions to instantaneously 
decide on an action in a driving setting. This opacity and lack of 
understanding of how the system actually reacts is inherently 
vulnerable to poisoned data injection or specific scenario-based 
failures. As a result, the complex software systems that drive 
decisions for an ADS are valuable targets for malicious actors to 
exploit. Software-based threats to connected vehicles equipped with an 
ADS include manipulation of sensors to create phantom objects; 
manipulation of ADS software to detect, capture, and retain information 
about specific geographic areas or other sensitive data; or other 
manipulation of sensor fusion processing software that could lead to 
faulty and dangerous vehicle decision making, to include unauthorized 
control over the connected vehicle. See National Counterintelligence 
and Security Center, Autonomous Automotive Vehicle Supply Chain Risk, 
(2022), https://www.dni.gov/files/NCSC/documents/supplychain/autonomous-vehicles-placemat-2022-D9A54B50-.pdf.
    A compromised ADS creates opportunities for data exfiltration and 
unauthorized vehicle manipulation due to the direct access it has to 
the Internal Vehicle Network (IVN). The IVN controls the communication 
framework within a connected vehicle, overseeing the electronic control 
units (ECUs) responsible for engine control, traction control, door 
locks, climate control, battery management, powertrain, airbags, 
cameras, and radar functionalities. These ECUs also communicate via 
overlaid communication networking protocols such as a CAN bus, LIN, and 
ethernet. See Anastasios Giannaros, et al. Autonomous Vehicles: 
Sophisticated Attacks, Safety Issues, Challenges, Open Topics, 
Blockchain and Future Directions, Journal of Cybersecurity and Privacy 
3.3, at 508-513, (2023). Because ADS interacts with ECUs through the 
IVN, a compromised ADS has the capability to execute functions that 
affect nearly all of a connected vehicle's software and hardware 
components. For example, an update to an ADS could alter outputs the 
ADS makes to a Body Control Unit, enabling the ADS to erroneously and 
dangerously open a vehicle's door while in motion. Moreover, because 
many connected vehicles maintain their own networks and actively scan 
their operating environment for other proximate networks, an ADS can 
also potentially be used to impact the IVN of other vehicles or 
transportation infrastructure networks through vehicle-to-vehicle 
communication. This could lead to disablement or compromise of other 
vehicles or of transportation infrastructure, affecting the movement of 
goods and the physical safety of drivers. See National 
Counterintelligence and Security Center, Autonomous Automotive Vehicle 
Supply Chain Risk (Apr. 2022), https://www.dni.gov/files/NCSC/documents/supplychain/autonomous-vehicles-placemat-2022-D9A54B50-.pdf; 
Patrick Wagner, Nikolai Puch, and David Emeis, Cybersecurity risk 
analysis of an automated driving system, Fraunhofer Institute AISEC 
(Oct. 2023), https://publica.fraunhofer.de/entities/publication/4d66e81e-3570-4c49-9f8c-8c9967a34ca6/details.
    Given the significant processing power and complex decision-making 
capability of an ADS, the risks arising from ADS designed, developed, 
manufactured, or supplied by persons owned by, controlled by, or 
subject to the jurisdiction or direction of a foreign adversary extend 
beyond the IVN itself and include risks to the fidelity and integrity 
of data that flows to downstream or adjacent transportation 
infrastructure. Foreign adversaries can corrupt ADS data by exploiting 
existing vulnerabilities in ADS connectivity environments. See 
subsection IV.b. As such, direct access to an ADS afforded to a 
malicious actor or foreign adversary through the design, development, 
manufacture, or supply of ADS software has the potential to cause 
severe adverse consequences to U.S. national security and U.S. persons.

b. Threats Associated With the PRC and Russia

    Several commenters agreed that PRC laws compel compliance with 
government requests, thereby making some companies subject to the 
direction of the PRC government. One commenter provided additional 
detail about the linkages between prominent Chinese companies, the PRC 
military, and the global automotive industry. Two commenters noted that 
current investments by Chinese companies in Mexico may allow effective 
``backdoor'' access to the American auto market. One commenter 
specifically pointed to the risks posed by Chinese-developed buses with 
connectivity features as posing a particular threat to U.S. national 
security. While commercial vehicles such as buses are not in the scope 
of this final rule, BIS intends to propose a new rule specifically 
tailored to the commercial vehicle sector in order to address 
substantial national security risks. Another commenter agreed with the 
Department's actions, specifically as it related to addressing the 
large amounts of data collected by connected vehicles already being 
transmitted to the PRC, regardless of the vehicle's physical location. 
In response to commenters' agreement with the nature of PRC and Russian 
legal and regulatory landscapes, BIS is reiterating its legal and risk 
analyses in this final rule. Moreover, BIS thanks commenters for 
providing additional information that clarifies the linkages between 
the PRC state, military, and the broader economy. In light of concerns 
raised by

[[Page 5366]]

commenters regarding PRC companies' investments in Mexico, BIS 
reiterates that PRC investments in Mexico's auto sector risk creating 
additional potential nexus points between PRC connected vehicle 
suppliers and U.S. automakers and consumers. Similarly, BIS agrees with 
commenters' concerns that the PRC-linked entities already collect large 
amounts of data, including from vehicles which are currently located in 
the United States. These concerns directly underscore the importance 
and necessity of this rulemaking.
    The design, development, manufacture, or supply of certain VCS and 
ADS components by persons owned by, controlled by, or subject to the 
jurisdiction or direction of the PRC or Russia poses undue or 
unacceptable risks to national security and U.S. persons. As discussed 
further, the PRC and Russia have adopted political, legal, and 
regulatory regimes that enable their governments to exercise direct and 
indirect ownership, control, or influence over entities in the 
connected vehicle supply chain. In addition, unlike other foreign 
adversaries, the PRC and Russia have certain current and anticipated 
industrial capabilities and expertise that uniquely position them 
within the global automotive market to pose an outsized risk, 
particularly when paired with the vulnerabilities present within 
certain connected vehicle systems.
1. PRC
    The PRC's role in the U.S. connected vehicle supply chain presents 
undue and unacceptable risks. The PRC has a large and growing 
automotive sector that has become increasingly integrated into the ICTS 
supply chains of global automakers, providing the PRC automotive sector 
with potential increased access to the U.S. automotive market. Further, 
the PRC's automotive sector has historical and ongoing links to the PRC 
military and is influenced by pervasive government intervention, 
including through legal and regulatory structures that increase 
government oversight of and control over PRC-based companies and their 
foreign subsidiaries. See Du Xiaoying and Wang Siyi, Dongfeng plays 
pivotal role in supporting China's military, China Daily (Sept. 25, 
2015), https://www.chinadaily.com.cn/cndy/2015-09/25/content_21976945.htm; Matthew Funaiole, et al., China Accelerates 
Construction of `Ro-Ro' Vessels, with Potential Military Implications, 
Center for Strategic and International Studies (Oct. 11, 2023), https://chinapower.csis.org/analysis/china-construct-ro-ro-vessels-military-implications/ (describing the involvement of Chinese automakers in the 
production of ``ro-ro'' vessels and the dual-use applications of ro-ro 
vessels, including clear evidence that the PRC military intends to 
utilize ro-ros to support military operations). Moreover, the PRC 
possesses advanced cyber espionage capacities that it exercises through 
both state and non-state cyber actors, exacerbating such risks. See 
Simon Handler, The 5x5-China's cyber operations, The Atlantic Council 
(Jan. 2023), https://www.atlanticcouncil.org/content-series/the-5x5/the-5x5-chinas-cyber-operations/.
    First, the size and scale of state control in the PRC auto sector 
poses outsized risks, increasing the vectors by which the national 
security threats associated with connected vehicles can enter the 
United States. The PRC automotive sector has played an important role 
in its domestic industrial policy since 1986, when the sector was first 
named a ``pillar industry'' in the Seventh Five-Year Plan. The 
Fourteenth Five-Year Plan, the latest strategic framework for the PRC, 
continues to prioritize the technological innovation and sustainable 
development of the automobile market, including new energy vehicles and 
connected vehicle software and hardware systems, as key priorities. See 
Ben Murphy, Outline of the People's Republic of China 14th Five-Year 
Plan for National Economic and Social Development and Long-Range 
Objectives for 2035, Center for Security and Emerging Technology, at 
22-23 (May 2021), https://cset.georgetown.edu/wp-content/uploads/t0284_14th_Five_Year_Plan_EN.pdf. For many years, the state has pursued 
policies and practices to further its industrial policy objectives in 
the automotive sector, including mandatory joint venture requirements, 
foreign equity restrictions, massive subsidies, and other financial 
support measures. The PRC automotive sector's growth is also led in 
part by several prominent state-owned firms, some of which began as 
military equipment suppliers (e.g., Dongfeng, Sichuan Auto Works, 
Shanxi Auto Works). See Mattias Holweg, Jianxi Luo, and Nick Oliver, 
The past, present and future of China's automotive industry: a value 
chain perspective, International Journal of Technological Learning, 
Innovation and Development 2, at 14 (Feb. 2009), https://www.pure.ed.ac.uk/ws/portalfiles/portal/7765689/Oliver.pdf. In recent 
years, this growth and development has led to a massive surge in 
domestic vehicle production, with Chinese vehicle production increasing 
by 1.5 times over the 15-year span between 2008 and 2023. Indeed, in 
2023, the PRC alone was responsible for nearly 33 percent of global 
passenger vehicle production. See VDA, Global passenger vehicle 
production in 2023, by country [Graph], (Retrieved July 23, 2024), 
https://www.statista.com/statistics/277055/global-market-share-of-regions-on-auto-production/; OICA & Statista, China's share in global 
vehicle production from 2008 to 2021 [Graph], (Mar. 17, 2022), https://www.statista.com/statistics/233942/chinas-share-of-global-production-capacity-of-the-automobile-industry/.
    Amid this significant growth in the PRC's domestic auto industry, 
Chinese automakers, both state-owned and private firms, have leveraged 
their significant state-backed support, including subsidies, to fuel a 
global expansion that has seen Chinese automakers establishing foreign 
operations in countries like South Africa, the Netherlands, Thailand, 
Japan, and Brazil, among others, increasing the risks stemming from PRC 
auto manufacturing in third countries. See Daisuke Wakabayashi and 
Claire Fu, China E.V. Makers Rush In and Upend a Country's Entire Auto 
Market, The New York Times (Jul. 30, 2024), https://www.nytimes.com/2024/07/30/business/chinese-electric-vehicles-thailand.html; Daniel 
Leussink, BYD's Global expansion push runs into stiff Japan test, 
Reuters (Sept. 4, 2024), https://www.reuters.com/business/autos-transportation/byds-global-expansion-push-runs-into-stiff-japan-test-2024-09-05/; China's BYD starts construction on manufacturing complex 
in Brazil, Reuters (Mar. 5, 2024), https://www.reuters.com/business/autos-transportation/chinas-byd-starts-construction-manufacturing-complex-brazil-2024-03-06/.
    The global expansion of the PRC auto sector's operations in foreign 
markets and recent foreign investment announcements indicate that 
Chinese automakers could attempt to enter the U.S. market via exports 
from third-party countries. Exports from third-party countries of 
vehicles with Chinese ICTS would expand the scope of the risk that 
Chinese ICTS poses to U.S. national security. See Paul Wiseman, 
Prospect of low-priced Chinese EVs reaching US from Mexico poses threat 
to automakers, The Associated Press (June 27, 2024), https://www.ap.org/news-highlights/spotlights/2024/prospect-of-low-priced-chinese-evs-reaching-us-from-mexico-poses-threat-to-automakers/; Daina 
Beth Solomon, Chinese automaker BYD looking for Mexico plant location,

[[Page 5367]]

executive says, Reuters (Feb. 28, 2024), https://www.reuters.com/business/autos-transportation/chinese-carmaker-byd-launches-low-cost-dolphin-mini-ev-mexico-2024-02-28/. Some PRC-based companies have 
announced plans to establish manufacturing facilities in Mexico, which 
could enable them to receive favorable trade terms contained in the 
U.S.-Mexico-Canada Agreement (USMCA). See id. Therefore, the PRC's 
growing presence within the global auto sector, particularly via 
operations in third-party countries, is expected to expand the number 
of potential nexus points between PRC connected vehicle suppliers and 
U.S. automakers and consumers, further undermining U.S. national 
security.
    Second, the military linkage between the PRC government and the 
automotive sector continues to the current day with the PRC's military-
civil fusion strategy, which seeks to, among other goals, exploit 
investment and innovation within the PRC's private sector to achieve 
military modernization goals. The military-civil fusion strategy 
prioritizes specific information and communication technologies and 
services that are integral to connected vehicle supply chains (e.g., 
telecommunications, artificial intelligence). See Ben Murphy, 
Translation for Outline of the People's Republic of China 14th Five-
Year Plan for National Economic and Social Development and Long-Range 
Objectives for 2035, Center for Security and Emerging Technology, at 11 
and 36 (May 2021), https://cset.georgetown.edu/wp-content/uploads/t0284_14th_Five_Year_Plan_EN.pdf. Strategies to achieve these goals 
include mandating collaboration between PRC-based companies and the 
military and establishing public and private firms as vectors to 
facilitate technology transfer, industrial espionage, and intellectual 
property (IP) theft that would be advantageous for the PRC military. 
See Office of the Dir. of Nat'l Intelligence, Annual Threat Assessment 
of the U.S. Intelligence Community, at 6-10 (Feb. 6, 2023), https://www.odni.gov/files/ODNI/documents/assessments/ATA-2023-Unclassified-Report.pdf.
    Third, even beyond military-civil fusion, the role of the PRC 
government in the auto sector has only grown as government intervention 
in the market increases. For example, the PRC intervenes in the auto 
market through direct ownership of prominent industry participants, the 
purchasing of so-called ``golden shares'' to gain significant levels of 
influence within otherwise private firms, embedding Chinese Communist 
Party (CCP) representatives within corporate boards and management, and 
the forceful application, or threat, of the PRC's expansive security 
laws, including its digital era legal structure. See Lingling Wei, 
China's New Way to Control Its Biggest Companies: Golden Shares, Wall 
Street Journal (Mar. 2023), https://www.wsj.com/articles/xi-jinpings-subtle-strategy-to-control-chinas-biggest-companies-ad001a63. Laws 
promulgated in recent years provide the PRC government increased 
oversight and control over PRC-based companies and their foreign 
subsidiaries, providing a lever for influence over corporate operations 
that further exacerbates the threat that the PRC poses to U.S. national 
security. These laws require PRC-based companies, wherever located, to 
comply with certain access and information requests upon demand from 
the PRC and therefore could be used by the PRC to obtain business or 
other data from PRC-based companies involved in the connected vehicle 
supply chain. Companies operating under these laws frequently highlight 
the lack of transparency, consistency, clarity, and predictability of 
the enforcement of these laws, publicly stating that PRC laws relating 
to cybersecurity, data storage, or cryptography are not subject to the 
same degree of judicial accountability as they might be in other 
jurisdictions. In particular, BIS notes the PRC may utilize a suite of 
national security laws (e.g., Counter-Espionage Law of the People's 
Republic of China [promulgated by the Standing Committee of the 
National People's Congress, Nov. 1, 2014, amended Apr. 26, 2023, 
effective July 1, 2023]; National Security Law of the People's Republic 
of China [promulgated by the Standing Committee of the National 
People's Congress, July 1, 2015, effective July 1, 2015]; National 
Intelligence Law of the People's Republic of China [promulgated by the 
Standing Committee of the National People's Congress, June 27, 2017, 
effective June 28, 2017, amended Apr. 27, 2018]; Anti-Terrorism Law of 
the People's Republic of China [promulgated by the Standing Committee 
of the National People's Congress, Dec. 27, 2015, effective Jan. 1, 
2016, amended Apr. 27, 2018]) to compel companies, including those in 
the connected vehicle supply chain, to support national security 
efforts--which are more broadly defined in the PRC than in the United 
States--or military agents upon request. The PRC pursues its broad 
national security and geopolitical objectives through the creation of 
backdoors and security vulnerabilities in products sold abroad, and, in 
many cases, the PRC prohibits companies from disclosing that such a 
request was made. See U.S. Department of Homeland Security, Data 
Security Business Advisory: Risks and Considerations for Businesses 
Using Data Services and Equipment from Firms Linked to the People's 
Republic of China, (Dec. 2022), https://www.dhs.gov/sites/default/files/publications/20_1222_data-security-business-advisory.pdf; 
Ministry of Civil Affairs of the People's Republic of China, National 
Security Law of the People's Republic of China, Arts. 25 and 77, 
promulgated by the 12th National People's Congress on July 1, 2015, 
https://www.mca.gov.cn/zt/n2643/n2647/c1662004999979993333/content.html. Additionally, PRC authorities have established a 
regulatory system that effectively allows them to stockpile cyber 
vulnerabilities. Entities subject to these regulations, including 
automotive systems manufacturers, are required to report 
vulnerabilities upon discovery to PRC authorities before patching them. 
See Cyberspace Administration of China, Provisions on the Management of 
Security Vulnerabilities of Network Products, (July 2021), https://www.cac.gov.cn/2021-07/13/c_1627761607640342.htm. This requirement 
drastically increases the ability of the PRC government and PRC-backed 
cyber actors to take action against the United States using connected 
hardware and its associated software by creating an accessible library 
of known and potentially unpatched vulnerabilities.

[[Page 5368]]

    Fourth, the PRC has demonstrated a high level of competency in 
cyber malfeasance. For instance, PRC state-sponsored cyber group Volt 
Typhoon has proven capable of infiltrating the IT networks of critical 
U.S. infrastructure using sophisticated tactics, techniques, and 
procedures such as Living Off the Land Techniques to pre-position 
themselves across U.S. critical infrastructure and military assets to 
carry out advanced reconnaissance in IT systems. At a later point, once 
advanced reconnaissance is conducted, they are then capable of 
launching cyberattacks to impede U.S. decision making, induce social 
panic, and interfere with the deployment of U.S. military forces. See 
Cybersecurity & Infrastructure Security Agency, PRC State-Sponsored 
Actors Compromise and Maintain Persistent Access to U.S. Critical 
Infrastructure, at 1-5 (Feb. 2024), https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf. A 2022 Annual Report to Congress by the U.S.-China Economic 
and Security Review Commission found that the PRC's ability and 
willingness to ``weaponize'' its own industries, particularly its 
cybersecurity industry, grants the country an asymmetric advantage over 
the United States. This argument is supported by public reporting 
detailing the methods by which known government-affiliated cyber threat 
groups utilize private firms to carry out their attacks. See U.S.-China 
Economic and Security Review Commission, 2022 Annual Report to 
Congress, at 11 and 14-15 (Nov. 2022), https://www.uscc.gov/sites/default/files/2022-11/2022_Annual_Report_to_Congress.pdf; Christian 
Shepherd, et al., Leaked files from Chinese firms show vast 
international hacking efforts, The Washington Post (Feb. 22, 2024), 
https://www.washingtonpost.com/world/2024/02/21/china-hacking-leak-documents-isoon/. Additionally, a 2012 report from the United States 
Senate Permanent Select Committee on Intelligence examining the 
national security risks posed by the PRC-based companies Huawei and ZTE 
specifically argued that there are numerous opportunities for PRC-based 
threat actors to insert malicious hardware or software components into 
ICTS products throughout the product development stage. See Permanent 
Select Committee on Intelligence, Investigative Report on the U.S. 
National Security Issues Posed by Chinese Telecommunications Companies 
Huawei and ZTE, at 3 (Oct. 2012), https://intelligence.house.gov/sites/intelligence.house.gov/files/documents/huawei-zte%20investigative%20report%20(final).pdf. This risk is further 
demonstrated by a study of designed vulnerabilities in products 
conducted by the Georgetown Security Studies Review, which outlines 
five years of persistent insertion of malicious code by PRC-based 
threat actors. See Ryan Neauhard, Flawed by design electronics with 
pre-installed malware, Georgetown Security Studies Review, at 2 (May 
23, 2018), https://georgetownsecuritystudiesreview.org/2018/05/23/flawed-by-design-electronics-with-pre-installed-malware/. Given the 
above, the PRC's access to the U.S. connected vehicle supply chain 
through its growing automotive sector, military-civil fusion and other 
corporate governance policies and legal institutions, paired with its 
development of mature cyber espionage capabilities, present a 
significant risk that the PRC could alter the systems in or obtain and 
manipulate data about market participants who use connected vehicle 
ICTS designed, developed, manufactured, or supplied by persons owned 
by, controlled by, or subject to the jurisdiction or direction of the 
PRC.
2. Russia
    The Russian state has prioritized the growth of its automotive 
manufacturing industry, instituted a legal and regulatory framework to 
compel company data sharing with the state, and maintained a long 
history of malicious cyber operations against the United States. Under 
these circumstances, there is an increasing likelihood that Russia 
emerges as a supplier of connected vehicles technologies for the U.S. 
market, providing the Russian government a means of exploiting U.S. 
connected vehicles. Incorporating Russian hardware or software into the 
U.S. connected vehicle supply chain, therefore, poses undue and 
unacceptable risks to U.S persons and critical infrastructure.
    First, while Russia has historically been less active in the global 
automotive sector than the PRC, the Russian government has recently 
sought to revitalize its domestic auto manufacturing industry following 
the exodus of foreign automakers after the imposition of significant 
additional sanctions in 2022 in response to the conflict in Ukraine. In 
2024 alone, the Russian auto market is projected to experience a 15 
percent increase in passenger vehicle sales, marking a notable uptick 
since the Russian market crashed in 2022 following the imposition of 
sanctions, and some Russian auto manufacturers have continued 
introducing new models even amid broader economic headwinds. See 
Russia's 2024 car sales forecast raised to 1.45mln, units, AEB says, 
Reuters (July 3, 2024), https://www.reuters.com/business/autos-transportation/russias-2024-car-sales-forecast-raised-145-mln-units-aeb-says-2024-07-03. Russia's domestic auto sector has begun to show 
signs of resilience, with at least one automaker releasing a new, 
primarily domestically developed model since the imposition of Western 
sanctions, even as other domestically sold models are manufactured in 
the PRC but undergo final assembly in Russia. See Gleb Stolyarov and 
Alexander Marrow, Focus: Made in Russia? Chinese cars drive a revival 
of Russia's auto factories, Reuters (July 20, 2023), https://www.reuters.com/business/autos-transportation/made-russia-chinese-cars-drive-revival-russias-auto-factories-2023-07-20/. In Russia, the 
revitalization of the domestic economy, particularly the domestic auto 
sector, has become a key focus of the Russian government since the 
imposition of sanctions in recent years. The Russian government has 
released several plans that prioritize the development of its domestic 
automotive market with a particular focus on research and development 
of new technology, including autonomous vehicles and V2X (``Vehicle to 
Everything'') vehicle connectivity systems. See Russian Federation, 
Order of the Government of the Russian Federation of December 28, 2022 
No. 4261-r On Approval of the Strategy for the Development of the 
Automotive Industry of the Russian Federation until 2035 (Jan. 4, 
2023), https://www.garant.ru/products/ipo/prime/doc/405963861/#1000; 
Russian Federation, Order of the Government of the Russian Federation 
of August 23, 2021 No. 2290-r On Approval of the Concept for the 
Development of Electric Vehicle Production and the Transport Strategy 
of 2030 (2023), http://static.government.ru/media/files/bW9wGZ2rDs3BkeZHf7ZsaxnlbJzQbJJt.pdf. The development of these 
interlocking national transportation and automotive industry strategies 
involves stakeholders from domestic automakers, technology sectors, and 
the Russian government, illustrating a coordinated effort across the 
Russian state and its domestic automotive industry. In order to extend 
the reach of the state into the Russian auto industry, in February 
2024, Russia established a state-owned corporation named Rosavto that 
will act as liaison between government and industry.

[[Page 5369]]

Rosavto will develop production plans for vehicles and automotive spare 
parts, oversee the development of new models and technologies, and 
manage order distribution, legislative initiatives, and workforce 
training. See Eugene Gerden, New State Corporation to Oversee Russian 
Auto Industry, Wards Auto (Feb. 2024), https://www.wardsauto.com/regulatory/new-state-corporation-to-oversee-russian-auto-industry. 
Further, Russia has demonstrated resilience against Western sanction 
and export control regimes while also continuing to grow its electric 
vehicle market. See Carnegie Endowment, Why Russia Has Been So 
Resilient to Western Export Controls, (Mar. 2024), https://carnegieendowment.org/research/2024/03/why-russia-has-been-so-resilient-to-western-export-controls?lang=en. According to market 
reporting, the Russian electric vehicle market has had a robust 
performance, with double digit growth in output and sales, largely 
driven by a surge in the sector's exports. See Russia Automotive Market 
Report--Analysing EVE Trends and Car Sales Volume Data, Global Monitor 
(retrieved Nov. 2024), https://www.globalmonitor.us/product/russia-automotive-market. Projections suggested that with the support of the 
government, the electric vehicle subsector is poised for further 
growth. See id. Concerted efforts by the Russian government to develop 
the domestic Russian automotive industry, a growing electric vehicle 
market, and resilience to western sanction and export control regimes 
increase the likelihood that Russia-linked connected vehicle 
technology, such as VCS hardware or covered software, will enter the 
U.S. connected vehicle supply chain, which, as described below, 
presents an undue or unacceptable risk to U.S. national security. Given 
these factors, BIS is taking proactive measures to mitigate any risk 
posed by Russia's influence over the U.S. connected vehicle supply 
chain and to prevent Russia from gaining increasing influence over the 
U.S. connected vehicle supply chain in the future.
    Second, like the PRC, the Russian government employs a suite of 
laws that enable it to compel domestic companies with overseas 
operations to provide data gleaned through foreign ventures or to 
surrender similar operational assets to the Russian state. These laws 
(e.g., Russian Law Federal Security Service No. 40-FZ, ``Operational-
Investigative Activity'' No. 144-FZ, 2014 Amdt. to No. 97-FZ) allow the 
Russian government direct control over Russian corporations' activities 
and facilities, including data or customer information, and mandate 
that companies assist with counterintelligence actions as requested by 
the state, including the Federal Security Service of the Russian 
Federation (FSB). The FSB can, in some cases, mandate that companies 
allow the FSB to install equipment on their infrastructure or collect 
data. Firms that are required to facilitate this surveillance or 
intrusion activity can also be required to actively obfuscate such 
requests and must provide the state with any information essential to 
the decryption of any communications captured. Together, these laws 
enable the Russian state to collect and exploit sensitive data on or 
about U.S. persons via Russian businesses and, should Russian companies 
become more prominent in the connected vehicle supply chain, create a 
pathway through which the Russian government could secure wide-ranging 
access to the vast amounts of data collected and processed by connected 
vehicles in the United States. See internet Governance, Report of Peter 
B. Maggs, (Dec. 2017), https://www.internetgovernance.org/wp-content/uploads/12-7-Exhibit-AR-Part-6-Maggs-report.pdf. Public reports have 
consistently raised concerns about Russian government laws concerning 
data collection, citing a lack of appropriate safeguards to prevent 
misuse, including judicial or public oversight. More broadly, reports 
have repeatedly documented the uneven application of the rule of law, 
lack of judicial accountability, recurrent violations of judicial 
proceedings, and challenges with judicial independence. See Justin 
Sherman, Russia is weaponizing its data laws against foreign 
organizations, Brookings (Sept. 2022), https://www.brookings.edu/articles/russia-is-weaponizing-its-data-laws-against-foreign-organizations/; Evegeni Moyakine and A. Tabachnik, Struggling to strike 
the right balance between interests at stake: The `Yarovaya,' `Fake 
news,' and `Disrespect' laws as examples of ill-conceived legislation 
in the age of modern technology, Computer Law & Security Review, at 40 
(Apr. 2021), https://www.sciencedirect.com/science/article/pii/S0267364920301175.
    Third, apart from the risks presented by the Russian government 
access as codified in Russia's legal framework, the country has a 
longstanding pattern of utilizing cyber operations to gain illicit 
access to systems that advance the strategic ends of Russian 
authorities. For example, in December 2020, the company SolarWinds 
announced it was the target of a two-year-long cyber operation 
perpetrated by Russian hackers in the Russian Foreign Intelligence 
Services (SVR). See U.S. Securities and Exchange Commission, SEC 
Charges SolarWinds and Chief Information Security Officer with Fraud, 
Internal Control Failures, (Oct. 2023), https://www.sec.gov/newsroom/press-releases/2023-227. The perpetrators of the SolarWinds supply 
chain attack used a software update to deliver malware to the 
platform's users after Russian intelligence services obtained covert 
access to the computer systems on which the platform was installed. The 
attack ultimately impacted more than 18,000 users, including more than 
100 companies and nine U.S. Government agencies. This attack credibly 
demonstrates how Russian actors can infiltrate global enterprise 
systems via software updates and exemplifies how they could similarly 
leverage software as a means to exploit connected vehicles in the 
United States. Additionally, a 2023 Cyber Security Advisory suggests 
that exploitation of information technology firms and their software 
will be a persistent tactic leveraged by the Russian government to 
collect intelligence. See Joint Cyber Security Advisory, Russian 
Foreign Intelligence Service (SVR) Exploiting JetBrains TeamCity CVE 
Globally, at 3 (Dec. 2023), https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a. BIS has further identified 
Kaspersky Lab as an example of the risks imposed by Russia's ability to 
leverage software companies to allow Russia the ability to collect and 
weaponize the personal information of Americans. See Bureau of Industry 
and Security, Final Determination: Case No. ICTS-2021-002, Kaspersky 
Lab, Inc. (June 2024), https://www.federalregister.gov/documents/2024/06/24/2024-13532/final-determination-case-no-icts-2021-002-kaspersky-lab-inc.
    These political, legal, and regulatory frameworks, combined with 
the demonstrated capabilities of Russia to exploit ICTS supply chains 
through malicious cyber activity, exacerbate BIS's concern that the 
threats posed by Russia could be directed at the U.S. connected vehicle 
supply chain, including integral systems such as VCS and ADS. The 
persistent connectivity and software-driven capabilities of VCS and 
ADS, combined with the vast amounts of data that traverse these 
systems, make them valuable and likely targets for the Russian 
government to compromise.

[[Page 5370]]

c. Consequences

    Taken together, VCS and ADS designed, developed, manufactured, or 
supplied by persons under the ownership, control, jurisdiction, or 
direction of the PRC or Russia manifest undue and unacceptable risks to 
United States national security and to the safety and security of U.S. 
persons in several ways. If left unaddressed, the interaction of 
threats and vulnerabilities could result in the exfiltration of 
sensitive U.S. persons' data to foreign adversaries or the remote or 
automated manipulation of connected vehicles by the PRC and Russia, 
among other concerns.
    First, the integration of compromised VCS or ADS into a completed 
vehicle could undermine the reliability of a connected vehicle or its 
underlying control systems. Compromised components in VCS or ADS could 
result in increased frequency and severity of connected vehicle 
malfunctions that could, in turn, detrimentally impact U.S. national 
security, including the resiliency of U.S. critical infrastructure, or 
the safety of U.S. persons.
    Given the persistent connectivity of VCS and ADS and the essential 
functions that they serve in the operation of connected vehicles, these 
systems, if compromised and co-opted by an adversary, could serve as 
the nodes through which a foreign actor could probe or breach broader 
ICTS systems within the United States. Remote malicious cyber 
activities--which rely on network connectivity (e.g., Wi-Fi, Bluetooth, 
3/4/5G networks)--have increased significantly in recent years and 
consistently outnumber malicious cyber activities carried out through 
physical access to devices since at least 2010, accounting for 95 
percent of all malicious cyber activities in 2023. See Upstream, 
Upstream's 2024 Global Automotive Cybersecurity Report (2024), https://upstream.auto/reports/global-automotive-cybersecurity-report/. 
Considering the increasingly sophisticated methodologies employed by 
foreign adversaries to gain access to critical U.S. cyber 
infrastructure, compromised VCS and ADS, with their inherent 
connectivity, would easily present another attack surface for foreign 
adversaries to exploit. As detailed in the previous analysis of 
vulnerabilities inherent in VCS, adversaries with access to VCS, such 
as telematics systems, could inject malicious code into a vehicle's 
operational systems. Additionally, such malware could be developed in 
such a way as to exploit vehicle connectivity to propagate itself 
across multiple systems as the vehicle travels and connects to those 
discrete systems. In this way, not only would the ICTS integral to 
connected vehicles be compromised, but vehicle systems could be 
exploited to spread malware with the intent of harming all ICTS systems 
to which a vehicle connects. See Anastasios Giannaros, et al., 
Autonomous Vehicles: Sophisticated Attacks, Safety Issues, Challenges, 
Open Topics, Blockchain and Future Directions, Journal of Cybersecurity 
and Privacy 3.3, at 505 (2023).
    Second, as discussed, both VCS and ADS have significant control 
over and access to critical vehicle functions, including steering, 
braking, speed control, ignition, and almost all other mechanical 
functions of the vehicle. Such extensive control over vehicle 
operations could enable a foreign adversary to use a compromised VCS or 
ADS component to hamper vehicle functions or even to manipulate a 
connected vehicle for malicious purposes. As VCS and ADS control or 
link to integral vehicle functions, a foreign adversary could even 
exploit compromised VCS or ADS components to impair or disable a 
connected vehicle while in transit. Disabled, impaired, or otherwise 
improperly functioning vehicles could result in grave damage or 
impediment to critical infrastructure within the United States or could 
result in physical harm to U.S. persons. A disabled, impaired, or 
erratically functioning connected vehicle, or potentially multiple 
connected vehicles all experiencing problems simultaneously, could 
cause traffic patterns that would effectively block critical 
transportation arteries. This scenario could also cause collisions, 
ultimately damaging transportation features (e.g., roadways, bridges, 
tunnels), energy, telecommunications, and similar infrastructure 
situated near transportation systems. The potential consequences of 
widespread connected vehicle impairment could be particularly acute if 
the targets were fleet vehicles operating in support of infrastructure 
vital to transportation, energy, water, waste, telecommunications, and 
other essential services.
    The risks to the resiliency of critical U.S. infrastructure posed 
by connected vehicle components designed, developed, manufactured, or 
supplied by persons that are owned by, controlled by, or subject to the 
jurisdiction or direction of the PRC or Russia are further compounded 
by the potential for VCS and ADS to collect data on infrastructure. 
Advances in VCS and ADS necessitate increasingly cutting-edge sensor 
suites incorporating radar, LiDAR, camera, sonar, and computer vision 
to gather information on the surrounding environment for both onboard 
computing and remote cloud computing to process data in informing 
vehicle operating decisions. See Anastasios Giannaros, et al., 
Autonomous Vehicles: Sophisticated Attacks, Safety Issues, Challenges, 
Open Topics, Blockchain and Future Directions, Journal of Cybersecurity 
and Privacy 3.3, at 515 (2023); Luis Hernandez, et al., Applications of 
Cloud Computing in Intelligent Vehicles, Journal of Artificial 
Intelligence and Machine Learning in Management, at 12-13 (2022). This 
vast wealth of data, collected over time by multiple vehicles, likely 
contains valuable information such as location data about critical U.S. 
infrastructure. For example, data gathered from GPS or global 
navigation satellite systems (GNSS) in a connected vehicle could be 
cross-referenced and collated with a multitude of other data to produce 
information about the location, function, and operational trends of 
various transportation, energy, or other critical infrastructure. See 
Cybersecurity & Infrastructure Security Agency, Autonomous Ground 
Vehicle Security Guide: Transportation Sector, at 1 (2021), https://www.cisa.gov/sites/default/files/publications/Autonomous%2520Ground%2520Vehicles%2520Security%2520Guide.pdf; 
Cybersecurity & Infrastructure Security Agency, Cybersecurity and 
Physical Security Convergence, at 1 (2020), https://www.cisa.gov/sites/default/files/publications/Cybersecurity%2520and%2520Physical%2520Security%2520Convergence_508_01.05.2021.pdf. A foreign adversary could extract such critical 
infrastructure data using its control over designers, developers, 
manufacturers, or suppliers of VCS and ADS components subject to the 
foreign adversary's ownership, control, jurisdiction, or direction, 
thereby increasing the risk and precision of attacks on such critical 
infrastructure.
    Finally, given the volume of information collected by vehicles to 
support VCS and ADS operation, exploitation of these systems could 
enable an adversary to cull a tremendous amount of data on vehicle 
movement across the United States. This information could potentially 
include data generated on or from fleet vehicles used by emergency 
response, law enforcement, or the military. This data, and particularly 
all metadata and

[[Page 5371]]

derived data that can be drawn from the raw data, can provide 
considerable insight into fleet size, composition, and capabilities, as 
well as information on organizational response times and response 
procedures. Such information would prove valuable to an adversary 
seeking to disrupt U.S. emergency response operations. Any potential 
risks to U.S. national security arising from disrupting emergency 
response activities are further compounded by the potential for an 
adversary to exploit access to VCS and ADS to leverage the persistent 
connectivity required for malign operations, including exploits to 
trigger improper engine shutdown, brake activation, or electrical 
system deactivation. Any of these actions would have serious 
consequences for U.S. persons' health and safety. VCS and ADS, if 
corrupted by the producer at the direction of a foreign adversary, 
could improperly access driver mobile devices to collect, exfiltrate, 
and exploit personally identifiable information (PII) or even protected 
health information (PHI). It is also possible that a foreign adversary 
could use covert access to VCS and ADS to provide false or misleading 
operational information to a driver, causing degraded and dangerous 
vehicle operation conditions. Such tactics could be used either 
indiscriminately to sow panic and cause disruption, or to intentionally 
target specific drivers. Additionally, and as noted by the Office of 
the Director of National Intelligence in the 2024 National 
Counterintelligence Strategy, foreign adversaries, like the PRC and 
Russia, view this kind of PII and PHI as particularly valuable as it 
provides them ``not only economic and R&D benefits, but also useful 
[counterintelligence] information, as hostile intelligence services can 
use vulnerabilities gleaned from such data to target and blackmail 
individuals.'' See The Director of Nat'l Intelligence, 2024 National 
Counterintelligence Strategy (Aug. 2024), https://www.dni.gov/files/NCSC/documents/features/NCSC_CI_Strategy-pages-20240730.pdf.
    Even when such systems are not subject to compromise, companies 
owned by, controlled by, or subject to the jurisdiction or direction of 
a foreign adversary, if occupying certain positions within the supply 
chain, may potentially legally gain access to their users' personal 
data. For example, one prominent Chinese auto manufacturer with 
operations in the United States publicly states in its U.S. privacy 
policy that the personal data it may collect (e.g., identifiers, 
customer records information, internet or other electronic network 
activity information, geolocation information, professional or 
employment-related information) is only stored in the United States in 
principle, but goes on to note that personal data may be transferred to 
its headquarters in China for processing and storage. While the 
incorporation in the U.S. supply chain of VCS hardware and covered 
software designed, developed, manufactured, or supplied by persons 
owned by, controlled by, or subject to the jurisdiction or direction of 
the PRC or Russia poses one type of risk, transactions involving VCS 
hardware and covered software pose a separate risk when the connected 
vehicle manufacturer is, itself, owned by, controlled by, or subject to 
the jurisdiction or direction of the PRC or Russia, even when the 
connected vehicle manufacturer is located in the United States. 
Connected vehicle manufacturers have privileged and direct access to 
all systems in the vehicle, including the VCS hardware and covered 
software. Not only are VCS hardware and covered software built to the 
connected vehicle manufacturers' specifications but prior to the sale 
of a completed connected vehicle, connected vehicle manufacturers are 
able to exercise significant levels of control over that VCS hardware 
and covered software with little to no external oversight prior to the 
sale of the completed connected vehicle. Based on the foregoing, BIS 
assesses that ICTS transactions involving VCS hardware or covered 
software designed, developed, manufactured, or supplied by persons 
owned or controlled by, or subject to the jurisdiction or direction of 
the PRC or Russia--including transactions to supply the VCS hardware or 
covered software into the United States market as part of the sale of 
the completed connected vehicle--present undue or unacceptable risks to 
the national security of the United States within the meaning of E.O. 
13873.

V. Discussion of the Final Rule

    This final rule prohibits--absent a general or specific 
authorization otherwise--(1) VCS hardware importers from knowingly 
importing into the United States certain hardware for VCS (section 
791.302, ``Prohibited VCS hardware transactions''), (2) connected 
vehicle manufacturers from knowingly importing into the United States 
completed connected vehicles incorporating covered software, and (3) 
connected vehicle manufacturers from knowingly selling within the 
United States completed connected vehicles that incorporate covered 
software (section 791.303, ``Prohibited covered software 
transactions''). These prohibitions apply to transactions when such VCS 
hardware or covered software is designed, developed, manufactured, or 
supplied by persons owned by, controlled by, or subject to the 
jurisdiction or direction of the PRC or Russia. The rule also (4) 
prohibits connected vehicle manufacturers who are persons owned by, 
controlled by, or subject to the jurisdiction or direction of the PRC 
or Russia from knowingly selling in the United States completed 
connected vehicles that incorporate VCS hardware or covered software 
(section 791.304, ``Related prohibited transactions''), regardless of 
whether such VCS hardware or covered software is designed, developed, 
manufactured, or supplied by persons owned by, controlled by, or 
subject to the jurisdiction or direction of the PRC or Russia 
(collectively, ``prohibited transactions'').
    This rule primarily impacts market participants who could be 
considered VCS hardware importers or connected vehicle manufacturers, 
such as OEMs and importers of completed connected vehicles, as well as 
tier one and tier two suppliers of VCS hardware. For these entities, 
three compliance mechanisms--Declarations of Conformity, general 
authorizations, and specific authorizations--are available, depending 
on whether the VCS hardware importer or connected vehicle manufacturer 
wishes to engage in an otherwise prohibited transaction. Importantly, 
because VCS hardware importers and connected vehicle manufacturers 
frequently offer many different types of products, any one of the three 
mechanisms may not be available for their entire business. Rather, 
depending on the product, VCS hardware importers and connected vehicle 
manufacturers could be required to use a combination of these three 
mechanisms to meet their obligations under the rule.
    First, Declarations of Conformity are required to be submitted to 
BIS by VCS hardware importers and connected vehicle manufacturers prior 
to importing VCS hardware or importing or selling completed connected 
vehicles that incorporate covered software, certifying that the VCS 
hardware or covered software was not designed, developed, manufactured, 
or supplied by persons owned by, controlled by, or subject to the 
jurisdiction or direction of the PRC or Russia (section 791.305, 
``Declaration of Conformity''). The Declarations of Conformity require 
VCS hardware importers and connected vehicle manufacturers to certify 
to BIS, once a year or whenever material

[[Page 5372]]

changes occur, that they are not engaging in prohibited transactions 
and provide certain information on the import of VCS hardware and/or 
the import or sale of completed connected vehicles as relevant.
    Second, a general authorization could be available for VCS hardware 
importers and/or connected vehicle manufacturers seeking to engage in 
an otherwise prohibited transaction, depending on the circumstances 
(section 791.306, ``General authorizations''). General authorizations 
are available only in a narrow set of circumstances in which the 
conditions of the otherwise prohibited transaction appropriately 
mitigate the level of risk associated with the particular type of 
transaction. In determining whether to issue a general authorization, 
BIS may consider any information or material BIS deems relevant and 
appropriate, classified or unclassified, from any Federal department or 
agency, or from any other source. BIS will publish general 
authorizations issued pursuant to this subpart on its website (https://www.bis.gov/OICTS) and will also publish them in the Federal Register. 
Those availing themselves of a general authorization are required to 
continuously monitor their use of the VCS hardware or completed 
connected vehicles covered by the general authorization to ensure the 
authorization still applies. If a change renders the transaction 
ineligible for a general authorization, such as a change in the 
vehicle's use, the VCS hardware importer or connected vehicle 
manufacturer is required to apply for a specific authorization and 
cease engaging in such transaction unless and until a specific 
authorization is granted.
    Lastly, a specific authorization may be permitted for VCS hardware 
importers and connected vehicle manufacturers who wish to engage in a 
prohibited transaction, but do not otherwise qualify for a general 
authorization from BIS (section 791.307, ``Specific authorizations''). 
Such VCS hardware importers and connected vehicle manufacturers are 
required to pause engaging in these transactions before they may 
proceed with the prohibited transaction under a specific authorization. 
A specific authorization will only be available in circumstances where 
BIS determines, based on the information submitted by the applicant as 
well as any information or material BIS deems relevant and appropriate, 
classified or unclassified, from any Federal department or agency, or 
from any other source, that the otherwise prohibited transaction does 
not present an undue or unacceptable risk to U.S. national security. 
However, as a condition of approving the specific authorization, BIS 
might impose certain requirements and mitigation measures upon the VCS 
hardware importers and connected vehicles manufacturers seeking to 
proceed with the prohibited transaction.
    VCS hardware importers and connected vehicle manufacturers can 
appeal any of the following BIS decisions to the Under Secretary: the 
determination that a VCS hardware importer or connected vehicle 
manufacturer is ineligible for a general authorization, the denial of 
an application for a specific authorization, or the suspension or 
revocation of a previously granted specific authorization (section 
791.309, ``Appeals''). Further, the regulation establishes a method for 
VCS hardware importers and connected vehicle manufacturers to seek 
guidance on prospective transactions that may be prohibited through a 
BIS advisory opinion (section 791.310, ``Advisory opinions''). BIS may 
also share guidance on its website for VCS hardware importers or 
connected vehicle manufacturers that certain activities could 
constitute a prohibited transaction.
    In issuing this rule, BIS recognizes that Section 203(b) of IEEPA--
i.e., the ``Berman Amendment''--limits the scope of the authority to 
regulate or prohibit transactions relating to ``information'' or 
``informational materials.'' In relevant part, the Berman Amendment 
states that the ``authority granted to the President by this section 
does not include the authority to regulate or prohibit, directly or 
indirectly . . . . the importation from any country, or the exportation 
to any country, whether commercial or otherwise, regardless of format 
or medium of transmission, of any information or informational 
materials, including but not limited to, publications, films, posters, 
phonograph records, photographs, microfilms, microfiche, tapes, compact 
disks, CD ROMs, artworks, and newswire feeds.'' 50 U.S.C. 1702(b)(3). 
Consistent with the statute's text and purpose, as demonstrated by 
legislative history and context as well as judicial interpretations, 
BIS interprets the phrase ``information or informational materials'' to 
be limited to expressive material, consistent with the purpose of 50 
U.S.C. 1702(b)(3) to protect materials involving the free exchange of 
ideas from regulation under IEEPA and with IEEPA's broader purpose to 
limit material support to adversaries. A broader interpretation of the 
term would enable adversaries and countries of concern to use non-
expressive data to undermine our national security.
    In the NPRM, BIS explained this regulation is consistent with the 
Berman Amendment. BIS sought comment on this issue, including whether 
and how to address the term ``information or informational materials'' 
in the final rule. One commenter claimed that the prohibitions included 
in the rule could extend beyond IEEPA's intended purpose and result in 
litigation risk for BIS. Therefore, according to the commenter, BIS 
should clarify what types of information sharing will be allowed in 
light of the IEEPA limitations included in the Berman Amendment. One 
commenter requested clarification on what types of information sharing 
will be allowed under the rule, including documentation of technology 
designs. Another commenter asked about ``the information/materials--
including technology design documentation--that will be permitted or 
required when the Berman Amendment applies.'' In response, BIS notes 
that this rule does not add any restrictions on the sharing of 
technology designs, technical documentation, or similar information, 
nor does it remove any restrictions that may exist under any other 
regulation (e.g., export controls). Additionally, while this rule 
requires regulated parties to maintain documentation relevant to their 
compliance with this rule, it does not prescribe any specific 
requirements as to what that documentation must consist of. BIS did not 
receive any comments requesting that specific provisions relating to 
information or informational materials be added to the rule.
    This final rule is consistent with the Berman Amendment. Its 
purpose is to regulate transactions involving certain hardware and 
software based on functional capabilities that can be exploited by 
foreign adversaries, not to restrict the import or export of expressive 
speech and communicative works and mediums that may be carrying such 
expressive content. As discussed in Section IV, VCS hardware and 
covered software process and transmit data such as geolocation 
information or systems diagnostics reports, which are used to monitor 
and control the vehicle's safe operation, and that a foreign adversary 
could manipulate in ways that could impair or disable the vehicle's 
function, leading to dangerous outcomes that pose a harm to U.S. 
national security. Similarly, the functional data collected by covered 
software--such as high-definition mapping data of infrastructure and

[[Page 5373]]

roadways--would pose serious risks to that critical infrastructure if 
collected and exploited by a foreign adversary. This final rule 
``balances IEEPA's competing purposes'' in ``restricting material 
support for hostile regimes while encouraging the robust interchange of 
information.'' United States v. Amirnazmi, 645 F.3d 564, 587 (3d Cir. 
2011). Thus, BIS has determined that the prohibitions in this rule are 
consistent with the Berman Amendment. To the extent that any parties 
believe that a transaction governed by this rule qualifies as 
``information or informational materials'' that is exempt under 50 
U.S.C. 1702(b)(3), they can seek clarification using the administrative 
processes for seeking an advisory opinion.

VI. Revisions From the Proposed Rule and Response to Comments

    Each section of the final rule is discussed below, including BIS's 
consideration of comments received in response to the NPRM.

a. Definitions

    BIS received a variety of comments regarding the definitions listed 
in the NPRM. In the following sections, BIS summarizes and responds to 
those comments, outlines the definitions for this final rule, and for 
some definitions, provides additional interpretation to assist readers 
in understanding the final definition (see section 791.301, 
``Definitions''). BIS notes that multiple commenters requested BIS 
include definitions for terms that are already defined within 15 CFR 
791.1, such as U.S. person. In response, BIS emphasizes that 
definitions contained in 15 CFR 791.1 apply to this subpart, except 
where the same term is defined differently in this rule.
1. Automated Driving System
    In the NPRM, BIS proposed Automated Driving System (ADS) to mean 
hardware and software that, collectively, are capable of performing the 
entire dynamic driving task for a completed connected vehicle on a 
sustained basis, regardless of whether it is limited to a specific ODD. 
After considering commenters' feedback, BIS has chosen to retain this 
definition in the final rule.
    Many commenters requested clarity on the definition of ADS, 
particularly urging BIS to explicitly reference SAE International's 
J3016 standard in the definition. Commenters also recommended that BIS 
explicitly exclude Levels 1 and 2 of the SAE J3016 standard or plainly 
state that the regulation does not capture ADAS in the definition. 
Similarly, BIS received feedback to incorporate language that excludes 
hardware and software that are not capable of performing the entire 
dynamic driving task and to provide examples of these exclusions, such 
as steering, braking, acceleration, and speed.
    BIS declines to include a reference to the current version of SAE 
J3016 at this time and believes that the current definition adequately 
covers only those systems that would fall into SAE categorization Level 
3 and above. However, this does not preclude BIS from amending this 
rule in the future to make explicit reference to the current version 
(April 2021) or any future version of J3016. BIS emphasizes that in 
enforcing this rule, it will only consider Automated Driving Systems 
that meet the full definition of this rule to be in scope, and BIS 
believes that the details regarding the specifics of Levels 3, 4, and 5 
systems contained within J3016 are useful guidance for connected 
vehicle manufacturers to determine if their products fall within scope. 
Following the effective date of this rule, entities that seek 
clarification if a specific piece of software is subject to the 
prohibitions of this rule may submit a request for an advisory opinion 
from BIS. Further, in response to commenters requesting that BIS 
explicitly state that ADAS is out of scope, BIS believes this to be 
unnecessary as the definition aligns with SAE J3016, which 
differentiates between ADAS and ADS.
    Comments contained various positions on the specific exclusion or 
inclusion of LiDAR and other sensing systems within the prohibitions. 
Several commenters advised BIS to identify examples of specific 
components that are outside the scope of the prohibitions, such as 
radar and camera technology. Others advocated for the inclusion of ADS 
sensor technology in the prohibitions and explained that BIS should 
explicitly scope the prohibitions to include cameras, radar, LiDAR, 
Time of Flight internal sensors, ultrasonic sensors, and microphones. 
Commenters pointed out that LiDAR is proliferating across critical 
infrastructure industries and heavily sourced by foreign adversaries, 
further urging that LiDAR, in particular, should fall in scope of the 
prohibitions, including LiDAR hardware, software for sensor control, 
and perception software.
    BIS maintains its position from the NPRM that this rulemaking will 
address only ADS software and not the multiple hardware systems that 
support or directly enable ADS operation. BIS agrees that proliferation 
of LiDAR and other sensing technologies from entities with a foreign 
adversary nexus throughout multiple critical infrastructure sectors may 
pose a threat to national security. However, within the limited scope 
of the automotive sector, and with this initial rulemaking, BIS 
assesses that a prohibition that focuses specifically on transactions 
that provide ADS software is appropriate at this time to mitigate the 
national security risks that they present while limiting the supply 
chain and economic impact. As stated in the NPRM, BIS is proposing to 
regulate ADS software rather than the hardware components of ADAS and 
ADS so as to reduce unnecessary economic impacts and supply disruption. 
The hardware that enables ADAS and ADS varies widely between different 
OEMs. ADAS and ADS hardware encompasses a wide variety of different 
sensors, distributed electronic control units (ECUs), centralized 
computing units, actuators, and signaling units, among others. These 
sensors and internal vehicle networking hardware rarely have 
independent connectivity. A rule that coherently and feasibly addresses 
these varied supply chains would have disproportionate economic and 
supply chain impacts relative to the reduction of national security 
risks. Further, focusing on the ADS software supply chain appropriately 
mitigates the national security risks that they present while limiting 
the supply chain and economic impact. Commenters should also refer to 
the discussion below on covered software for greater detail on BIS's 
decision to omit LiDAR from this rule. BIS's decision not to focus on 
sensing technologies in this rule does not preclude BIS from addressing 
them in a subsequent rulemaking.
    Commenters recommended providing definitions for terms within the 
ADS definition, such as ``operational design domain.'' BIS declines to 
specify a definition for operational design domain as it believes this 
to be an industry standard term in the autonomous vehicle sector that 
refers to operating conditions under which an ADS or feature thereof is 
specifically designed to function. Additionally, BIS hopes to provide 
industry with additional flexibility to interpret these terms within 
the contexts of their own technologies, reducing the compliance burden 
of the rule. However, BIS emphasizes that the related definitions in 
J3016 are useful guidance for industry and interested entities.
    One commenter also advised removing ``for a completed connected 
vehicle'' from the definition of ADS and adding an ``ADS-equipped 
vehicle'' to

[[Page 5374]]

the definition to avoid industry confusion because not all connected 
vehicles will have ADS. BIS maintains that the ADS-related prohibitions 
of the rule affect only completed connected vehicles that are equipped 
with ADS by the nature of how the covered software prohibition is 
crafted, and therefore narrowing the definition of ADS to remove ``for 
a completed connected vehicle'' is not necessary.
    Commenters noted that the ADS definition includes hardware, while 
the prohibited transactions do not include ADS hardware. The ADS 
definition captures the whole of ADS, including hardware, while the 
regulation prohibits only ADS software and does not prohibit ADS 
hardware. Commenters advised removing ``hardware'' from the definition 
of ADS or providing language that clarifies that the definition of ADS 
generally describes what an ADS is, but not necessarily what aspects of 
the system are regulated by this rule. After consideration, BIS 
declines this suggestion. In the interest of maintaining a harmonized 
definition that is consistent with other Federal regulations and with 
industry standards such as NHTSA's Second Amended Standing General 
Order 2021-01 and SAE J3016, BIS maintains that inclusion of 
``hardware'' in the definition of ADS is appropriate, even though this 
does not mean that the hardware of an ADS system is regulated. The 
structure of the covered software definition and the covered software 
prohibitions are the only instances of a use of the ADS definition and 
make clear that ADS hardware is not prohibited when designed, 
developed, manufactured, or supplied by entities owned by, controlled 
by, or subject to the jurisdiction or direction of the PRC.
    One commenter requested that BIS clarify that ADS software that 
carries out only a single function, such as parking, be excluded from 
the definition of ADS. While BIS generally believes that systems that 
are not capable of executing the entire dynamic driving task (as 
required by the definition of ADS) are not covered by this regulation, 
BIS declines to amend the definition in this rule as such a 
determination would be highly fact specific. BIS emphasizes that 
persons seeking greater clarity may, upon the effective date of this 
rule, seek an advisory opinion from BIS regarding a specific 
transaction involving ADS software.
2. Completed Connected Vehicle
    In the NPRM, BIS proposed to define completed connected vehicle as 
follows: ``a connected vehicle that requires no further manufacturing 
operations to perform its intended function. For the purposes of this 
subpart, the integration of an ADS into a connected vehicle constitutes 
a manufacturing operation for a completed connected vehicle.'' BIS 
chose to retain this definition of completed connected vehicle in the 
final rule based on comments, further research, and other changes to 
the regulation.
    Some commenters, particularly from the commercial vehicle sector, 
argued that the proposed rule did not provide a clear definition of 
completed vehicle within the context of the commercial market. As 
discussed in the following section addressing the definition of 
connected vehicle, BIS recognizes the substantial compliance concerns 
associated with the complex commercial vehicle sector and has 
determined that the commercial vehicle sector will not be covered by 
this rulemaking. Recognizing there are substantial national security 
concerns in the commercial vehicle market, BIS intends to issue a new 
proposed rule specifically tailored to this sector.
    One commenter urged BIS to substitute a new definition for ``ADS-
equipped connected vehicle'' instead of ``completed connected vehicle'' 
in order to avoid implying that all connected vehicles contain ADS 
software. BIS recognizes that not all connected vehicles are ADS-
equipped. However, BIS declines this suggestion because the 
prohibitions resulting from the regulation pertain to completed 
connected vehicles, as defined by the regulation, and BIS does not want 
to engender confusion or suggest that the prohibitions pertain only to 
products equipped with ADS. Therefore, BIS chooses not to integrate 
this recommendation into the final rule.
3. Connected Vehicle
    In the NPRM, BIS proposed connected vehicle to mean a vehicle 
driven or drawn by mechanical power and manufactured primarily for use 
on public streets, roads, and highways, that integrates onboard 
networked hardware with automotive software systems to communicate via 
dedicated short-range communication, cellular telecommunications 
connectivity, satellite communication, or other wireless spectrum 
connectivity with any other network or device. Vehicles operated only 
on a rail line are not included in this definition. BIS modified its 
definition in the final rule based on comments from the public.
    A few commenters requested clarifications or refinements for BIS's 
definition of a ``connected vehicle.'' Some commenters highlighted that 
other regulatory bodies, such as National Highway Traffic Safety 
Administration (NHTSA) and the Environmental Protection Agency (EPA), 
often implement separate rulemaking efforts for light/passenger 
vehicles and heavy/commercial vehicles. BIS has opted to exclude 
commercial vehicles from the final rule. As discussed elsewhere, BIS 
emphasizes that the national security risks associated with PRC or 
Russian VCS and ADS in commercial vehicles are grave, and BIS's 
decision to exclude commercial vehicles from this rulemaking in no way 
implies that these risks are lesser than in the passenger vehicle 
market. Rather, BIS intends to propose a separate regulation tailored 
to the commercial sector in the coming months.
    Specifically, BIS has amended the definition of ``connected 
vehicle,'' for the purposes of this rule, to exclude vehicles with a 
gross vehicle weight rating (GVWR) of over 10,000 pounds, which 
generally aligns with the weight delineation included in definitions 
used by other government agencies (including the Federal Motor Carrier 
Safety Administration) and by industry to delineate between passenger 
and commercial vehicles.
    One commenter also requested that BIS clarify that recreational 
vehicles (RVs) are not included in the definition of a ``connected 
vehicle.'' BIS declines to amend the definition as it believes RVs will 
largely be excluded from the regulation. First, as amended, RVs 
weighing over 10,000 pounds will not be captured by this rule and will 
instead be subject to an intended future rule covering commercial 
vehicles. Second, as the commenter noted, BIS intends to issue a 
general authorization pertaining to vehicles used on public roads for 
fewer than 30 days a year, which could capture additional RVs that 
weigh under 10,001 pounds, if manufacturers are able to verify their 
RVs are eligible. Manufacturers availing themselves of any future 
general authorization need not notify BIS of its use nor apply for the 
authorization, contrary to the comment's suggestion. In the future, BIS 
may consider whether a general authorization that specifically 
addresses RVs would be appropriate.
    One commenter requested that BIS explicitly exclude agricultural 
equipment, construction equipment, and mining equipment from the 
definition of ``connected vehicle.'' BIS does not believe this 
modification necessary as it believes the existing definition of 
``connected vehicle,'' which mandates that the vehicle must be 
manufactured ``primarily for use on

[[Page 5375]]

public streets, roads, and highways,'' and under 10,001 pounds, 
sufficiently excludes these vehicles from the provisions of the rule. 
Another commenter urged BIS to clarify that the rule does not apply to 
entities importing VCS hardware intended for integration into vehicles 
that are not covered by this rule. BIS believes that modifications to 
the definition of VCS and VCS hardware address this comment.
    Commenters urged BIS to amend the definition of ``connected 
vehicle'' to clarify that Personal Delivery Devices (PDDs) and bicycles 
are not captured by the rule. BIS does not believe this modification is 
necessary as it does not believe PDDs nor bicycles meet the definition 
of a connected vehicle. PDDs and bicycles primarily operate in 
shoulders of roads, bike lanes, and sidewalks, which BIS does not 
believe meets the definition of ``manufactured primarily for use on 
public streets, roads, and highways.'' The exclusion of these devices 
from this regulation is further in line with Federal and State-level 
interpretations that have also excluded PDDs from the definition of 
motor vehicle and related policies.
    Commenters asked that BIS clarify whether a ``connected vehicle'' 
includes a motorcycle. One commenter offered the definition of 
motorcycle from 40 CFR 205.151: ``[A]ny motor vehicle, other than a 
tractor, that: (i) [h]as two or three wheels; (ii) [h]as a curb mass 
less than or equal to 680 kg (1499 lb); and (iii) [i]s capable, with an 
80 kg (176 lb) driver, of achieving a maximum speed of at least 24 km/h 
(15 mph) over a level paved surface.'' BIS understands and acknowledges 
that this definition of motorcycle fits into its definition of 
``connected vehicle'' in this rule, meaning that motorcycles are 
subject to this regulation, and BIS believes that an additional 
definition is unnecessary to improve ease of administration of this 
rule. Further, BIS notes that vehicles such as electric scooters and e-
bicycles are not ``manufactured primarily for use on public streets, 
roads, and highways,'' given that in most jurisdictions such vehicles 
cannot be ridden legally on public highways and many roads. Therefore, 
BIS assesses that the definitions provided are scoped appropriately.
    One commenter asked BIS to clarify that the regulation does not 
apply to VCS hardware importers and connected vehicle manufacturers 
that import covered hardware intended for assembly into vehicles that 
are not covered by the definition of connected vehicle. In response, 
BIS confirms that transactions involving covered software and VCS 
hardware that are not integrated into a connected vehicle are not 
subject to this regulation. VCS hardware importers and connected 
vehicle manufacturers executing covered software and VCS hardware 
transactions that are intended to be incorporated into a connected 
vehicle, as defined in the final rule, are subject to this regulation.
    BIS has chosen to define ``connected vehicle'' to mean a vehicle 
driven or drawn by mechanical power and manufactured primarily for use 
on public streets, roads, and highways, that integrates onboard 
networked hardware with automotive software systems to communicate via 
dedicated short-range communication, cellular telecommunications 
connectivity, satellite communication, or other wireless spectrum 
connectivity with any other network or device. Vehicles operated only 
on a rail line are not included in this definition. For the purposes of 
this subpart, a connected vehicle with a gross vehicle weight rating of 
more than 4,536 kilograms or 10,000 pounds is not included in this 
definition.
    The primary change from the definition in the proposed rule is the 
inclusion of a weight constraint. This final rule has been narrowed to 
address vehicles under 10,001 pounds (which largely apply to the 
passenger vehicle market). BIS intends to supplement this rulemaking 
with an additional rule to address vehicles over 10,000 pounds (which 
largely applies to the commercial vehicle market), given the national 
security risks.
4. Connected Vehicle Manufacturer
    In the NPRM, BIS proposed ``connected vehicle manufacturer'' to 
mean a U.S. person (1) manufacturing or assembling completed connected 
vehicles in the United States; and/or (2) importing completed connected 
vehicles for sale in the United States. Based on feedback from 
commenters, BIS has amended its definition of ``connected vehicle 
manufacturer'' in the final rule.
    Commenters advised BIS to be more specific about who is responsible 
for reporting to BIS under this regulation. Commenters recommended that 
BIS clarify that contracting with another party to manufacture or 
assemble a completed connected vehicle that integrates one's own ADS or 
VCS for one's own business is out of scope of the regulation. BIS 
declines to do so. Through modifications to the connected vehicle 
manufacturer definition, BIS specifies that a person whose sole 
manufacturing or assembly operation is integrating ADS into an 
otherwise completed connected vehicle would qualify such a person as 
being a ``connected vehicle manufacturer.'' BIS also included changes 
to the definition of sale to ensure that these contracting operations 
are within scope of the regulation. As discussed further below relating 
to the modifications to the definition of sale, BIS has determined that 
contracting operations could, but may not necessarily, be a sale under 
the terms of this rule.
    Commenters encouraged BIS to consider whether a person owned by, 
controlled by, or subject to the jurisdiction or direction of the PRC 
or Russia, whose sole manufacturing or assembly operation is 
integrating ADS into an otherwise completed connected vehicle, should 
be subject to the prohibitions in the rule and need to obtain a 
specific authorization before importing or selling that completed 
connected vehicle in the United States. BIS determined that such 
integration of ADS software into a completed connected vehicle by a 
person owned by, controlled by, or subject to the jurisdiction or 
direction of the PRC or Russia is an extension of the national security 
risk relating to covered software and intended to be restricted. In 
response, BIS clarifies that ADS integration into an otherwise 
completed connected vehicle is subject to this regulation and has 
updated the definition of connected vehicle manufacturer in the final 
rule to reflect this.
    Commenters also encouraged BIS to make third-party manufacturers or 
assemblers operating on behalf of a U.S. entity, regardless of the 
origin of the ADS or VCS, exempt from this regulation. BIS rejects this 
request and has updated the regulation to clarify that third-party 
manufacturers who are persons owned by, controlled by, or subject to 
the jurisdiction or direction of the PRC or Russia are subject to this 
rule. Third-party manufacturers are an integral aspect to a connected 
vehicle manufacturer's overall manufacturing operations; therefore, if 
such third parties were persons owned by, controlled by, or subject to 
the jurisdiction or direction of the PRC or Russia, this would continue 
to perpetuate the national security risks that this rule is seeking to 
address.
    In the final rule, BIS has chosen to define a connected vehicle 
manufacturer to mean a U.S. person who:
    (1) Manufactures or assembles completed connected vehicles in the 
United States for sale in the United States;
    (2) Imports connected vehicles for sale in the United States; and/
or

[[Page 5376]]

    (3) Integrates ADS software on a completed connected vehicle for 
sale in the United States.
    A connected vehicle manufacturer may also be a VCS hardware 
importer, as defined herein, if VCS hardware has already been installed 
in a connected vehicle when the connected vehicle manufacturer imports 
it.
    This modified definition clarifies BIS's intention to capture 
entities who purchase otherwise completed (and compliant) connected 
vehicles from a third party and then integrate their proprietary ADS on 
the vehicle to enable autonomous driving. For example, a U.S. person 
who purchases completed connected vehicles from a U.S. connected 
vehicle manufacturer (even if those vehicles do not contain PRC or 
Russian VCS hardware or ADS software) and then integrates its own ADS 
software on the vehicles would be performing a manufacturing operation 
and would be explicitly captured as a connected vehicle manufacturer 
under this amended definition. If that U.S. person is an entity owned 
by, controlled by, or subject to the jurisdiction or direction of the 
PRC or Russia, it would require a specific authorization to sell those 
vehicles in the United States, which includes transferring those 
vehicles for commercial operations. The modified definition also 
clarifies that the first paragraph of the definition, which relates to 
persons who manufacture or assemble completed connected vehicles in the 
United States, applies only if the vehicles are intended for sale in 
the United States (not for export and sale abroad).
5. Covered Software
    In the NPRM, BIS proposed to define covered software as ``the 
software-based components, in which there is a foreign interest, 
executed by the primary processing unit of the respective systems that 
are part of an item that supports the function of Vehicle Connectivity 
Systems or Automated Driving Systems at the vehicle level. Covered 
software does not include firmware, which is characterized as software 
specifically programmed for a hardware device with a primary purpose of 
controlling, configuring, and communicating with that hardware device. 
Covered software also does not include open-source software that can be 
freely used, modified, and distributed by anyone, with both access to 
the source code and the ability to contribute to the software's 
development and improvement unless that open-source software has been 
modified for proprietary purposes and not redistributed or shared.'' 
Based on comments, BIS changed its definition of covered software to 
better align with industry practices.
    Commenters commonly sought more guidance on the layers of software 
regulated under the rule. Commenters requested examples regarding how 
covered software applies to the software stack for VCS and ADS. Common 
feedback urged BIS to define software-based components that fall in and 
out of scope of the regulation, such as application, firmware, 
middleware, and system software. Commenters also encouraged BIS to 
provide a definition of these layers of software, particularly 
emphasizing that a definition was needed for firmware. Commenters 
advocated for the exclusion of embedded software (e.g., middleware and 
system software) because the application software more directly 
facilitates external communications, and the embedded software is not 
divisible or distinguishable from hardware. Commenters also suggested 
that regulating embedded software would introduce more complex supply 
chain bottlenecks and prevent many companies from meeting the covered 
software prohibition within a year's time.
    In response to these comments, BIS has added specificity to the 
covered software definition to explicitly include application, 
middleware, and system software, while continuing to exclude firmware. 
BIS has also included a description of firmware. BIS declined to 
generally exclude embedded software from the definition, because doing 
so would exclude certain software that could pose a national security 
risk. Rather, BIS has chosen to classify software along 
``application,'' ``system,'' ``middleware,'' and ``firmware'' 
categories. To determine whether particular embedded software is 
excluded from the definition, parties should consider whether the 
embedded software leverages specific code executed by the primary 
processing unit or units of the system. This requirement may exclude 
embedded software systems that are executed on ancillary surface 
modules or processors, depending on the specific architecture of the 
VCS.
    Two commenters recommended that BIS limit covered software to only 
the application layer. BIS rejects this feedback. BIS intends covered 
software to include application software, operating system software and 
a library of established functions which are generally referred to as 
``middleware.'' BIS chose to include operating system and middleware 
function software in the definition of ``covered software'' because if 
either the operating system or middleware functions are compromised, 
the resulting application would not execute securely. So long as the 
software in question is application, operating system, or middleware 
executed by the primary processing unit of the subject system, it would 
likely be covered software unless otherwise excluded.
    One commenter requested that BIS define the term ``primary 
processing unit'' in the ``covered software'' definition. BIS declines 
to incorporate an explicit definition in the regulatory text because a 
definition is unnecessary; unlike other specialized terms defined in 
the final rule, ``primary processing unit'' is a generally widely 
understood term. To provide additional interpretive guidance on the 
term, BIS intends the term ``primary processing unit'' to encompass the 
central or graphics computing unit of a system responsible for running 
both the application(s) and the associated operating system that 
directly enable VCS or ADS on the vehicle. Commenters supported the 
exclusion of open-source software from the rule and requested BIS align 
the definition of open-source software with the definitions from the 
National Defense Authorization Act (NDAA) of 2019, CISA 2023 Open-
Software Security Roadmap, and the Open Source Initiative. Commenters 
also wanted BIS to clarify if open-source software modified by Russian 
or Chinese entities falls under scope of the regulation. BIS accepts 
the recommendation of multiple commenters to align the definition of 
open-source software with that of the 2019 NDAA. Further, BIS added 
certain clarifying clauses to the 2019 NDAA definition to address 
advances in artificial intelligence and the evolution of the use of the 
term ``open-source'' in artificial intelligence applications by 
including ``in its entirety'' to the definition. However, BIS declines 
to limit the open-source software exclusion by the geographical 
location of specific administrators or contributors to open-source 
projects or libraries. BIS is not well placed to arbitrate the validity 
of individual open-source contributors and rather relies on the 
inherent structure and transparency of open-source software to identify 
potential security compromises by malicious actors. BIS excludes open-
source software from covered software and characterizes it as software 
for which the human-readable source code is available in its entirety 
for use, study, re-use, modification, enhancement, and redistribution 
by the users of such software unless that open-source

[[Page 5377]]

software has been modified for proprietary purposes and not 
redistributed or shared.
    In addition to BIS being more specific about the definition of 
covered software, commenters requested that BIS explicitly scope out 
different software components. Some commenters recommended modifying 
the definition to cover only component software of ADS and VCS. These 
commenters argued that tying the covered software to the hardware helps 
narrow the scope and removes the ambiguity of the term ``item that 
supports,'' which they argued was ambiguous because it is generally 
understood as part of a system. To this end, commenters advised BIS to 
define ``covered software'' as ``software, in which there is a foreign 
interest, executed by the primary processing unit of the Vehicle 
Connectivity System or Automated Driving System item that directly 
enables the Vehicle Connectivity System or Automated Driving System 
function,'' or similarly. Commenters argued that marrying the 
definitions of VCS and ADS to the definition of covered software 
provides clarity to connected vehicle developers and other automotive 
industry actors while retaining BIS's stated goal of targeting ``two 
integral ICTS systems,'' of VCS and ADS, and no other vehicle equipment 
or technologies. Commenters also said this change removes the language 
``an item that support the function of VCS,'' which is confusing to 
industry.
    In response to these comments, BIS clarified the definitions of 
``covered software'' and ``VCS hardware'' to include items that 
``directly enable'' the function of those systems as opposed to 
``supports'' those systems. BIS defined the term ``item'' in conformity 
with SAE International's 21434 ``Road Vehicles--Cybersecurity 
Engineering'' standard of September 2021, as a term that would be 
commonly understood by industry. The SAE 21434 standard promotes the 
delineation of item definitions for different automotive systems and 
for assessing the cybersecurity of those systems. BIS therefore 
considered the SAE 21434 terms and practices in drafting its 
definitions so that connected vehicle manufacturers can consult 
existing compliance mechanisms to determine the item definition of 
different systems and assess what is included within the item 
definition of a VCS. BIS also retained ``covered software'' and ``VCS 
hardware'' as separate terms and separate prohibitions due to other 
structural and legal considerations.
    Commenters also wanted to better understand the granularity of the 
ADS software prohibition, seeking clarity as to whether final software 
is considered ``designed'' or ``developed'' by a person owned by, 
controlled by, or subject to the jurisdiction or direction of the PRC 
when a software module from the PRC is part of the larger ADS suite. If 
only one software subcomponent of an ADS software suite is designed, 
developed, manufactured, or supplied by a PRC or Russian entity, then 
the entire ADS software suite would be considered designed, developed, 
manufactured, or supplied by a foreign adversary entity. BIS modified 
the covered software definition to make clear that it applies to 
software components of application, middleware, and system software. 
BIS acknowledges the burden of determining the provenance of software 
subcomponents for legacy code bases and therefore added an exclusion 
for code that was designed, developed, manufactured, or supplied before 
one year from the effective date of the rule.
    One commenter requested clarity about VCS software architecture, 
specifically regarding whether the regulation's scope includes upstream 
communication transfer, downstream communications transfer, and 
communications processing. This commenter thought that upstream 
communications were within scope of the proposed rule, while the 
downstream communication transfer and communication processing were out 
of scope. Some commenters requested specific opinions about specific 
automotive in-vehicle network architectures. Because of the variety and 
diversity of automotive network designs, BIS sought to provide 
definitions that could be applied across the industry and declines to 
specifically opine on specific architectures. However, BIS intends to 
work with industry to answer specific questions during the 
implementation of the rule and through the issuance of advisory 
opinions.
    Commenters commonly sought clarity on the degree and type of remedy 
necessary for the software to no longer be deemed covered software and 
therefore not subject to the prohibitions and compliance requirements 
in this rule. To this end, commenters recommended that BIS consider 
integrating accepted international regulatory standards to drive its 
guidance. For example, commenters suggested that BIS adopt the ISO/SAE 
21434 Road Vehicles--Cybersecurity Engineering Threat Analysis and Risk 
Assessment (TARA) to assess the cybersecurity risks in automotive 
products. Commenters flagged that this standard provides a methodology 
for the software developer to identify critical assets and privacy 
concerns and allows for the greatest specificity to address the 
critical asset(s), such as the specific lines of source code or module 
at issue, rather than broadly including all software packages. BIS 
appreciates this recommendation and acknowledges that it previously 
considered such a framework. BIS ultimately declines to consider 
compliance with SAE 21434 as a standalone security control sufficient 
for mitigating the national security risks identified in this rule. BIS 
determined that a combination of security controls could successfully 
mitigate the national security risk relating to connected vehicles and 
intends to use a multi-layered approach when issuing a specific 
authorization. BIS anticipates that requiring security features 
controls such as conformity with cybersecurity standards, audits 
conducted by third parties or BIS, enhanced reporting requirements, and 
controls on corporate governance may be effective ways to manage risk. 
However, BIS will consider compliance with cybersecurity standards like 
SAE 21434, R155, and NHTSA Cybersecurity Best Practices when evaluating 
applications for specific authorizations.
    Many commenters requested that BIS exclude legacy code from the 
definition to minimize supply chain disruption and ensure warranties 
can be fulfilled. BIS acknowledges comments regarding the mature code 
bases that have been built, audited, and refined over time and the 
significant burden that determining the specific developers that 
contributed to those libraries over time would create. Based on the 
comments, BIS incorporated a specific exclusion within the covered 
software definition for legacy code. This addition to the covered 
software definition will exclude all source code that is designed, 
developed, manufactured, or supplied before a date that is one year 
from the effective date of the rule. This ``legacy'' code exclusion 
will protect products that have already gone to market. Furthermore, 
excluding legacy code designed, developed, manufactured, or supplied 
prior to March 17, 2026 will provide regulated entities time to 
transfer intellectual property rights as well as responsibility for 
development and maintenance of code to within their organizations in 
order to come into compliance with the covered software prohibition. 
BIS believes that this appropriately balances addressing the national 
security risks posed by software that is actively maintained in the PRC 
and Russia while lowering

[[Page 5378]]

potential burdens and disruptions to the market.
    Commenters also warned that the regulation does not clearly 
articulate if ADS added to a completed connected vehicle falls in scope 
of the prohibition. Commenters advised limiting the scope of the 
regulation by adding language at the end of the covered software 
definition to ensure that the addition of ADS software that itself is 
not designed, developed, manufactured, or supplied by PRC or Russian 
entities to a connected vehicle is not a manufacturing operation for 
the purposes of this rule. BIS declines to adopt this recommendation. 
BIS explicitly included the sentence, ``For the purposes of this 
subpart, the integration of an Automated Driving System into a 
connected vehicle constitutes a manufacturing operation for a completed 
connected vehicle,'' to make clear that the addition of ADS to a 
completed connected vehicle falls within scope of this rule as it is a 
manufacturing operation for a completed connected vehicle. If the 
addition of covered ADS software to a completed connected vehicle 
involves software in which there is no foreign interest, then the 
integrating entity would not be required to submit a Declaration of 
Conformity. However, if there is a foreign interest in that covered 
software transaction, then it would require a Declaration of 
Conformity, or in the case the software is covered by the prohibitions 
of this rule, a specific authorization. BIS assesses that the addition 
of covered ADS software to a completed connected vehicle by an 
aftermarket vendor poses the same national security threat as the 
addition of covered ADS software at the initial point of manufacture. 
BIS believes such a modification or integration of ADS software could 
introduce the same underlying risk that the connected vehicle can be 
manipulated, to include unauthorized access to vehicle data.
    Commenters also inquired if electronic logging devices (ELDs), 
insurance-related vehicle tracking devices, and after-market safety 
technologies are in the scope of covered software. BIS recommends that 
commenters review the technical specifications of these devices against 
the updated definition of covered software to confirm if they are 
executed by the primary processing unit or units of an item that 
directly enables the function of VCS or ADS at the vehicle level to 
determine if said devices fall within the scope of the definition of 
covered software. BIS believes the definitions for covered software and 
VCS hardware should provide clarity; however, a person may submit a 
request for an advisory opinion regarding transactions involving 
specific technologies, along with technical information related to 
these technologies, so BIS may provide an opinion specific to the 
technology presented. BIS understands ``after-market safety 
technologies'' to be broad and can encompass a range of varying 
technologies. Such technologies would likely be covered as they relate 
to ADS software directly; however, uses outside of this scope would 
likely require BIS to receive additional information within a request 
for an advisory opinion. While the use of these technologies in the 
commercial vehicle market is out of scope of this regulation, under 
certain circumstances these technologies may be subject to this 
regulation (e.g., if they are used in vehicles weighing less than 
10,001 pounds).
    Commenters wanted BIS to define ``integrated or attached hardware 
or software'' to clarify whether software or hardware attached by a 
Bluetooth device or USB to a vehicle would be subject to the rule, or 
if the rule includes only integrated technologies. Per its definitions, 
this final rule is not limited to integrated technologies.
    Commenters advised BIS to reconsider the zero percent threshold for 
software containing code from prohibited foreign entities, such as a de 
minimis threshold. BIS chose to not adopt a de minimis threshold 
approach due to the risk of circumvention that it would create. For 
example, entities could add additional code to make their percentage of 
prohibited content appear to fall below the minimum threshold. This 
suggestion would not adequately mitigate the risks identified. 
Additionally, seeking to create an implementable de minimis standard of 
code, wherein code could be analyzed by various metrics such as per 
bit, per line, per execution command, per library, etc., would be 
extremely complex, and the associated difficulty of assessing whether 
content is de minimis or not would be inefficient and ineffective. 
Furthermore, BIS added a significant exclusion in the ``covered 
software'' definition by excluding all code that had been designed, 
developed, or supplied prior one year from the effective date of this 
rule. This legacy code exclusion, paired with the infeasibility and 
ineffectiveness of a de minimis threshold led BIS to reject this 
suggestion.
    A commenter urged BIS to require companies to implement 
cybersecurity requirements for edge cloud architecture and to establish 
domestic or allied sourcing requirements for ADS cloud infrastructure, 
as well as continuous monitoring of ADS cloud and edge systems. BIS 
addresses its considerations for cybersecurity requirements in its 
discussion of Declarations of Conformity, as well as other places in 
this text. Cloud architecture and infrastructure are out of scope of 
this current regulation. However, BIS understands the concern and may 
consider this area for future rulemaking.
    Commenters recommend that BIS consider narrowing the covered 
software definition, or the annual reporting requirement, to exclude 
covered software produced by companies based in trusted or allied 
nations. Commenters suggest that this change would both streamline 
connected vehicle manufacturers' reporting obligations and reduce the 
burden on BIS in reviewing vast quantities of submitted information and 
allow BIS to focus its resources and efforts on overseeing the use of 
software-based components in completed connected vehicles that may 
present actual or heightened risks to U.S. security. One commenter was 
particularly concerned that not narrowing the foreign interest scope 
meant that all technology must be sourced from a U.S. vendor, limiting 
global supply chains to using only U.S. software. BIS addresses these 
concerns in its discussion of Declarations of Conformity more in depth. 
At a high level and as explained in more depth below, BIS will not 
exclude non-foreign adversary nations from the scope of covered 
software, because BIS assesses that it is necessary to address the 
threats posed by interconnected but opaque supply chains writ large, as 
opposed to finished products imported from non-foreign adversary 
nations.
    Commenters urged BIS to establish a process that would allow an OEM 
to fully own software purchased from a prohibited supplier so that the 
purchased software would not be considered prohibited. BIS is willing 
to discuss such an approach through an advisory opinion request to 
determine whether such a software purchase may adequately mitigate the 
identified risk if the transaction is not otherwise excluded by the 
modified definition of covered software.
    In this final rule, BIS has chosen to define covered software to 
mean the software-based components, including application, middleware, 
and system software, in which there is a foreign interest, executed by 
the primary processing unit or units of an item that directly enables 
the function of VCS or ADS at the vehicle level. Covered software does 
not include firmware,

[[Page 5379]]

which is characterized as software specifically programmed for a 
hardware device with a primary purpose of directly controlling, 
configuring, and communicating with that hardware device. Covered 
software also does not include open-source software, which is 
characterized as software for which the human-readable source code is 
available in its entirety for use, study, re-use, modification, 
enhancement, and redistribution by the users of such software, unless 
that open-source software has been modified for proprietary purposes 
and not redistributed or shared. Covered software also does not include 
software subcomponents that were designed, developed, manufactured, or 
supplied prior to March 17, 2026, as long as those software 
subcomponents are not maintained, augmented, or otherwise altered by an 
entity owned by, controlled by, or subject to the jurisdiction or 
direction of a foreign adversary after March 17, 2026.
    With this definition of covered software, BIS focused on both the 
functional characteristics of the software that it intends to regulate 
as well as the common industry terminology used to refer to that 
software. For example, BIS acknowledges that there is not a bright line 
between application-level software, middleware (e.g., device drivers, 
database management functions), and firmware. However, by combining 
both industry terminology and a functional definition in its definition 
of covered software, BIS seeks to provide two levels of clarity. In 
making a reasonable, good faith determination of whether a software 
subcomponent falls within the covered software definition, entities 
should refer to the architecture of the product to assess whether the 
software component would be generally considered ``application'' level 
software based on industry practice using established methodologies 
like AUTOSAR software component definitions or ISO 26262 guidelines. 
When there is uncertainty, entities should consider whether the primary 
processor (e.g., a central processing unit, a graphics processing unit) 
processes the executables, or whether the software is executed by a 
peripheral microcontroller. If the primary processor does not execute 
the software, and the software would not be classified as application 
software by an industry standard like AUTOSAR, it is unlikely the 
software would qualify as application software for the purpose of this 
definition.
    BIS has also provided examples to clarify what constitutes 
application, middleware, and systems software below. If regulated 
parties have questions about what constitutes covered software in 
specific cases, they may request an advisory opinion.
    Example 1: A U.S. person licenses automotive software from a vendor 
who is a foreign person that is owned by, controlled by, or subject to 
the jurisdiction or direction of the PRC or Russia. The automotive 
software the U.S. person licenses includes a message processing 
application that receives a digital message from a peripheral radio 
device, processes that message, and uses the information within that 
message to issue a digital control command to a related electronic 
control unit. This software would be considered application software. 
Because the licensed software includes application software designed, 
developed, manufactured, or supplied by an entity owned by, controlled 
by or subject to the jurisdiction of a foreign adversary, the licensed 
software would be prohibited, unless it qualifies for a general or 
specific authorization granted by BIS.
    Example 2: A U.S. person licenses automotive software from a vendor 
who is a foreign person that is owned by, controlled by, or subject to 
the jurisdiction or direction of the PRC or Russia. The automotive 
software the U.S. person licenses includes a software device driver 
intended for use in the operating system for applications to activate 
and utilize specific VCS hardware. This driver would be considered 
middleware. Because the licensed software includes middleware designed, 
developed, manufactured, or supplied by an entity owned by, controlled 
by or subject to the jurisdiction of a foreign adversary, the licensed 
software would be prohibited, unless it qualifies for a general or 
specific authorization granted by BIS.
    Example 3: A U.S. person licenses automotive software from a vendor 
who is a foreign person that is owned by, controlled by, or subject to 
the jurisdiction or direction of the PRC or Russia. The automotive 
software the U.S. person licenses includes a software component in the 
operating system that coordinates communications between distributed 
applications and between applications and an internal reference 
database. This software component would be considered middleware. 
Because the licensed software includes middleware designed, developed, 
manufactured, or supplied by an entity owned by, controlled by or 
subject to the jurisdiction of a foreign adversary, the licensed 
software would be prohibited, unless it qualifies for a general or 
specific authorization granted by BIS.
    Example 4: A U.S. person licenses automotive system software from a 
vendor who is a foreign person that is owned by, controlled by, or 
subject to the jurisdiction or direction of the PRC or Russia. The 
automotive system software the U.S. person licenses is a proprietary 
real time operating system that manages system resources as well as 
task scheduling, prioritization, and synchronization for an automotive 
system. This software component would be operating system software. 
Because the licensed software includes operating system software 
designed, developed, manufactured, or supplied by an entity owned by, 
controlled by or subject to the jurisdiction of a foreign adversary, 
the licensed software would be prohibited, unless it qualifies for a 
general or specific authorization granted by BIS.
    Example 5: A U.S. person purchases a V850 CAN controller from a 
vendor who is a foreign person. The V850 CAN controller includes a 
software subcomponent that is embedded into the controller's non-
volatile memory and directly enables the transmission and receipt of 
analog electric signals by interacting with the VCS hardware system's 
application software. This software component would be considered 
firmware. Assuming no other facts, this purchase does not involve 
covered software and would not be affected by the covered software 
prohibition (but may be affected by the VCS hardware prohibition, 
depending on other facts and circumstances of the transaction).
    BIS determined that it was necessary to exclude firmware because 
firmware is often shipped with and designed in coordination with the 
provision of automotive hardware subcomponents. Therefore, while there 
are similar national security and cybersecurity risks at the firmware 
level, BIS determined that a firmware prohibition would be tantamount 
to a hardware prohibition. Finally, BIS made slight modifications to 
the open-source software definition from the 2019 National Defense 
Authorization Act when crafting the ``covered software'' definition. 
These minor modifications are to make clear that large language models 
or neural networks that may bill themselves as ``open source'' but do 
not openly share their source code or training data in their entirety 
do not meet the commonly held definition of open-source software. 
Furthermore, the clause appended to the end of the definition is 
redundant but meant to emphasize that if an open-source product is 
modified outside the

[[Page 5380]]

limits of the open-source license and not shared, the resulting product 
is definitionally not open source. However, modification would not 
include integration into an existing code base by engaging with an 
open-source product's application programming interface, permissible 
customization within the terms of the open-source license, or selection 
of modular sections of the open-source product while excluding others.
    In light of comments the agency received, BIS emphasizes that 
regulated entities are not absolved of conducting due diligence on 
open-source software when that open-source software has been modified 
outside the scope of its license. Additionally, BIS declines to 
introduce a static list of approved or excluded open-source software 
libraries and tools into the text of the rule, as these libraries and 
tools are dynamic by nature. BIS will maintain and update compliance 
information on its website and will also be available to work with 
regulated entities through advisory opinions or compliance education 
and outreach programs.
    BIS included the term ``item'' within its definition of covered 
software because industry standards define ``item'' as a scoping 
boundary when analyzing specific automotive systems for cybersecurity 
and functional safety requirements to ensure that assessments are 
targeted and comprehensive. For example, ISO 21434's threat analysis 
and risk assessment methodology for assessing cybersecurity relies on 
``item definition'' boundaries. Entities seeking additional guidance on 
the term ``item'' in this context may find it helpful to refer to its 
use in ISO 21434 and ISO 26262, and its use by automotive cybersecurity 
and safety professionals when making a reasonable determination whether 
a component is part of a covered software system item. Comments about 
this term are further explained in the ``item'' subsection of this 
Definitions section. BIS has incorporated specific language to ensure 
that legacy parts are not subject to the covered software prohibitions 
of this regulation. This ``legacy'' code exclusion in covered software 
protects products that have already gone to market. By incorporating a 
one-year timeline, BIS allows regulated entities time to transfer 
intellectual property rights as well as responsibility for development 
and maintenance of code within their organizations to come into 
compliance with the covered software prohibition.
6. Declarant
    In this final rule, BIS includes a new definition for ``declarant'' 
to mean the U.S. person submitting a Declaration of Conformity to BIS. 
BIS has included ``declarant'' in the final rule text to provide more 
clarity in the regulation since the term is used throughout.
7. FCC ID Number
    In the NPRM, BIS proposed defining the term ``FCC ID Number'' to 
mean the unique alphanumeric code identifying a product subject to 
certification by the Federal Communications Commission composed of a: 
(1) grantee code; and (2) product code. Commenters provided no feedback 
about this particular definition. BIS retains its definition in the 
final rule.
    While commenters did not provide feedback on the definition of 
``FCC ID Number,'' they provided input in how the regulation 
incorporates them. Commenters pointed out that not all VCS hardware 
items have FCC Numbers. Taking this point into consideration, BIS will 
only require an FCC ID Number if known by the submitting party. This 
change is reflected in 791.305 of the regulation text, which discusses 
Declarations of Conformity.
8. Foreign Interest
    In the NPRM, BIS proposed to define ``foreign interest'' to mean 
any interest in property of any nature whatsoever, whether direct or 
indirect, by a non-U.S. person. Many commenters encouraged BIS to 
narrow its definition of foreign interest or otherwise provide greater 
clarity. After consideration of these comments, BIS retains this 
definition of foreign interest in the final rule.
    Several commenters, for example, requested that BIS clarify this 
definition to mean a legally cognizable interest in property. BIS 
declines to limit this definition to a legally cognizable interest 
because ``legally cognizable'' may be overly narrow for purposes of 
this regulation. Moreover, BIS's approach retains consistency with 
other IEEPA-based programs, which similarly use a broad definition of 
``foreign interest.'' Some commenters suggested that requiring a 
legally cognizable interest would address the scenario in which the 
only foreign interest in software is the fact that foreign persons 
worked on the development of the software. In response, BIS notes that 
a foreign interest must be an interest in property, and the sole fact a 
foreign individual worked on a software development team would not meet 
this requirement unless additional factors (such as ongoing financial 
or beneficial interests or contractual rights) are present.
    Multiple commenters encouraged BIS to carve out allied persons from 
the definition of foreign interest, defined as citizens of, residents 
of, or corporations incorporated in nations in ``Country Group A'' of 
BIS's own Export Administration Regulations. BIS declines to amend the 
definition of foreign interest to exclude certain allied nations or to 
grant preferential status for entities in allied nations as this would 
inadequately mitigate the national security risk this rule seeks to 
address. The mere fact that a connected vehicle manufacturer is 
headquartered in, incorporated in, or otherwise organized under the 
laws of a non-foreign adversary country does not imply that the 
manufacturer has appropriate practices in place to address the risks 
identified by this rule. For example, a connected vehicle manufacturer 
located in a non-foreign adversary country may actually be controlled 
by a PRC or Russian entity, or the manufacturer sources design and 
development of its ADS software or VCS hardware from an entity located 
in or controlled by the PRC or Russia. However, the fact that a 
transaction has a foreign interest does not mean that the transaction 
is prohibited. Rather, the presence of a non-PRC and non-Russian 
foreign interest in a transaction without the requisite foreign 
adversary nexus would require the connected vehicle manufacturer or VCS 
hardware importer to submit a declaration of conformity, a requirement 
that BIS has substantially streamlined in this rule to facilitate 
compliance and reduce the burden on regulated entities. BIS is 
separately working to identify if any security standards or best 
practices exist, or may be developed, that will sufficiently mitigate 
this national security risk and allow companies, wherever located, to 
engage in transactions without need to notify BIS through a Declaration 
of Conformity.
    One commenter also urged BIS to ensure that software developed in 
the PRC or Russia by wholly owned subsidiaries of U.S. companies would 
not be considered to contain a foreign interest. BIS declines to create 
an exemption for software developed by wholly owned subsidiaries of 
U.S. businesses from the definition of foreign interest. As articulated 
in this rule, entities operating in the PRC or Russia are subject to 
the jurisdiction and control of the PRC or Russian governments, even if 
wholly owned by a U.S. or allied entity. These types of entities, 
despite their ownership, are

[[Page 5381]]

subject to the regulations and laws of the PRC or Russia that could 
obligate them to comply with information or access requests resulting 
in undue or unacceptable risks, as discussed in Section IV of this 
rule.
    One commenter stated that BIS's broad definition of foreign 
interest would mean that a publicly traded company with some foreign 
shareholders would be required to submit a Declaration of Conformity 
even if the company's covered software itself contained no foreign 
interest. In response to this comment, BIS has introduced an exemption 
for the submission of Declarations of Conformity for those transactions 
where the only foreign interest in the product arises from a foreign 
entity's equity ownership in a U.S. person. This exemption is narrowly 
tailored intentionally to minimize the compliance burden. BIS continues 
to understand equity ownership to be a form of foreign interest. 
However, BIS recognizes that attaching a static percentage foreign 
interest threshold would be particularly challenging for regulated 
entities and their compliance teams in practice. For example, 
shareholders change daily, and while there are some reporting 
requirements for principal shareholders according to Regulation D of 
the Securities Exchange Act of 1934, setting a percentage threshold 
based on equity ownership alone would mean there could be no reporting 
obligations for a transaction one day and foreign interest that 
required a Declaration of Conformity. To avoid this outcome, BIS 
clarifies through this exemption that Declarations of Conformity are 
not required for transactions where the only foreign interest arises 
from foreign equity ownership of one of the U.S.-based parties to a 
transaction. If the foreign equity ownership is paired with another 
foreign interest (e.g., degree of control over the U.S. entity or 
licensing of intellectual property), a Declaration of Conformity would 
be required. To provide further clarity regarding transactions 
involving foreign interest as a result of public shareholder ownership, 
BIS offers the following examples.
    Example 6: Company A develops VCS. Company A is incorporated in the 
United States and is publicly traded on the New York Stock Exchange. No 
foreign entity owns more than 5% of Company A's common stock. Assuming 
no other facts, because no foreign entity shareholder of Company A's 
common stock can materially affect Company A's operations and corporate 
management, there is not a foreign interest in Company A's VCS. As 
such, the sale of completed connected vehicles incorporating Company 
A's VCS does not require a Declaration of Conformity.
    Example 7: Same facts as previous example, except Company A is 
headquartered in a foreign jurisdiction. The import of completed 
connected vehicles incorporating Company A's VCS software from a 
foreign jurisdiction would require a Declaration of Conformity because 
the import gives rise to a foreign interest independent of equity 
ownership.
    Example 8: Company A develops VCS software, is incorporated in the 
United States, and is publicly traded on the NASDAQ Stock Exchange. 
Company A states that one of its shareholders is a foreign person 
holding 60% of Company A's outstanding shares and is not a person owned 
by, controlled by, or subject to the jurisdiction or direction of a 
foreign adversary. Assuming no other facts, because a foreign entity is 
a shareholder whose holding is such that the foreign entity can 
materially affect Company A's operations and corporate management, 
there is a foreign interest in Company A's VCS software other than 
equity ownership. As such, the sale of completed connected vehicles 
incorporating VCS software developed by Company A requires submission 
of a Declaration of Conformity.
    Example 9: Company A is incorporated in the United States and is 
publicly traded on a U.S. stock exchange. In aggregate, foreign 
shareholders hold 28 percent of Company A's outstanding shares. These 
shareholders have an informal agreement to act in concert with respect 
to voting decisions for Company A. The collective 28 percent would 
allow such foreign shareholders to block resolutions and important 
decisions regarding Company A's management. The foreign shareholders 
have an interest in Company A's VCS software independent of their 
equity ownership by virtue of their control over the company. As such, 
the sale of completed connected vehicles incorporating VCS software 
developed by Company A requires submission of a Declaration of 
Conformity.
    Example 10: Company A, a U.S. person completed connected vehicle 
manufacturer, purchases ADS software from Company B. Company B is a 
U.S. person publicly traded company that designs, develops, and 
manufactures its ADS software solely in the United States. A foreign 
entity holds 15% of Company B's outstanding public shares. The foreign 
investor has no board seat and exerts no management or control over 
Company B. Assuming no other facts, Company A is exempt from the 
requirement to file a Declaration of Conformity.
    Another commenter requested that BIS clarify that foreign IP 
claims, which may not be recognized under U.S. law, do not constitute a 
foreign interest. BIS declines to insert language that would require an 
extensive inquiry into the legal status of IP claims in multiple 
jurisdictions in order to determine whether a foreign interest is 
present. BIS notes that there may be situations, such as where a 
foreign IP claim is frivolous, in which the foreign IP claim would not 
constitute a valid interest. The commenter suggests revising the 
definition of foreign interest to add that it does not include ``legal 
claims or other allegations, or rights that might be afforded by law 
even when all other rights have been assigned to another party, such as 
employee-inventor remuneration obligations and moral rights in works of 
authorship.'' BIS believes that many such claims would fall outside of 
the scope of foreign interest. For example, rights that cannot legally 
be transferred might not meet the definition of ``property.'' BIS does 
not believe it necessary to amend the definition to specify this point 
or to provide an exhaustive list of claims that are not included under 
the definition of foreign interest. If regulated parties have a 
question about whether a foreign IP interest constitutes a foreign 
interest in specific cases, they may request an advisory opinion from 
BIS.
    Multiple commenters also requested that BIS amend the provisions on 
the import of VCS hardware to clarify that a Declaration of Conformity 
is required only when the VCS hardware itself contains a foreign 
interest. Others suggested that BIS remove the foreign interest 
requirement from the definition of covered software. BIS declines to 
make these changes. As discussed in the NPRM, IEEPA requires a foreign 
interest in the property that BIS seeks to regulate. BIS has included a 
foreign interest requirement in the definition of covered software 
because some prohibited covered software transactions are sales that 
occur within the United States. By requiring a foreign interest in the 
definition of covered software, BIS ensures that this rule only 
captures those sales covered by IEEPA. By contrast, this rule prohibits 
imports (not sales within the United States) of VCS hardware. BIS 
assesses that items crossing into the United States from a foreign 
jurisdiction will necessarily contain a foreign interest by nature of 
the transaction, and therefore does not find it necessary to include a 
foreign interest requirement in the definition.

[[Page 5382]]

Additionally, the final rule does not require a Declaration of 
Conformity to be submitted if the only foreign interest related to 
covered software resides in open-source or legacy code.
    After considering all comments, BIS has retained the definition of 
foreign interest, when used with respect to property, to mean any 
interest in property, of any nature whatsoever, whether direct or 
indirect, by a non-U.S. person. Under this definition, a foreign 
interest can include, but is not limited to, an interest through 
ownership of the item itself, intellectual property present in the 
item, a contractual right to use, update, or otherwise impact the 
property, (e.g., ongoing maintenance commitments, any license agreement 
related to the use of intellectual property), profit-sharing or fee 
arrangement linked to the property, as well as any other cognizable 
interest. This definition is consistent with the definition of 
``interest'' used in the context of OFAC sanctions, which are, in 
relevant part, also established pursuant to the statutory requirements 
of IEEPA. See 31 CFR Chapter V, and, e.g., 31 CFR 510.313, 535.312.
    With respect to VCS hardware that is designed, developed, 
manufactured, or supplied by a person owned by, controlled by, or 
subject to the jurisdiction or direction of the PRC or Russia, this 
rule regulates the importation of VCS hardware, making VCS hardware 
importers responsible for compliance.
    With respect to covered software, based on feedback from connected 
vehicle manufacturers, automotive suppliers, and other stakeholders, 
BIS continues to understand that typically, ADS and VCS software are 
designed or developed to a connected vehicle manufacturer's 
specification. ADS and VCS software is frequently designed, developed, 
or supplied by foreign persons, and those persons frequently retain an 
interest in the underlying software, even after it has been integrated 
into the connected vehicle. For example, foreign software developers 
may earn profits from use of their software, retain data access and 
sharing rights to the software, have obligations to maintain and update 
the software, or participate in other ongoing contractual arrangements. 
Such arrangements are among the types of interests that BIS identifies 
as giving rise to an obligation to submit a Declaration of Conformity 
or, if the software designer, developer, or supplier is a person owned 
by, controlled by, or subject to the jurisdiction or direction of a 
foreign adversary, an obligation to qualify for a general authorization 
or seek a specific authorization under this final rule. BIS therefore 
will regulate covered software by regulating the importation or sale of 
completed connected vehicles, making connected vehicle manufacturers 
responsible for compliance.
    Finally, in addition to the general regulations related to VCS 
hardware and covered software described above, with respect to 
connected vehicle manufacturers who are owned by, controlled by, or 
subject to the jurisdiction or direction of the PRC or Russia, this 
rule additionally regulates VCS hardware and covered software by 
regulating the sale of completed connected vehicles that incorporate 
VCS hardware or covered software. In this circumstance, BIS understands 
from extensive engagement with connected vehicle manufacturers and 
automotive suppliers that persons who own, control, or direct the 
operations of the connected vehicle manufacturer would maintain an 
interest in the vehicle transactions that the connected vehicle 
manufacturer carries out. For example, this could include, but is not 
limited to, profit sharing agreements between a parent company and its 
U.S. subsidiary; data sharing agreements; intellectual property rights 
transfers from the U.S. subsidiary to the parent company; cooperation 
in technological development between the parent and U.S. subsidiary; 
arrangements by which the parent company directly or indirectly 
appoints the leadership of the U.S. subsidiary; the ability of the 
parent company to direct some or all corporate decision making by the 
U.S. subsidiary; and parent company influence over procurement by the 
U.S. subsidiary. BIS understands many if not all of these arrangements 
to be standard for the automotive industry. Additionally, because the 
PRC and Russian legal regimes discussed in Section IV of this rule 
could compel a PRC or Russia-based parent company of a connected 
vehicle manufacturer to provide those governments with information on 
or access to the operations of the U.S.-based connected vehicle 
manufacturer, BIS understands that the foreign parent company typically 
retains a legal right to access the data collected by the U.S. 
subsidiary, representing a foreign interest in that U.S. subsidiary and 
its connected vehicle sales.
    BIS provides the following examples to assist in interpreting 
whether a foreign interest is present.
    Example 11: Company A is headquartered in a foreign jurisdiction 
and is the owner of the code, algorithms, and other design elements in 
a software development kit (SDK) that is used to develop software used 
in certain payment systems. Company A provides its SDK to Company B, a 
U.S. person, who uses it to develop software that is installed in 
connected vehicles in the United States to provide secure communication 
and payment with transportation infrastructure. Even though Company A 
has no legal property interest in the software itself, it has an 
indirect beneficial interest in the use of such software because 
updates to the software will need to be made using Company A's SDK. 
Thus, the software Company B develops with Company A's SDK retains a 
continuing foreign interest.
    Example 12: Company A is a wholly owned U.S.-based subsidiary of 
Company B, a multinational holding corporation incorporated in the 
British Virgin Islands. Company A imports products for sale in the 
United States, which generate revenue. Based on Company B's corporate 
structure and governance of its subsidiary holding companies including 
Company A, Company B dictates how Company A's revenue and profits are 
allocated across Company B's holdings. Because Company B, a foreign 
person, benefits from each of Company A's domestic transactions and 
because Company B directs the allocation of revenue generated by those 
transactions, there is a foreign interest in Company A's domestic 
United States transactions.
    Example 13: Company A is a U.S. based connected vehicle 
manufacturer. Company B is a parts manufacturer headquartered in a 
foreign jurisdiction. Company B manufactures systems on chip (SoC) 
based on customer specifications that are specifically used in VCS. 
Company A and Company B have entered into a multi-year agreement 
whereby, among other conditions, Company B will be the exclusive 
supplier, with rights of first refusal, for replacements and any 
maintenance and services repairs of SoCs to Company A for the term of 
the agreement. Because Company B is a foreign entity and because 
Company A may use no other parts supplier for its VCS SoCs during the 
term of the agreement, the SoCs that Company B provides to Company A 
under the agreement retain a continuing foreign interest once those 
SoCs enter the United States.
    Example 14: Company A is a U.S. based connected vehicle 
manufacturer. Company B is a U.S. subsidiary of a foreign software 
company, Company C. Company B sells ADS software licenses on behalf of 
its foreign parent Company C, who holds the intellectual property 
rights to the software. Company B

[[Page 5383]]

licenses Company C's ADS software to Company A for system integration 
and further commercialization within the limits of its licensing 
agreement. Company C, a foreign entity, will have a continued interest 
in Company A's use of its software after commercialization.
9. Hardware Bill of Materials
    In the NPRM, BIS defined Hardware Bill of Materials (HBOM) to mean 
a comprehensive list of parts, assemblies, documents, drawings, and 
components required to create a physical product, including information 
identifying the manufacturer, related firmware, technical information, 
and descriptive information. Public comment provided feedback that led 
BIS to change the final rule definition of HBOM. Commenters provided a 
variety of opinions on the HBOM requirements of this regulation. 
Several commenters expressed opposition to the inclusion of HBOMs in 
Declaration of Conformity submissions on the grounds that they contain 
highly confidential business information and intellectual property, 
citing security issues related to storage and transmission. Several 
commenters noted that the HBOM requirement is overly broad and 
suggested that they only include ``electronic components that execute 
software.'' Several commenters recommended that BIS provide a 
``specific'' resource as an example of an HBOM, such as the HBOM 
Framework for Supply Chain Risk Management. Commenters also suggested 
that BIS remove references to documents and drawings within the HBOM 
definition to exclude protected intellectual property from compliance 
submissions. Other commenters requested that BIS provide an HBOM sample 
model.
    After considering the issues raised in these comments, BIS will no 
longer require the submission of HBOMs as part of Declarations of 
Conformity. However, BIS will require entities to maintain primary 
business records related to their certification that due diligence was 
conducted in analyzing their VCS hardware supply chains, which could 
include HBOMs. These primary business records must be made available to 
BIS upon request. BIS has also included a section in the rule dedicated 
to the submission of CBI, which would cover the submission of HBOMs. 
BIS will continue to work with industry partners to identify best 
practices in HBOM development, including templates and advisory 
documents.
    To better align HBOM criteria with industry practices, BIS has 
modified its definition of HBOM. Specifically, BIS has removed 
documents, drawings, technical information, and descriptive information 
from the HBOM definition because these elements do not strictly fall 
under the scope of a bill of materials. This change also addresses 
industry concerns about the potential exposure of intellectual property 
and CBI. Additionally, BIS has replaced the term ``comprehensive list'' 
with ``formal record'' since ``record'' is a more general term and 
``comprehensive'' is difficult to define precisely.
    BIS has chosen to define ``Hardware Bill of Materials (HBOM)'' as a 
formal record of the supply chain relationships of parts, assemblies, 
and components required to create a physical product, including 
information identifying the manufacturer, and related firmware.
10. Import
    In the NPRM, BIS proposed to define the term ``import'' to mean, 
with respect to any article, the entry of such article into the United 
States Customs Territory. It does not include admission of an article 
from outside the United States into a foreign-trade zone for storage 
pending further assembly in the foreign-trade zone or shipment to a 
foreign country. BIS did not receive comment on its definition of 
``import'' or how the term is used in the regulation text. Therefore, 
BIS retains the NPRM definition of ``import'' in the final rule. For 
clarity, BIS has added a sentence clarifying that the same definition 
applies to related terms such as ``importing'' and ``imported.''
    While BIS did not receive any comment on the proposed meaning of 
``import,'' one commenter requested that BIS clarify that for the 
purposes of the regulation, ``article'' means VCS hardware and covered 
software as defined in this regulation. BIS is confirming for the 
purposes of this rule that ``article'' is referring to VCS hardware and 
covered software.
11. Item
    In the NPRM, BIS proposed to define ``item'' to mean a component or 
set of components with a specific function at the vehicle level. A 
system may also be considered an item if it implements a function. BIS 
received a few comments on how this term is used within its regulation 
text but based on further research chooses to retain this definition of 
``item'' for the final rule. Some commenters urged BIS to replace the 
term item with ``system,'' both in the context of VCS hardware and 
covered software to clarify that the terms refer to overall systems. 
BIS declines this suggestion and maintains the use of the term item. 
This term is used both in ISO 26262 and ISO/SAE 21434 to delineate 
system boundaries. BIS further believes the use of the term item in 
both covered software and VCS will allow regulated entities to 
harmonize compliance with this rule with existing cybersecurity and 
functional security work as dictated by ISO/SAE 21434 and ISO 26262.
12. Knowingly
    In the NPRM, BIS proposed to define ``knowingly'' to mean ``having 
knowledge of a circumstance (the term may be a variant, such as `know,' 
`reason to know,' or `reason to believe'), to include not only positive 
knowledge that the circumstance exists or is substantially certain to 
occur, but also an awareness of a high probability of its existence or 
future occurrence. Such awareness is inferred from evidence of the 
conscious disregard of facts known to a person and is also inferred 
from a person's willful avoidance of facts.'' BIS received no comments 
requesting changes to this definition and retains this definition for 
the final rule.
    BIS did receive some public comments relating to due diligence and 
Declaration of Conformity requirements, which are relevant to the 
context in which the definition of ``knowingly'' would be applied. 
Commenters suggested that BIS consider implementing a whitelist of 
vendors that do not require additional due diligence. According to 
commenters, a whitelist would provide more clarity on the compliance 
requirement for regulated entities. One commenter also stated that a 
whitelist would preclude the need for Declarations of Conformity. BIS 
declines to create a whitelist at this time. Due to the complexity of 
connected vehicle supply chains and the multitude of factors involved 
in each unique transaction undertaken by manufacturers, BIS believes 
the creation of a whitelist would insufficiently address the national 
security risks present in the connected vehicle supply chain. However, 
BIS maintains the flexibility to grant general authorizations for 
certain types of transactions subject to the prohibitions at a future 
date.
    Several commenters also requested clarity on how far into a supply 
chain importers are required to maintain visibility. BIS encourages 
entities to reference the definitions of VCS hardware and covered 
software when determining the depth of supply chain due diligence 
necessary to certify that the VCS hardware or covered software was not 
designed, developed, manufactured, or supplied by persons owned by, 
controlled by, or subject to the jurisdiction or direction of the PRC

[[Page 5384]]

or Russia. Based on the definitions provided in this rule, importers 
would need to conduct due diligence on supply chain components if these 
components directly enable the function of and are directly connected 
the VCS systems or are part of an item that directly enable the 
function of the VCS. Component parts that do not contribute to the 
communication function of VCS hardware are not considered VCS hardware 
per the above, and so would not have due diligence requirements.
    One commenter suggested that suppliers should be prohibited from 
importing or selling covered software or VCS hardware linked to the PRC 
or Russia if they have knowledge that it will be integrated in 
connected vehicles built for the U.S. market. BIS declines to place the 
onus of this prohibition on suppliers of VCS hardware and covered 
software rather than on VCS hardware importers and connected vehicle 
manufacturers due to the numerous suppliers of the myriad components 
involved in the VCS hardware and covered software supply chain from 
which BIS would need to accept specific authorization applications in 
such circumstances. Instead, through requiring specific authorization 
applications and Declarations of Conformity from VCS hardware importers 
and connected vehicle manufacturers, BIS has implemented a more 
targeted approach, which BIS believes will still create the necessary 
changes to VCS hardware and covered software supply chains in the 
interest of national security. However, VCS hardware importers and 
connected vehicle manufacturers may rely on statements and 
documentation from suppliers in support of specific authorization 
applications and Declarations of Conformity so long as all necessary 
due diligence is documented and made available to BIS (section 791.313, 
``Reports to be furnished on demand'').
    Another commenter asked for clarity that a ``regulated entity can 
wholly and reasonably rely on statements of its tier 1 suppliers that a 
supplied part or piece of equipment does not contain a restricted 
component or subcomponent.'' As stated above, BIS clarifies that VCS 
hardware importers and connected vehicle manufacturers may rely on 
statements and documentation from suppliers in any Declarations of 
Conformity or specific authorization application. For example, in 
certifying that regulated entities have conducted due diligence in 
their covered software and VCS hardware supply chains, entities must 
also certify that they maintain documentation specifying their due 
diligence efforts and that they have made arrangements with suppliers 
to furnish any necessary documentation upon request by BIS (section 
791.312, ``Recordkeeping''). In making these certifications to BIS, 
entities may rely on statements from suppliers that a component is not 
designed, developed, manufactured, or supplied by persons owned by, 
controlled by, or subject to the jurisdiction or direction of the PRC 
or Russia.
13. Model Year
    In the NPRM, BIS proposed to define ``model year'' to mean the year 
used to designate a discrete vehicle model, irrespective of the 
calendar year in which the vehicle was actually produced, provided that 
the production period does not exceed 24 months. While many commenters 
raised issues with the specific model years selected by BIS as the 
implementation dates for this regulation, none addressed BIS's 
definition of the term. BIS has addressed concerns over implementation 
dates further below, under ``Exemptions.'' BIS retains the NPRM 
definition of ``model year'' in the final rule.
    Several commenters raised the concept of vehicle generations and 
highlighted that connected vehicle manufacturers do not conduct a major 
refresh of vehicle technologies every year. Rather, vehicle generation 
refreshes may only take place every four to six years. As discussed 
further below, BIS understands that the implementation dates for the 
rule may fall mid-generation for many connected vehicle manufacturers. 
In this situation, BIS would consider issuing a time-bound specific 
authorization in cases where connected vehicle manufacturers are able 
to demonstrate that they are moving into compliance with the rule for 
the next vehicle generation refresh. BIS may also contemplate allowing 
a phased-in implementation of the prohibitions, as advocated for by 
some commenters, in a specific authorization for manufacturers mid-
generation during the implementation period. Please see the specific 
authorizations section to learn more about how a phased approach can 
occur under this regulation.
14. Person Owned by, Controlled by, or Subject to the Jurisdiction or 
Direction of a Foreign Adversary
    In the NPRM, BIS proposed to define ``person owned by, controlled 
by, or subject to the jurisdiction or direction of a foreign 
adversary'' to mean:

    (1) Any person, wherever located, who acts as an agent, 
representative, or employee, or any person who acts in any other 
capacity at the order, request, or under the direction or control, 
of a foreign adversary or of a person whose activities are directly 
or indirectly supervised, directed, controlled, financed, or 
subsidized in whole or in majority part by a foreign adversary;
    (2) Any person, wherever located, who is a citizen or resident 
of a foreign adversary or a country controlled by a foreign 
adversary, and is not a United States citizen or permanent resident 
of the United States;
    (3) Any corporation, partnership, association, or other 
organization with a principal place of business in, headquartered 
in, incorporated in, or otherwise organized under the laws of a 
foreign adversary or a country controlled by a foreign adversary; or
    (4) Any corporation, partnership, association, or other 
organization, wherever organized or doing business, that is owned or 
controlled by a foreign adversary, to include circumstances in which 
any person identified in paragraphs (a) through (c) possesses the 
power, direct or indirect, whether or not exercised, through the 
ownership of a majority or a dominant minority of the total 
outstanding voting interest in an entity, board representation, 
proxy voting, a special share, contractual arrangements, formal or 
informal arrangements to act in concert, or other means, to 
determine, direct, or decide important matters affecting an entity.

    BIS has retained this definition in its final rule. However, it has 
provided further examples on how to apply this definition below.
    Example 15: Company A, incorporated in the United States, is a 
wholly owned subsidiary of Company B. Company B is a state-owned 
enterprise of the PRC or Russia. Because Company B is a state-owned 
enterprise, Company A would be considered ``owned by'' the PRC or 
Russia.
    Example 16: Company A is a joint venture between Company B and 
Company C where Company C owns a majority share of Company A. Company B 
is a corporation incorporated in a third-party jurisdiction. Company C 
is a state-owned enterprise of the PRC or Russia. Company A would be 
considered ``owned by'' the PRC or Russia.
    Example 17: Company A is majority owned in aggregate by multiple 
state-owned enterprises and state-owned investment funds of the PRC or 
Russia. Company A would be considered ``owned by'' the PRC or Russia.
    Example 18: Company A, incorporated in the United States, is a 
subsidiary of Company B. Company B is a private company incorporated in 
the PRC or Russia with its principal place of business in the PRC or 
Russia. Because Company B is subject to the jurisdiction of the PRC or 
Russia,

[[Page 5385]]

Company B's subsidiary, Company A, is controlled by an entity subject 
to the jurisdiction of the PRC or Russia and would be considered 
``controlled by'' and ``subject to the direction of'' the PRC or 
Russia.
    Example 19: Company A is a multinational company where a majority 
of the voting power is held by Company B, a PRC or Russian government 
investment fund. Company A would be ``controlled by'' and ``subject to 
the direction of'' the PRC or Russia.
    Example 20: Company A is a holding company organized in a tax-
advantaged jurisdiction. Company A is publicly listed on a stock 
exchange and its corporate voting structure is characterized by Class A 
and Class B shares, Class B shares having 10 times the voting power of 
Class A shares. If the aggregate voting power of shareholders subject 
to the jurisdiction of the PRC or Russia holding either Class A and 
Class B shares constitutes a majority or a dominant minority of total 
voting power, then Company A would be ``controlled by'' and ``subject 
to the direction of'' the PRC or Russia.
    Example 21: Company A, a company that is organized under the laws 
of the PRC or Russia, owns a minority interest in Company B, a U.S. 
business. Based on special voting powers vested in that minority 
interest, Company A maintains certain veto rights that determine 
important matters affecting Company B, including the right to veto the 
dismissal of senior executives of Company B. Company B would be 
considered ``controlled by'' and ``subject to the direction of'' 
Company A, and therefore ``controlled by'' and ``subject to the 
direction'' of the PRC or Russia.
    Example 22: Company A is an entity incorporated in a third country 
and Company B is an entity incorporated in the PRC or Russia. Company A 
and Company B create a new joint venture, Company C, to design, 
develop, and manufacture a new product. Company A and Company B own 
minority shares of the joint venture while Company D, a holding company 
wholly owned by a PRC citizen, owns the largest minority share. If 
aggregate voting power of Company B and Company D constitutes majority 
or dominant minority voting share, Company C would be ``controlled by'' 
and ``subject to the direction of'' the PRC or Russia.
    Example 23: Company A has eight members on its board of directors. 
Company A is characterized by a shareholder and corporate governance 
structure that requires a 75 percent supermajority for any significant 
business decision. Three of the members of the board are citizens of, 
and therefore subject to the jurisdiction of, the PRC or Russia. 
Because these three members make up 37.5 percent of the voting power of 
the board, they can block any supermajority and therefore determine, 
direct, or decide important matters affecting Company A. Company A 
would be ``controlled by'' or ``subject to the direction of'' the PRC 
or Russia.
    Example 24: The PRC or Russian government, through an investment 
fund, acquires a 1 percent special management share in Company A. This 
share grants the PRC or Russian government the right to appoint a 
director to the board of Company A and veto certain key business 
decisions, such as major strategic changes or mergers. This share 
allows the government to influence Company A's operations and strategy. 
Company A would be ``controlled by'' the PRC or Russia.
    Example 25: Company A maintains its principal place of business in 
the PRC or Russia. Company A would be ``subject to the jurisdiction'' 
of the PRC or Russia.
    Example 26: Company A is a publicly listed U.S. corporate entity. 
Company A has a wholly owned subsidiary, Company B, that is organized 
under the laws of the PRC or Russia and manufactures goods in the PRC 
or Russia. Because Company B is organized under the laws of the PRC or 
Russia, Company B would be subject to the jurisdiction of the PRC or 
Russia. However, Company A is not subject to the jurisdiction of the 
PRC or Russia.
    Example 27: Company A is privately held and incorporated in the 
United States. One member of Company A's board of directors, Person X, 
a former chairman of the board of a large PRC corporation, has known 
ties to the government of the PRC, owns a large minority share of 
Company A, and has previously made significant investments in other 
companies founded by Company A's chief executive officer. Person X also 
facilitated a large minority investment in Company A by the large PRC 
corporation where they were previously chairman of the board. Person 
X's professional background indicates that they are directly or 
indirectly supervised, directed, controlled, financed, or subsidized by 
the PRC government. The combination of Person X's close ties to Company 
A's CEO, Person's X's ownership interest and ability to direct 
investment from large, highly regulated PRC corporate entities, and 
Person X's close ties to the PRC government indicate that Company A 
would be ``subject to the direction'' of the PRC.
    Example 28: Company A is an automobile company based in a 
jurisdiction that is not the PRC or Russia. Company A maintains a 
supervisory committee established by the company's articles of 
association that is responsible for supervising the management of the 
company and is not part of the board of directors. Each member of the 
committee exercises significant managerial authority over the nature, 
scope, and attributes of the company's business. An independent member 
of this committee has known ties to the government of the PRC and 
previously served as board director for a PRC state-owned enterprise. 
Since Company A's supervisory committee contains a member that can 
affect important matters of the company, has ties to the PRC 
government, Company A is subject to the direction of the PRC.
    For additional clarity for determining what is and what is not 
designed, developed, manufactured, or supplied by the entities 
mentioned above, BIS offers the following examples below.
    Example 29: Company A is a U.S. person. Company B is headquartered 
in the PRC and is a fabless semiconductor design company that produces 
systems on chips for vehicle telematics systems. Through a joint 
development agreement, Company A collaborates with Company B to design 
a custom cellular microcontroller for integration into a VCS hardware 
unit that will be imported into the United States. Assuming no other 
facts, Company A's VCS hardware unit contains components designed by an 
entity that is subject to the jurisdiction of the PRC. The import of 
the VCS hardware unit is a prohibited transaction, unless authorized by 
a general authorization or specific authorization.
    Example 30: Company A is a U.S. person. Person B is a PRC citizen 
residing in the PRC. Company A contracts with Person B to conduct a 
cybersecurity review of its operating system software design for a 
piece of VCS hardware that is imported in the United States. Person B 
completes that review and recommends improvements and changes to 
Company A's product, which Company A is free to accept or reject. 
Person B's review of Company A's software does not mean Company A's 
covered software product was designed by an entity subject to the 
jurisdiction of the PRC solely on the basis of Person B being a PRC 
citizen.
    Example 31: Company A is domiciled in the PRC and is a joint 
venture between Company B and Company C. Company B is headquartered in 
the United States. Company C is headquartered in the PRC. Company A

[[Page 5386]]

sources suppliers, including suppliers of VCS hardware and covered 
software, integrates parts into automotive systems, and conducts 
prototyping and testing for future model year connected vehicles that 
Company B will eventually import and sell into the United States. 
Assuming no other facts, the connected vehicles that Company A 
prototypes and tests contain VCS hardware and covered software supplied 
by an entity subject to the jurisdiction of the PRC. Company B's import 
or sale of the vehicles is a prohibited transaction, unless a general 
authorization or specific authorization applies.
    Example 32: Company A is a PRC company that is an automotive 
contract assembler and manufacturer for connected vehicles. Company B 
is an automotive company headquartered in the United States. Company A 
assembles and manufactures completed connected vehicles, including 
installing the VCS hardware and covered software, in another country, 
that Company B will eventually import into the United States. Company 
B's connected vehicles contain VCS hardware and covered software 
supplied by an entity that is subject to the jurisdiction of the PRC. 
Importing the vehicles into the United States is a prohibited 
transaction, unless a general authorization or specific authorization 
applies.
    Example 33: Company A is an automotive parts company that is 
domiciled in the PRC or Russia. Company B is a U.S. person. Company A 
buys VCS hardware that integrates covered software, then customizes and 
packages that VCS hardware for sale to and import by Company B into the 
United States. Assuming no other facts, the VCS hardware supplied by 
Company A is supplied by an entity subject to the jurisdiction of the 
PRC or Russia. The import of the VCS hardware into the United States is 
a prohibited transaction, unless a general authorization or specific 
authorization applies.
    For additional clarity in determining whether a transaction 
involving VCS hardware or covered software designed, developed, 
manufactured, or supplied by entities described above is prohibited 
under the final rule, BIS offers the below examples. In offering these 
examples, BIS emphasizes, and has further clarified this language in 
the prohibitions, that VCS hardware and covered software would not be 
considered designed, developed, manufactured, or supplied by persons 
owned by, controlled by, or subject to the jurisdiction or direction of 
the PRC or Russia based solely on the country of citizenship of one or 
more natural persons who are employed by, contracted by, or otherwise 
similarly engaged in such actions through the entity designing, 
developing, manufacturing, or supplying the VCS hardware or covered 
software. In particular, BIS confirms that visa holders in the United 
States would not be considered persons controlled by the PRC or Russia 
solely based on their citizenship.
    Example 34: A U.S. person has a contractual relationship with a 
foreign person to import a cellular module, and the cellular module 
will later be integrated into a VCS for a completed connected vehicle. 
The U.S. person is, under the final rule, a VCS hardware importer. The 
U.S. person knows the cellular module was manufactured at a facility 
located in the PRC or Russia and is being imported through a third 
country. Since the entity manufacturing the module would, at a minimum, 
be ``subject to the jurisdiction'' of the PRC or Russia, the import of 
the module would be a prohibited transaction under the final rule, 
unless it qualifies for a general authorization or a specific 
authorization from BIS.
    Example 35: A U.S. person imports a TCU that was assembled in a 
third country, but that contains a microcontroller that is manufactured 
in the PRC or Russia and is sold to the third-country assembler of the 
TCU. The U.S. person knows that the microcontroller was manufactured by 
an entity located in the PRC or Russia. As the microcontroller is 
included in the definition of VCS hardware, the import of the TCU for a 
completed connected vehicle would be a prohibited transaction under the 
final rule unless it qualifies for a general authorization, or a 
specific authorization granted by BIS.
    Example 36: A U.S. person imports a completed connected vehicle, 
making the U.S. person a connected vehicle manufacturer under the final 
rule's definition. The completed connected vehicle contains a TCU that 
operates software supporting off-vehicle connectivity above 450 MHz, 
and that software is designed, developed, or otherwise supplied (in 
whole or in part) by an entity located in the PRC or Russia. Under the 
final rule, the import of the completed connected vehicle would be 
prohibited unless it was authorized by a general authorization or a 
specific authorization.
    Example 37: A U.S. person who is a connected vehicle manufacturer 
that manufactures or assembles completed connected vehicles in the 
United States sells to a dealer within the United States a completed 
connected vehicle in which the vehicle's ADS software for object 
detection, classification, and decision making is proprietary software 
designed, developed, or supplied by an entity in the PRC or Russia. The 
sale or transfer of the completed connected vehicle would be a 
prohibited transaction under the final rule unless it qualifies for a 
general authorization or specific authorization.
    Example 38: A U.S. person who is a connected vehicle manufacturer 
utilizes foreign VCS and ADS software development teams through various 
subsidiaries, joint ventures, and contract arrangements, some of which 
retain servicing obligations and contractual and licensing rights in 
the software they have developed. One of those software development 
teams is located in the PRC or Russia, and as such, that software team 
is subject to the jurisdiction of the PRC or Russia. Given the role of 
PRC or Russian developers in the creation of the VCS or ADS software 
and the existence of an ongoing foreign interest (i.e., servicing 
obligations and contractual and licensing rights), the sale of a 
completed connected vehicle within the United States that integrates 
this proprietary covered software would be a prohibited transaction 
under the final rule, unless it qualifies for a general authorization 
or specific authorization.
    Example 39: Company A, which is a wholly owned subsidiary of a 
foreign corporation in which a PRC or Russian entity owns a controlling 
interest, imports completed connected vehicles that incorporate covered 
software and VCS hardware, none of which was originally designed, 
developed, manufactured, or supplied by an entity owned by, controlled 
by, or subject to the jurisdiction or direction of the PRC or Russia. 
In the rare circumstance where Company A did not participate in the 
design or development of the covered software or VCS hardware, Company 
A would submit a Declaration of Conformity for the import of the 
completed connected vehicles containing covered software and VCS 
hardware, identified by make, model, and VIN series. However, any 
subsequent sale by Company A of such completed connected vehicle in the 
United States would be prohibited. For example, Company A subsequently 
sells such completed connected vehicles to a dealer in the United 
States. Because Company A is a person controlled by the PRC or Russia 
and has direct privileged access to the VCS hardware and covered 
software prior to the sale, the knowing sale by Company A of the 
completed connected vehicle with VCS hardware and covered software 
would be a prohibited transaction under the

[[Page 5387]]

final rule, and a specific authorization from BIS would be required 
before engaging in such a transaction.
    Example 40: Company A, a wholly owned subsidiary of a PRC or Russia 
corporation, manufactures completed connected vehicles in the United 
States. The completed connected vehicles that Company A manufactures 
incorporate covered software and VCS hardware provided by Company B, a 
company that is not owned by, controlled by, or subject to the 
jurisdiction or direction of the PRC or Russia. Because Company A is 
owned by, controlled by, or subject to the jurisdiction or direction of 
the PRC or Russia, Company A's sale of the completed connected vehicles 
is a prohibited transaction under the final rule, and a specific 
authorization from BIS would be required before engaging in such a 
transaction.
    Example 41: Company A is a company that, through any of the 
scenarios detailed above, is deemed to be owned by, controlled by, or 
subject to the jurisdiction or direction of the PRC or Russia. Company 
A purchases otherwise completed connected vehicles from Company B, a 
U.S. company that is not owned by, controlled by, or subject to the 
jurisdiction or direction of the PRC or Russia. Company A transforms 
these vehicles into autonomous vehicles by integrating hardware and 
software, including ADS software, on these vehicles. Company A is thus 
a connected vehicle manufacturer under this rule. Company A seeks to 
offer a commercial robotaxi service by which customers are able to use 
a mobile application to hail one of Company A's vehicles incorporating 
ADS software. Because Company A is a connected vehicle manufacturer 
owned by, controlled by, or subject to the jurisdiction or direction of 
the PRC or Russia and seeks to offer a commercial service utilizing 
completed connected vehicles incorporating ADS, Company A would require 
a specific authorization from BIS prior to engaging in such a 
transaction.
    Many commenters recommended that BIS further clarify that, under 
the rule, VCS hardware or covered software would not be considered as 
designed, developed, manufactured, or supplied by entities with a nexus 
to the PRC or Russia if individual contributors holding PRC or Russian 
citizenship work on the hardware or software outside of the PRC or 
Russia. Commenters expressed similar concerns about visa holders from 
the PRC or Russia working in the United States. BIS agrees that 
participation by individual contributors holding PRC or Russian 
citizenship outside of the PRC or Russia should not alone make VCS 
hardware or covered software subject to the prohibitions in this rule 
because this scenario presents a lower national security risk than 
other situations addressed by this rule. BIS has addressed this point 
in paragraph (b) of section 791.302 (prohibited VCS hardware 
transactions) and paragraph (c) of section 791.303 (prohibited covered 
software transactions). BIS further highlights in the examples below.
    Example 42: A U.S. person who is a connected vehicle manufacturer 
utilizes VCS and ADS software development teams around the world 
through various subsidiaries, joint ventures, and contract 
arrangements. One of those software development teams is comprised of 
individuals who are PRC or Russian citizens working in a foreign 
jurisdiction other than the PRC or Russia for a company that is not 
owned by, controlled by, or subject to the jurisdiction or direction of 
the PRC or Russia. Although the individuals technically meet the 
definition of ``person owned by, controlled by, or subject to the 
jurisdiction or direction of a foreign adversary,'' assuming no other 
facts, paragraph (c) of the section 791.303 (Prohibited covered 
software transactions) makes clear that the sole fact that PRC or 
Russian citizens work on the connected vehicle manufacturer's software 
development would not make the sale of a completed connected vehicle 
within the United States that integrates this VCS or ADS software a 
prohibited transaction under the final rule.
    Example 43: Company A is a European automotive company. Company B 
is a supply chain consultancy that is domiciled in Singapore and is 
majority owned by a PRC citizen. Subject to a non-disclosure agreement, 
Company B reviews Company A's automotive design specifications and 
recommends specific hardware and software suppliers to Company A. 
Company A considers Company B's recommendations and obtains hardware or 
software from the recommended suppliers directly (not through Company 
B). Assuming no other facts, Company B's review and recommendation of 
Company A's covered software and VCS hardware suppliers does not mean 
those products are developed by an entity subject to the jurisdiction 
of the PRC. The import or sale of Company A's vehicles in the United 
States would not be a prohibited transaction, but a VCS hardware 
importer or connected vehicle manufacturer that imports or sells the 
vehicles into the United States must comply with any applicable 
Declaration of Conformity requirements.
    To provide further clarification, BIS has added examples to this 
final rule, such as Example 30, Example 42, and Example 43, to explain 
that citizenship of natural persons involved in the manufacture or 
design of a product is not itself determinative of a product being 
designed, development, manufactured, or supplied by a person owned by, 
controlled by, or subject to the jurisdiction or direction of the PRC 
or Russia. These examples also help explain the prohibitions described 
in Section VI subsection (b) Prohibitions on Certain Transactions 
Related to Connected Vehicles.
    Numerous commenters urged BIS to provide greater clarity as to the 
criteria by which regulated entities should deem a person to be owned 
by, controlled by, or subject to the jurisdiction or direction of the 
PRC or Russia. Several commenters recommended that BIS adopt the 
criteria described by the Department of Justice's (DOJ) NPRM, 
Provisions Pertaining to Preventing Access to U.S. Sensitive Personal 
Data and Government-Related Data by Countries of Concern or Covered 
Persons (89 FR 86116, October 29, 2024), which uses a fifty percent 
threshold for ownership as one criteria for an entity to be a ``covered 
person'', or adopting a more conservative ownership threshold of 25 
percent, as stipulated by the Department of Energy's (DOE) Foreign 
Entity of Concern (FEOC) rules. BIS rejects these suggestions and 
retains the current definition as published in the NPRM because it 
retains consistency across all ICTS transactions reviewed by BIS under 
15 CFR part 791 Securing the Information and Communications Technology 
and Services Supply Chain. By contrast, each of the other U.S. 
government programs identified by commenters differs and addresses 
national security risks unique to their mandates and missions. For 
instance, DOE's final guidance applies to the Battery Materials 
Processing and Manufacturing grant program, authorized by section 40207 
of the Bipartisan Infrastructure Law, Public Law 117-58, and the 30D 
Clean Vehicle tax credit created under the Inflation Reduction Act, 
Public Law 117-169, which imposes limits on when an entity's battery 
supply chain includes FEOC. DOE's final guidance was issued to aid 
stakeholders in identifying FEOCs in their battery supply chains rather 
than those entities involved in supply chains related to VCS and ADS. 
DOJ's NPRM on Provisions Pertaining to Preventing Access to U.S. 
Sensitive

[[Page 5388]]

Personal Data and Government-Related Data by Countries of Concern or 
Covered Persons also differs in that it prohibits and restricts certain 
transactions that could allow persons from countries of concern access 
to bulk sensitive personal data or to U.S. government-related data. 
Additionally, BIS rejects the recommendation to define ownership 
thresholds. While BIS recognizes that thresholds may provide a bright 
line for industry, BIS maintains that connected vehicle supply chains 
are complex and opaque, with varying ownership structures of OEMs and 
connected vehicle suppliers. Bright-line thresholds alone can be 
limited when dealing with an entity with a PRC or Russia nexus and one 
who may circumvent the prohibitions by adjusting its ownership 
structure, while still retaining corporate control or executive 
management that may be subject to the direction of the PRC or Russia. 
Retaining the current definition of owned by, controlled by, or subject 
to the jurisdiction or direction of the PRC or Russia, will allow BIS 
to address the evolving and unique national security risks across a 
variety of supply chains for distinct industries, as articulated in 
Section IV of this rule. Additionally, one commenter requested that BIS 
further clarify the meaning of subject to the direction in this 
definition. This commenter expressed concern that ``direction'' 
diverges from common industry understandings of ownership and control, 
and that it could be interpreted to include a one-time event. BIS 
retains the definition of person owned by, controlled by, or subject to 
the jurisdiction or direction of a foreign adversary, which is 
consistent with the scope of E.O. 13873 and reflects the possibility 
that a person may act at the direction of a foreign adversary in 
situations in which typical corporate ownership or control may not be 
present. BIS considers ``subject to the direction'' to typically entail 
a continuous and ongoing relationship between a regulated person and 
the PRC or Russian government or entities subject to the jurisdiction 
of the PRC or Russian government.
    One commenter maintained that the ultimate ownership structure of 
an entity should not subject that entity to the prohibitions of the 
rule, and the location of covered software and VCS hardware design 
should instead be determinative. BIS reiterates the threat outlined in 
the NPRM and in this final rule that entities owned by, controlled by, 
or subject to the jurisdiction or direction of the PRC or Russia may be 
compelled to provide logical access to their VCS hardware or covered 
software resulting in the exfiltration of sensitive data or remote 
manipulation of the vehicle. While the location of covered software and 
VCS hardware design and development, as well as corporate structure and 
security practices, will play an important factor in BIS's decision to 
issue specific authorizations, BIS declines to amend the rule in 
response to this comment.
15. Prohibited Transactions
    In the NPRM, BIS proposed prohibited transactions to mean 
collectively, the transactions described in section 791.302 (Prohibited 
VCS hardware transactions), section 791.303 (Prohibited covered 
software transactions), or section 791.304 (Related prohibited 
transactions) of this subpart. BIS did not receive any comments 
directly about this definition. Feedback on prohibited transactions 
focused on the transactions described in the body of the regulation 
text. To review the comments and responses on the prohibited 
transactions in this rule, please review Section VI subsection (b) 
Prohibitions on Certain Transactions Related to Connected Vehicles 
below.
16. Sale
    In the NPRM, BIS proposed sale to mean distributing for purchase, 
lease, or other commercial operations a new completed connected vehicle 
for a price, to include the transfer of completed connected vehicles 
from a connected vehicle manufacturer to a dealer or distributor, as 
those terms are defined in 49 U.S.C. 30102. This definition also 
applies to the related terms such as sell or selling. Some commenters 
recommended that BIS clarify and revise the definition of sale. 
Commenters highlighted differences between the commercial vehicle 
market and the passenger vehicle market and emphasized that the NPRM 
sale definition is inadequately scoped for the commercial vehicle 
market. BIS, after taking all comments into consideration, retained 
this definition in the final rule but made a related change to the 
definition of connected vehicle to focus on the passenger market by 
limiting the scope of this final rule to vehicles under 10,001 pounds.
    One commenter recommended that BIS clarify that contracting with a 
third party to manufacture one's own completed connected vehicles with 
one's own VCS or ADS does not constitute a sale. In response, BIS 
believes that such a transaction could, but would not necessarily 
always, constitute a sale, and such a determination would depend on the 
specifics of the arrangement, including the chain of custody or legal 
rights over the vehicle while with a third-party manufacturer. BIS 
generally believes that it is not in the national security interest of 
the United States to categorically exempt third-party manufacturing 
from the prohibitions of this rule. For example, the rule would 
prohibit the sale of completed connected vehicles manufactured by an 
entity that is owned by, controlled by, or subject to the jurisdiction 
or direction of the PRC or Russia, even if that manufacturing is on 
behalf of a U.S. connected vehicle manufacturer. In this scenario, BIS 
believes the integration of VCS hardware or covered software by that 
manufacturer constitutes the ``supply'' of such ICTS by a prohibited 
entity. Whether or not the actual transfer of the vehicles from the 
third-party manufacturer to the U.S. connected vehicle manufacturer 
occurred would depend on the specifics of the transaction, but if there 
is a foreign interest in the software (e.g., ongoing contractual 
arrangements or IP rights), the ultimate sale of those vehicles in the 
United States would be prohibited. However, if, for example, the third-
party manufacturer incorporates prohibited ADS software that is 
designed, developed, manufactured, or supplied by a PRC or Russian 
entity, the subsequent transfer of those vehicles to any entity for 
commercial operations would be prohibited.
    One commenter claimed that the definition as written could be 
interpreted to impose compliance duties on dealers who sell but do not 
manufacture or import connected vehicles. As written, the prohibitions 
of the rule apply only to the sale of a completed connected vehicle by 
a connected vehicle manufacturer. Given that dealers do not perform 
manufacturing operations on vehicles to transform an incomplete 
connected vehicle into a completed connected vehicle (nor do they 
integrate ADS onto an otherwise completed connected vehicle), the sale 
of vehicles from a dealer to a consumer would not be captured by any of 
the prohibitions of this rule. BIS emphasizes that instead, given both 
the definition of sale and the prohibitions contained in this rule, it 
is the sale by the connected vehicle manufacturer to the dealer that 
would be prohibited if the VCS hardware or covered software is 
designed, developed, manufactured, or supplied by an entity owned by, 
controlled by, or subject to the jurisdiction or direction of the PRC 
or Russia, or if the connected

[[Page 5389]]

vehicle manufacturer itself is such an entity. In this case, it is the 
connected vehicle manufacturer that is subject to the prohibition, and 
it is the connected vehicle manufacturer that would be subject to civil 
or criminal penalties should they knowingly violate these prohibitions. 
As such, BIS stresses that this rule places no additional compliance 
responsibilities on dealers.
17. Software Bill of Materials
    In the NPRM, BIS proposed to define software bills of materials 
(SBOM) to mean a formal and dynamic, machine-readable inventory 
detailing the software supply chain relationships between software 
components and subcomponents, including software dependencies, 
hierarchical relationships, and baseline software attributes, including 
author's name, timestamp, supplier name, component name, version 
string, component hash package URL, unique identifier, and dependency 
relationships to other software components. Based on public comment, 
BIS has altered its definition of SBOM and modified its compliance 
requirements with respect to SBOMs.
    Commenters provided feedback on what BIS should include in the 
criteria for an SBOM, suggesting how its definition should be changed 
in the final rule. Multiple commenters recommended that BIS align its 
SBOM definition to the National Telecommunication and Information 
Administration's (NTIA) ``The Minimum Elements for a Software Bill of 
Materials'' (Minimum Elements for an SBOM), a report written in 
collaboration with the Department of Commerce and authorized under 
President Biden's E.O. 14028, ``Improving the Nation's Cybersecurity,'' 
86 FR 26633 (May 12, 2021), which identifies the prevention, detection, 
assessment, and remediation of cyber incidents. Many commenters 
recommended referencing NTIA's Minimum Elements for an SBOM in BIS's 
SBOM definition. Another commenter specifically advised removing the 
``component hash'' requirement in BIS's SBOM definition to match the 
NTIA's Minimum Elements for an SBOM. Commenters also recommended 
revising the definition to only require the detailed elements ``if 
available.''
    Based on the numerous comments received, BIS opted to align the 
SBOM definition with the NTIA Minimum Elements for an SBOM requirements 
rather than reference them directly to avoid any confusion should the 
NTIA definitions change. In addition, BIS has removed several SBOM 
elements (e.g., version string, component hash, package URL, and unique 
identifier) from the minimum documentation requirements necessary to 
apply for a Declaration of Conformity or specific authorization. BIS 
declines to add ``if available'' to the SBOM requirements included in 
the final rule with the understanding that this regulation is 
prospective, allowing industry the opportunity to ensure these minimum 
requirements are met for any covered software transaction. These 
changes also reflect comments arguing that the NPRM definition requires 
information that may be beyond the detail provided by automated 
scanning tools and would create burdens for manufacturers, and 
cautioning BIS that industry did not have sufficient time to gather 
SBOMs as defined in the NPRM by model year 2027. By reducing the 
minimum documentation requirements for an SBOM, as described above, and 
removing the requirement to submit an SBOM with Declarations of 
Conformity (see Section VI.c.1), BIS has significantly reduced the 
compliance burden for industry, including for small entities. BIS has 
significantly reduced the compliance burden for industry, including for 
small entities.
    One auto manufacturer recommended that BIS replace ``supplier's 
name'' and ``author's name'' with ``person's name'' in the definition. 
While BIS has removed the required baseline software attributes from 
the definition of SBOM, including the requirements for author's name 
and supplier name, it declines to replace the term ``supplier'' and 
``author'' with ``person'' in the context of SBOMs throughout the 
remaining regulatory text based on the understanding that a 
``supplier'' or ``author'' may be either an entity or person. 
Additionally, this language is inconsistent with E.O. 14028 and NTIA's 
Minimum Elements for an SBOM, on which BIS bases its SBOM definition. 
Another commenter stated that if BIS intends for SBOM requirements to 
include open-source software within covered software, that this be 
specified in the definition by adding ``including open-source software 
used in covered software, even if the open-source software is outside 
the definition of covered software.'' In alignment with the removal of 
the SBOM submission requirement, BIS will only require retention of 
minimal documentation related to products for which a Declaration of 
Conformity is submitted, including documentation or third-party 
assessments sufficient to identify, at minimum, the author name, 
timestamp, component name, and supplier name of all proprietary 
additions to the development of the covered software.
    Commenters provided other feedback about how to use and process 
SBOMs. A commenter highlighted how SBOMs could be useful to BIS in 
variety of ways, including: verifying if known vulnerabilities exist 
using the CPE (Common Platform Enumeration) in the unique identifier 
against the NVD (National Vulnerability Database); ensuring the 
supplier names listed in the SBOMs do not match any entity under 
foreign adversary control, as defined by the proposed rule; confirming 
that component hashes match those generated from package URLs to verify 
source code integrity; and using dependency relationships to provide 
specific guidance to entities on scope to address for achieving 
conformity when issues arise with identified components. This commenter 
also recommended that BIS allow a flexible SBOM update method that can 
be integrated into the frequent software update typical for VCS and ADS 
without disrupting development cycle. BIS appreciates this feedback; 
however, given its decision to not require SBOMs at this time, BIS will 
not take action on these recommendations. NBIS has chosen to define 
``Software Bill of Materials'' or SBOM as a formal record containing 
the details and supply chain relationships of various components used 
in building software. Software developers and vendors often create 
products by assembling existing open-source and commercial software 
components. The SBOM enumerates these components in a product.
18. United States
    In the NPRM, BIS proposed United States to mean United States of 
America, the States of the United States, the District of Columbia, and 
any commonwealth, territory, dependency, or possession of the United 
States, or any subdivision thereof, and the territorial sea of the 
United States. Commenters did not provide feedback on this definition. 
BIS retains this definition for its final rule.
19. Vehicle Connectivity System
    In the NPRM, BIS proposed Vehicle Connectivity System (VCS) to mean 
a hardware or software item for a completed connected vehicle that has 
the function of enabling the transmission, receipt, conversion, or 
processing of radio frequency communications at a frequency over 450 
megahertz. Public comments informed BIS's modification of VCS 
definition for the final rule, which includes explicit hardware and 
software exclusions.

[[Page 5390]]

    Numerous commenters provided feedback on BIS's proposed definition 
for Vehicle Connectivity System. Many commenters urged BIS to narrow 
the definition to exclude specific radio frequency bands, functions, or 
devices. Comments regarding specific VCS hardware devices are discussed 
in the next section, ``VCS Hardware.''
    Multiple commenters took issue with the proposed rule's threshold 
of 450 MHz and argued that this cutoff is overly broad. For example, 
some commenters recommended that BIS include an upper limit for the 
radio frequency band in order to scope out certain ultra-wideband 
automotive applications, such as some key fobs. Other commenters 
encouraged BIS to scope out certain convenience functions such as 
garage door opening or rear seat entertainment. Several commenters also 
encouraged BIS to explicitly scope out systems that connect internally 
within the vehicle, supply power to the VCS, exchange data with the 
VCS, authenticate a user to access or drive a vehicle, or localize a 
device intended to control vehicle functions.
    In response to these comments, BIS has amended the definition of 
VCS to include a variety of function-based exclusions to exclude 
certain low-risk use cases and provide industry with greater 
flexibility. BIS declines to implement an upper bound for the radio 
frequency as this would unnecessarily constrain the definition of VCS 
as automotive technology evolves. BIS has accepted the majority of 
recommendations to exclude certain functions, including automotive 
sensing (which includes LiDAR, radar, cameras, and ultrawideband); 
global navigation satellite system (GNSS); and satellite, AM, and FM 
radio. BIS declines to exclude convenience functions given the 
difficulty in adequately defining this exemption to address only 
convenience functions rather than communications functions that present 
undue risk. Further, many of the ``convenience'' functions referenced 
by the commenters are simply systems that use VCS to accomplish a non-
driving task, often by communicating non-expressive data with an 
external device. BIS added a number of VCS exclusions that may exclude 
certain ``convenience'' functions, but declines to categorically 
exclude them all, as the term is broad and eludes concise definition. 
BIS further believes that the amended definition of VCS hardware, 
particularly the replacement of ``supports'' to ``directly enables,'' 
renders unnecessary the exclusion of internal vehicle communications or 
an exemption for systems that simply exchange data with the VCS. While 
BIS believes that this amended definition excludes features that enable 
vehicle access and user authentication, BIS declines to exclude the 
hardware and software that enable the localization of a device intended 
to control vehicle functions, as the vehicle-side hardware and software 
of that function presents a possible threat vector that could enable 
the national security risks spelled out in this rule.
    A commenter recommended that the definition of VCS be restricted to 
the electronic control unit or part of an item that supports the VCS 
external communications capability. Restricting the definition of VCS, 
and therefore VCS hardware, to solely the electronic control unit or 
``telematics control unit'' would be overly narrow and would leave many 
other components that also support wireless communications that could 
enable long-range cybersecurity exploits. For example, if an 
infotainment module or a battery management system included a cellular 
module for its own wireless communication, those modules could be 
considered VCS but would not be covered by a regulation that only 
focused on an ``ECU.'' Furthermore, major subcomponents of ECUs that 
are software programmable often retain connectivity with their OEMs and 
continue to receive software updates throughout their lifecycle. 
Therefore, BIS determined that addressing connectivity systems at the 
ECU level only would be insufficient.
    Commenters urged BIS to clarify the definition of VCS by clarifying 
that (1) a system that may convert or process radio frequency 
communications at a frequency over 450 megahertz, but that does not 
both receive and transmit data either to or from the vehicle, is 
outside the scope and (2) a system that does not both receive data from 
external sources and transmit data to an external source is outside the 
scope. In response to this comment and others that raised similar 
issues, BIS modified the definition of VCS to add a number of 
functional exclusions, one of which excludes unidirectional 
communication systems. However, a subcomponent within an item that 
directly enables the function of transmission, receipt, conversion, or 
processing of a connectivity item would nonetheless be defined as VCS 
even if that subcomponent has only an internal, unidirectional 
communication purpose. One commenter urged BIS to modify the VCS 
definition to clarify that: ``Items that are either for wired frequency 
communications (e.g., USB port, OBD port) or for the purpose of 
distance positioning or imaging only are exempted (e.g., Ultra-Wide 
Band (UWB), cameras, and sensors including LiDAR and radar).'' BIS 
understands that wired-frequency communications-related hardware may 
also pose risks, but they are not as significant as those defined in 
the final rule's definition of VCS. BIS accepts this recommendation in 
part and has modified the VCS definition to define specific function-
based exclusions, including on that explicitly excludes sensor 
hardware.
    Commenters recommended that the VCS definition align with the 
Federal Communication Commission (FCC) equipment authorization 
regulations. BIS attempted, wherever able, to conform and harmonize 
with preexisting standards in both the automotive and 
telecommunications industries. In this case, aligning the VCS 
definition with the scope of the FCC's equipment authorization 
definition would be overly broad, as the FCC requires declarations of 
conformity or certification for products that BIS did not intend to be 
VCS, including unintentional radiators, as defined by 47 CFR 15.3. To 
keep the definition as narrow as possible to address only those items 
and components necessary to mitigate the identified national security 
risks, BIS decided not to rely on the FCC equipment authorization 
program's scope.
    One commenter suggested that BIS amend this term to ``Vehicle 
Communication Device,'' believing that the term would provide industry 
with greater clarity on covered items. BIS has decided to retain the 
original Vehicle Connectivity System term and believes that ``Vehicle 
Communication Device'' would unnecessarily constrain covered 
components, including unintentionally excluding major VCS subcomponents 
that could directly pose a national security risk as outlined in this 
rule. However, BIS believes that other changes to the definitions of 
Vehicle Connectivity System and VCS hardware substantially address the 
intent behind this comment. BIS also rejects commenters recommendation 
to define system. Another commenter urged BIS to reconsider its 
prohibitions on vehicle connectivity given the U.S Department of 
Transportation's efforts to deploy Vehicle-to-Everything (V2X) 
technology. This commenter argued that the proposed rule unnecessarily 
risks delaying V2X deployments and undermines local, state, and federal 
investments into V2X infrastructure deployment. BIS appreciates this 
comment and has been in contact with the Department of Transportation 
in drafting this regulation. BIS understands that the requirements of 
this regulation may create new compliance burdens.

[[Page 5391]]

However, those requirements seek to ensure automotive supply chain 
security, which will help secure the future of V2X technology 
implementation.
    BIS has chosen to define Vehicle Connectivity System or VCS as a 
hardware or software item installed in or on a completed connected 
vehicle that directly enables the function of transmission, receipt, 
conversion, or processing of radio frequency communications at a 
frequency over 450 megahertz. VCS does not include a hardware or 
software item that exclusively:
    (1) enables the transmission, receipt, conversion, or processing of 
automotive sensing (e.g., LiDAR, radar, video, ultrawideband);
    (2) enables the transmission, receipt, conversion, or processing of 
ultrawideband communications to directly enable physical vehicle access 
(e.g., key fobs);
    (3) enables the receipt, conversion or processing of unidirectional 
radio frequency bands (e.g., global navigation satellite systems 
(GNSS), satellite radio, AM/FM radio); or
    (4) supplies or manages power for the VCS.
20. VCS Hardware
    In the NPRM, BIS proposed VCS hardware to mean the following 
software-enabled or programmable components and subcomponents that 
support the function of VCS or are part of an item that supports the 
function of VCS: microcontroller, microcomputers or modules, systems on 
a chip, networking or telematics units, cellular modem/modules, Wi-Fi 
microcontrollers or modules, Bluetooth microcontrollers or modules, 
satellite navigation systems, satellite communication systems, other 
wireless communication microcontrollers or modules, and external 
antennas. VCS hardware does not include component parts that do not 
contribute to the communication function of VCS hardware. BIS received 
a variety of comments on VCS hardware that informed the final rule 
definition.
    One commenter encouraged BIS to adopt an entity-based approach, 
rather than target specific VCS hardware devices, or to introduce an 
exhaustive list of covered components. BIS declines these suggestions. 
BIS has determined that an entity-based approach would not adequately 
mitigate the national security risks outlined in this rule, given the 
ability of prohibited entities to restructure and ingrain themselves in 
the connected vehicle supply chain before being subject to an 
enforcement action by BIS. Rather, a technology-based approach more 
broadly covers entities of concern and would not require individual 
enforcement actions against all PRC or Russian suppliers of covered 
software or VCS hardware. Some commenters requested that BIS clarify 
that the list of VCS hardware components is exhaustive, meaning any 
component not included in the definition would not be captured by the 
prohibition. BIS declines this recommendation as it believes the 
modifications to the definition of VCS and VCS hardware will allow 
industry to appropriately identify covered components, and further 
believes that limiting the definition to a set list of components would 
not adequately address the potential for changes in nomenclature in the 
future or address technological developments in which components that 
are not listed might directly enable VCS functions.
    Commenters requested several changes to the VCS hardware 
definition. As with covered software, numerous commenters requested 
that BIS refine the definition of VCS hardware and replace the phrase 
``support the function of.'' Most commenters making this point 
suggested that BIS replace this language with ``directly enable the 
function of'' or similar language. BIS accepts this recommendation and 
believes it will allow industry to more easily identify components that 
are captured by the VCS hardware definition. One commenter requested 
that BIS remove the word ``subcomponent'' from the definition. BIS 
rejects this recommendation because VCS hardware subcomponents with a 
nexus to foreign adversaries facilitate the same risk identified in 
this regulation.
    Many commenters encouraged BIS either to explicitly exclude certain 
VCS hardware devices from the definition, or, in some cases, to 
explicitly include a set of devices not originally present in the 
proposed rule's definition. As referenced above, commenters encouraged 
BIS to exclude automotive radar from the definition of VCS hardware 
given its safety-critical nature and its inability to communicate 
independently of the vehicle. As noted, BIS accepts this recommendation 
and has amended the definition of Vehicle Connectivity System 
accordingly where it has noted this exclusion. Radar hardware is also 
excluded in the definition of VCS hardware because its primary function 
is for sensing rather than communications.
    Other commenters urged BIS to include LiDAR as a separate category 
of VCS hardware, contesting BIS's decision to exclude the technology 
from the proposed rule. One commenter pointed to outside research 
assessing that certain PRC manufacturers of LiDAR could insert 
vulnerabilities into the technology and that the reliance of U.S. 
connected vehicle manufacturers on PRC LiDAR could pose an unacceptable 
supply chain risk. In response, BIS reaffirms its decision to exclude 
LiDAR from the definition of VCS hardware. While recognizing that 
foreign adversary-sourced LiDAR may present certain cyber or supply 
chain risks, BIS continues to assess that the ADS software is the most 
appropriate avenue through which to address the potential remote 
manipulation of a connected vehicle at this time. In general, ADS 
software is responsible for overseeing the autonomous behavior of the 
car, processing data from sensors in the car, and executing operations 
based on that data. In contrast, LiDAR software is merely responsible 
for analyzing and processing the data collected by LiDAR. BIS 
recognizes that the scope of both data and control over the vehicle is 
greater for ADS software than LiDAR software, which is why BIS has 
prioritized ADS software in this regulation. However, BIS emphasizes 
that it may consider LiDAR separately as part of a separate rulemaking 
effort or investigation under 15 CFR 791.
    Commenters specifically asked that components and subcomponents 
that do not have the ability to process or modify data be removed from 
the scope of VCS hardware, such as antennas and tuners. In response to 
these comments, BIS notes that if a tuner is a passive electronic part 
that is not software programmable, it may not be covered by this 
regulation. However, if the tuner is a software-enabled and 
programmable component that directly enables the function of a VCS item 
then it would likely be defined as VCS hardware and thus regulated by 
this rule. This also applies to one commenter, who requested that BIS 
clarify that RF switches and passive oscillation components not be 
included in the definition of VCS hardware. BIS believes that the 
clarification that VCS hardware must ``directly enable'' vehicle 
communication addresses this comment. Other outstanding questions may 
be answered on BIS's FAQ website page or via an advisory opinion.
    Commenters requested that BIS define the terms system and modules. 
BIS accepts this recommendation in part, as it has defined ``system'' 
to the extent it has defined Vehicle Connectivity System and Automated 
Driving System. Further, the definition of item reflects BIS's stance 
on the term ``system,'' insofar as a system can be considered an

[[Page 5392]]

item if that system performs a function. Given this portion of the item 
definition, a subsequent definition of ``system'' would be redundant. 
With regard to the term ``module,'' BIS again determines that the 
definition of item is sufficient to provide a known industry benchmark 
that regulated entities may use to delimit the types of components that 
fall within the regulated systems. Multiple commenters, particularly in 
the commercial vehicle sector, urged BIS to reconsider the inclusion of 
aftermarket VCS devices. BIS believes that certain aftermarket devices, 
specifically those that fulfill VCS functions, pose a significant 
national security risk when designed, developed, manufactured, or 
supplied by PRC or Russian entities. BIS does recognize that the 
inclusion of aftermarket devices poses particular concerns for the 
commercial sector, and consequently may consider a separate rulemaking 
on commercial connected vehicles to address this significant threat in 
a tailored manner. For the passenger connected vehicle market, BIS 
emphasizes that aftermarket devices that directly fulfill VCS functions 
are captured by the VCS hardware prohibition.
    Some commenters raised that under the proposed rule, a cellphone 
that paired with a connected vehicle could be considered aftermarket 
VCS hardware. BIS believes that the updated definition of VCS hardware, 
particularly the stipulation that the hardware ``directly enable the 
function of'' and be ``directly connected to'' VCS sufficiently 
clarifies BIS's intent that cellphones not be captured by this rule. 
VCS hardware includes aftermarket devices not contained in a completed 
connected vehicle at sale but that are later integrated into the 
vehicle to perform VCS functions. Conversely, VCS hardware does not 
include aftermarket devices whose primary function is not to enable 
vehicle connectivity. For example, mobile phones that are paired with a 
connected vehicle are not considered aftermarket VCS hardware as 
vehicle connectivity is not the primary intended function of the 
device.
    Additionally, just as commenters requested legacy software to be 
excluded from the definition of covered software, other commenters 
requested BIS exclude legacy hardware, or ``as produced'' repairs, from 
the scope of the regulation. BIS rejects adding a legacy hardware 
exclusion because of the longevity of hardware and completed connected 
vehicles in general. As such, excluding hardware designed prior to the 
effective date of the prohibition but imported after the effective date 
from the scope of this regulation could result in national security 
risks emanating from such hardware for decades. BIS believes that 
setting the date in the prohibition for January 1, 2029, or model year 
2030 and allowing the import of parts meant for vehicles with a model 
year prior to 2030 provides a reasonable middle ground. Additionally, 
BIS assesses that inspecting hardware for embedded vulnerabilities is 
more burdensome than inspecting software for the same. Legacy hardware 
could contain persistent undetected vulnerabilities that would continue 
to enable potential access to or exploitation of vehicles or vehicle 
data that would be difficult or impossible to mitigate if scaled across 
a generation of vehicles. Conversely, regulated entities are more 
likely to discover such vulnerabilities in software during the 
continuous cycle of software development and testing, and have the 
means to patch those vulnerabilities across their fleets. BIS 
emphasizes that VCS hardware importers may engage in otherwise 
prohibited transactions so long as (1) the import of VCS hardware not 
associated with a vehicle model year prior to January 1, 2029, or (2) 
the import of VCS hardware is associated with a vehicle model year 
prior to 2030, the VCS hardware is imported as part of a connected 
vehicle with a model year prior to 2030, or the VCS hardware is 
imported for purposes of repair or warranty for a connected vehicle 
with a model year prior to 2030. BIS believes this is sufficient time 
to adjust VCS hardware supply chains, including for legacy VCS 
hardware.
    BIS defines VCS hardware to mean software-enabled or programmable 
components if they directly enable the function of VCS, or are part of 
an item that directly enables the function of VCS, including but not 
limited to: microcontroller, microcomputers or modules, systems on a 
chip, networking or telematics units, cellular modem/modules, Wi-Fi 
microcontrollers or modules, Bluetooth microcontrollers or modules, 
satellite communication systems, other wireless communication 
microcontrollers or modules, external antennas, digital signal 
processors, and field-programmable gate arrays. VCS hardware does not 
include component parts that do not contribute to the communication 
function of VCS hardware (e.g., brackets, fasteners, plastics, and 
passive electronics, diodes, field-effect transistors, and bipolar 
junction transistors).
    The representative list of VCS hardware included in its definition 
is not exhaustive but provides a bright line for certain examples where 
BIS would consider a component to be VCS hardware. BIS believes this 
definition appropriately identifies the various components, contained 
within a TCU or other connected systems of a connected vehicle, that 
facilitate off-board data transmission, and thus are most likely to 
pose the risks identified in Section IV.
21. VCS Hardware Importer
    In the NPRM, BIS proposed VCS hardware importer to mean a U.S. 
person importing VCS hardware for further manufacturing, integration, 
resale, or distribution. A connected vehicle manufacturer may be a VCS 
hardware importer if VCS hardware has already been installed in a 
connected vehicle when imported by the connected vehicle manufacturer. 
Commenters' feedback led BIS to provide a more specific definition in 
the final rule.
    Some commenters highlighted that the proposed rule's broad 
definition of both VCS hardware and VCS hardware importer would capture 
the import of components whose primary use is not automotive and thus 
cause severe ancillary effects on other industries. In response, BIS 
has clarified the definition of VCS hardware importer to include only 
those entities who are importing VCS hardware components that are for 
use in completed connected vehicles, or that are already incorporated 
in a connected vehicle (incomplete or completed). BIS further believes 
that the changes to the definition of VCS hardware provide additional 
clarity on this point.
    Other commenters requested that BIS codify its expectation that 
this definition would capture OEMs and tier one and tier two suppliers. 
While BIS anticipates that these will be the primary entities who are 
engaging in the import of VCS hardware components covered by this rule, 
BIS has opted not to specify this expectation in the rule text given 
the possibility that other entities may become involved in the import 
of VCS hardware. BIS emphasizes that parties may submit a request for 
an advisory opinion on a specific transaction if they are unsure if 
they qualify as a VCS hardware importer under the terms of this rule.
    BIS defines VCS hardware importer as a U.S. person who imports:
    (1) VCS hardware for further manufacturing, incorporation, or 
integration into a completed connected vehicle that is intended to be 
sold or operated in the United States; or
    (2) VCS hardware that has already been installed, incorporated, or 
integrated into a connected vehicle, or a subassembly thereof, that is 
intended

[[Page 5393]]

to be sold as part of a completed connected vehicle in the United 
States.
    BIS anticipates that this definition will primarily capture OEMs, 
tier one, and tier two suppliers importing VCS hardware into the United 
States. This definition also delineates that only entities importing 
VCS hardware with an intention of incorporating it into the U.S. 
automotive supply chain are subject to this regulation, rather than VCS 
hardware importers providing products to markets beside the auto 
industry.

b. Prohibitions on Certain Transactions Related to Connected Vehicles

    The NPRM proposed to prohibit three categories of transactions: 
prohibited VCS hardware transactions, prohibited covered software 
transactions, and related prohibited transactions (collectively 
described as prohibited transactions). In this section, BIS summarizes 
the prohibitions proposed in the NPRM and examines public comments on 
them. This final rule largely retains these same prohibitions, but in 
response to comments, BIS has added additional examples to provide more 
clarity for the scope of transactions that fall under this regulation. 
Many commenters also requested that BIS provide greater clarity 
regarding the definitions of VCS hardware, covered software, and 
foreign interest so that auto manufacturers can better understand what 
constitutes a prohibited transaction. Comments on these definitions as 
well as BIS's efforts to clarify these definitions are discussed above 
and should be considered in tandem with this discussion.
    In the NPRM, BIS proposed the following language identifying 
prohibited transactions. First, under prohibited VCS hardware 
transactions, the NPRM stated:

    (a) ``VCS hardware importers are prohibited from knowingly 
importing VCS hardware that is designed, developed, manufactured, or 
supplied by persons owned by, controlled by, or subject to the 
jurisdiction or direction of the PRC or Russia.''
    (b) ``In the context of this subpart, VCS hardware will not be 
considered to be designed, developed, manufactured, or supplied by 
persons owned by, controlled by, or subject to the jurisdiction or 
direction of the PRC or Russia, solely based on the country of 
citizenship of natural persons who are employed, contracted, or 
otherwise similarly engaged to participate in the design, 
development, manufacture, or supply of the VCS hardware.''

    Second, under prohibited covered software transactions, BIS 
proposed the following language:

    (a) ``Connected vehicle manufacturers are prohibited from 
knowingly importing into the United States completed connected 
vehicles that incorporate covered software, designed, developed, 
manufactured, or supplied by persons owned by, controlled by, or 
subject to the jurisdiction or direction of the PRC or Russia.''
    (b) ``Connected vehicle manufacturers are prohibited from 
knowingly selling in the United States completed connected vehicles 
that incorporate covered software, designed, developed, 
manufactured, or supplied by persons owned by, controlled by, or 
subject to the jurisdiction or direction of the PRC or Russia.''
    (c) ``In the context of this subpart, covered software will not 
be considered to be designed, developed, manufactured, or supplied 
by persons owned by, controlled by, or subject to the jurisdiction 
or direction of the PRC or Russia, solely based on the country of 
citizenship of natural persons who are employed, contracted, or 
otherwise similarly engaged to participate in the design, 
development, manufacture, or supply of the [c]overed [s]oftware.''

    Finally, BIS proposed the following language addressing related 
prohibited transactions:

    ``Connected vehicle manufacturers who are persons owned by, 
controlled by, or subject to the jurisdiction or direction of the 
PRC or Russia, are prohibited from knowingly selling in the United 
States completed connected vehicles that incorporate VCS hardware or 
covered software.''

    Multiple commenters requested that BIS provide clearer guidance on 
what constitutes a prohibited transaction, notably (1) to demonstrate 
the difference between ``design'' and ``develop'' (relevant to both the 
VCS hardware and the covered software prohibitions) and (2) to narrow 
the scope of the entity responsible for the ``design'' or 
``development'' of the item when multiple entities are involved in its 
creation. BIS acknowledges the need for clear guidance on what 
constitutes a prohibited transaction and has therefore in response to 
commenters included new examples in explaining the definitions above to 
clarify the scope of ``design and develop'' and the entities 
responsible.
    Several commenters voiced that BIS should narrow the scope of the 
prohibited transactions. For example, one commenter recommended that 
the covered software prohibition only apply prospectively and not to 
software developed prior to the effective date of the rule. Another 
commenter stated that BIS should exclude embedded software similar to 
firmware, while another commenter stated that BIS should amend its 
prohibitions to only prohibit the import of VCS hardware if it is 
integrated into a VCS or a completed connected vehicle. BIS appreciates 
these recommendations and has addressed them by clarifying the 
definitions of ADS, VCS, VCS hardware, and covered software, as 
described above.
    One commenter proposed narrowing the scope of prohibited 
transactions by adding an exemption to the prohibited transactions for 
OEMs physically manufacturing connected vehicles in the PRC and Russia 
if those OEMs met certain security standards such as the independent 
design of covered software and VCS hardware, verifiable hardware and 
software integrity, secure key and certificate management, and ongoing 
monitoring. BIS appreciates this recommendation and may utilize this 
suggestion when issuing specific authorizations, which are discussed in 
Section VI.c.3 below. However, BIS believes that such mitigations are 
more appropriately implemented and monitored on a case-by-case basis 
and therefore declines the suggestion for a blanket exemption.
    Other commenters recommended that BIS expand the scope of 
prohibited transactions to include BMS, vehicle charging equipment, 
connectivity apps, edge cloud architecture, and core ADS components to 
better protect national security. BIS regulates VCS and ADS based on 
feedback from the ANPRM that eliminates these other areas. For example, 
ANPRM comments emphasized that BMS do not have their own connectivity 
and require communication through a VCS, thereby making VCS a better 
system for mitigating the identified risks in this rule. BIS also 
recognizes that the traditional BMS does not have its own external 
wireless data link, which is why it rejects commenters' recommendation 
to include BMS at this time. An additional commenter stated that BIS 
should avoid ``politicization'' of technical issues and cancel all 
prohibitions against the PRC in the rule. BIS declines to make this 
change due to the national security risks discussed in Section IV 
above.
    One commenter requested that BIS clarify with regard to the 
preamble's ``potential regulatory statement'' that the prohibition on 
the sale of completed connected vehicles by connected vehicle 
manufacturers who are themselves owned by, controlled by, or subject to 
the jurisdiction or direction of the PRC or Russia (related prohibited 
transactions) applies only when the VCS hardware or covered software 
within the vehicle is designed, developed, manufactured, or supplied by 
persons owned by, controlled by, or subject to the jurisdiction or 
direction of the PRC or Russia. BIS has amended the rule to clarify 
that this prohibition applies to

[[Page 5394]]

all vehicles (with VCS hardware or covered software) sold by these 
connected vehicle manufacturers given the substantial national security 
risk posed by the provision of these completed connected vehicles by 
these entities.
    Some commenters asked whether ownership alone, regardless of the 
location of manufacturing or development, falls under this prohibition. 
Given the legal authorities laid out in Section IV and the threats 
stemming from those authorities, BIS assesses that a connected vehicle 
manufacturer that is owned by, controlled by, or subject to the 
jurisdiction or direction of the PRC or Russia creates an unacceptable 
risk. The risk applies even if manufacturing or design operations are 
located in the United States or other non-foreign adversary countries, 
and BIS assesses that the costs of reducing the risk are justified by 
the reduced risk to national security.
    One commenter suggested that ADS hardware should also be 
prohibited. This commenter suggested that the supply chain disruptions 
can be reduced by incorporating a phased implementation, where the 
prohibitions relating to ADS hardware could be modeled after the VCS 
hardware exemption. This commenter also emphasized that if ADS hardware 
is not included in the final rule, industry will have little incentive 
to develop and manufacture hardware in the United States, leaving the 
national security risk unmitigated. BIS declines to expand this 
regulation to prohibit ADS hardware at this time. Much of the hardware 
that supports or directly enables the ADS function, or that falls 
within the ADS item definition, are end point sensing devices or 
internal wired communication devices that often do not have external 
connectivity. For that reason, BIS maintains that regulating VCS 
hardware and ADS software is an appropriate means to mitigate the 
national security concerns at this time. BIS's decision not to include 
ADS hardware in this rule's prohibitions does not preclude BIS from 
addressing it in a subsequent rulemaking.
    BIS agrees with commenters' focus on the potential impacts of 
foreign adversary involvement in developing technology for autonomous 
vehicles and the degree to which PRC and Russian legal and regulatory 
environments inhibit the transparency that would be necessary to 
adequately ensure both public safety and U.S. national security. One 
commenter noted that the lack of data transparency required of PRC 
autonomous vehicle developers makes it particularly difficult for the 
public to assess their safety. BIS appreciates this feedback and notes 
its alignment with its own risk assessment.
    After reviewing and considering all of the comments, in this final 
rule, BIS has adopted prohibitions consistent with the NPRM: (1) VCS 
hardware importers are prohibited from knowingly importing into the 
United States any VCS hardware that is designed, developed, 
manufactured, or supplied by persons owned by, controlled by, or 
subject to the jurisdiction or direction of the PRC or Russia; (2) 
connected vehicle manufacturers are prohibited from knowingly selling 
within the United States, or importing into the United States, 
completed connected vehicles that incorporate covered software that is 
designed, developed, manufactured, or supplied by persons owned by, 
controlled by, or subject to the jurisdiction or direction of the PRC 
or Russia; and (3) connected vehicle manufacturers who are owned by, 
controlled by, or subject to the jurisdiction or direction of the PRC 
or Russia are also prohibited from knowingly selling in the United 
States completed connected vehicles that incorporate covered software 
or VCS hardware, regardless of whether such VCS hardware or covered 
software is designed, developed, manufactured, or supplied by persons 
owned by, controlled by, or subject to the jurisdiction or control of 
the PRC or Russia. These connected vehicle manufacturers are also 
prohibited from offering commercial services in the United States that 
utilize completed connected vehicles that incorporate ADS.
    Because of the role connected vehicle manufacturers play in the 
design and development of the key components in connected vehicles, 
which are generally built to the manufacturers' specifications, the 
third prohibition will often be duplicative of the other prohibitions 
in this final rule. However, as BIS intended in the NPRM and has 
clarified in this final rule, the third prohibition applies even if 
connected vehicle manufacturers who are owned by, controlled by, or 
subject to the jurisdiction or direction of the PRC or Russia were not 
involved in the design or development of the VCS hardware and covered 
software. Their sale of those completed connected vehicles constitutes 
the supply of VCS hardware and covered software and is thus captured by 
this prohibition. Additionally, in the NPRM, BIS intended to prohibit 
persons owned by, controlled by, or subject to the jurisdiction or 
direction of the PRC or Russia from integrating ADS onto otherwise 
completed connected vehicles and offering them for commercial services, 
to include rideshare or robotaxi services. For this reason, BIS 
included in the NPRM's definition of sale that ``distributing for . . . 
other commercial operations'' qualifies as a sale (even if it is not 
for purchase or lease). In order to provide greater clarity to 
regulated parties, BIS has chosen to explicitly state in the related 
prohibited transactions provision in section 791.304, that this rule 
prohibits connected vehicle manufacturers who are themselves owned by, 
controlled by, or subject to the jurisdiction or direction of the PRC 
or Russia from offering commercial services that utilize completed 
connected vehicles that incorporate ADS. BIS anticipates that this will 
include both robotaxi and rideshare services. BIS has added Example 41 
above to provide further clarity.
    As noted above, for the purposes of the final rule, BIS defines the 
term person owned by, controlled by, or subject to the jurisdiction or 
direction of a foreign adversary to mean (a) any person, wherever 
located, who acts as an agent, representative, or employee, or any 
person who acts in any other capacity at the order, request, or under 
the direction or control, of a foreign adversary or of a person whose 
activities are directly or indirectly supervised, directed, controlled, 
financed, or subsidized in whole or in majority part by a foreign 
adversary; (b) any person, wherever located, who is a citizen or 
resident of a foreign adversary or a country controlled by a foreign 
adversary, and is not a United States citizen or permanent resident of 
the United States; (c) any corporation, partnership, association, or 
other organization with a principal place of business in, headquartered 
in, incorporated in, or otherwise organized under the laws of a foreign 
adversary or a country controlled by a foreign adversary; or (d) any 
corporation, partnership, association, or other organization, wherever 
organized or doing business, that is owned or controlled by a foreign 
adversary, to include circumstances in which any person identified in 
paragraphs (a) through (c) possesses the power, direct or indirect, 
whether or not exercised, through the ownership of a majority or a 
dominant minority of the total outstanding voting interest in an 
entity, board representation, proxy voting, a special share, 
contractual arrangements, formal or informal arrangements to act in 
concert, or other means, to determine,

[[Page 5395]]

direct, or decide important matters affecting an entity.
    To provide further clarity regarding transactions involving VCS 
hardware and covered software that are prohibited, BIS has offered 
examples of persons owned by, controlled by, or subject to the 
jurisdiction or direction of the PRC and Russia in Section VI 
subsection (a) above. BIS incorporates the examples provided in the 
NPRM and has added several new examples to provide further 
illustration.

c. Compliance

1. Declaration of Conformity
    Declarations of Conformity will be a critical tool for advancing 
the goals of this final rule, and addressing the emergency declared in 
E.O. 13873 (section 791.306, ``General authorizations''). Through 
extensive engagement with connected vehicle manufacturers and 
automotive suppliers, BIS has come to understand that connected vehicle 
supply chains are complex and often opaque, with potentially hundreds 
of suppliers for a single connected vehicle in a given model year. 
Given the complexity, the vast number of parts, and the supply-chain 
opacity, BIS assesses there is a significant risk that VCS hardware and 
covered software that is designed, developed, manufactured, or supplied 
by persons owned by, controlled by, or subject to the jurisdiction or 
direction of foreign adversaries will be incorporated into connected 
vehicles if connected vehicle manufacturers do not conduct adequate 
supply chain due diligence or fail to prioritize and prevent the risks 
BIS has assessed. BIS considered whether to remove the Declarations of 
Conformity requirement and only require the submission of specific 
authorization applications for connected vehicles incorporating VCS 
hardware and covered software imported from PRC and Russia. However, 
BIS does not believe that this alternative adequately mitigates the 
risks identified in this rule. Foreign adversaries are not limited to 
operations within their geographical area and may obtain access to VCS 
and ADS supply chains through investment and participation in 
operations in a variety of foreign locations. Current customs and other 
supply chain reporting, which is focused on country of origin, creates 
a layer of opacity that can be exploited by adversaries to compromise 
connected vehicle components that can later be used to threaten United 
States persons and infrastructure. In other words, current practices 
for reporting supply chain due diligence do not prioritize the same 
national security focus required by this regulation.
    As BIS stated in the NPRM and as discussed in further detail below, 
based on extensive engagement with connected vehicle manufacturers and 
automotive suppliers, BIS assesses that connected vehicle supply chains 
often have significant numbers of suppliers for a single connected 
vehicle in a given model year. Connected vehicle manufacturers 
typically have strong relationships with their immediate suppliers, 
including the development of years-long supply contracts that span 
entire vehicle generations; however, their understanding of the deeper 
supply chain, such as who is supplying their suppliers (e.g., tier two, 
tier three) is substantially weaker. Additionally, BIS understands 
through industry engagement that although the COVID-19 pandemic and 
associated supply chain crisis forced connected vehicle manufacturers 
to critically evaluate their hardware supply chains, detailed knowledge 
of software supply chains remains largely unachieved. Even where it may 
exist, BIS cannot actively identify a specific supply chain compliance 
framework for the auto industry that requires due diligence on the 
national security risks in the auto market's supply chain. Such 
complexity and opacity, without a requirement to conduct the necessary 
due diligence, could result in the incorporation of VCS hardware and 
covered software that is designed, developed, manufactured, or supplied 
by persons owned by, controlled by, or subject to the jurisdiction or 
direction of foreign adversaries, into connected vehicles without the 
full knowledge of the connected vehicle manufacturer.
    Consequently, BIS believes that the requirement to submit annual 
Declarations of Conformity will serve as an important mechanism that 
will substantially reduce the risk of the current supply chain opacity 
by requiring enhanced due diligence into the auto market's supply chain 
through a specific national security lens. BIS requires VCS hardware 
importers and connected vehicle manufacturers to submit Declarations of 
Conformity to certify their compliance with this regulation, including 
their completion of due diligence requirements. BIS has considered 
whether, as an alternative, a recordkeeping approach could adequately 
address the national security risk posed by connected vehicle 
technology with a nexus to the PRC and Russia, but recordkeeping is a 
retroactive activity. It does not create an adequate incentive to 
change supply chain business practices to achieve the goals of this 
rule.
    If Declarations of Conformity were entirely replaced by a 
recordkeeping requirement, manufacturers may have to undergo recalls on 
parts that have already entered the supply chain. Automotive recalls 
are difficult to execute, with automakers traditionally struggling to 
reach a 100 percent completion rate on recalls due to various 
complications, including customer communication failures and the 
preowned vehicle market. If a recall fails to remove all of the 
vulnerable vehicles from the road, the national security threat will 
continue to persist. As such, the undue risks to national security 
would not be sufficiently mitigated without proactive due diligence 
requirements that deter the threat before it enters the U.S. supply 
chain, rather than reactive measures such as recordkeeping, reporting 
requirements, or unsatisfactory recalls by VCS hardware importers and 
covered vehicle manufacturers to secure their supply chains. At the 
same time, recalls would represent a source of unpredictability for 
automakers and suppliers, and this cost would likely be passed on to 
consumers. By contrast, requiring companies to submit Declarations of 
Conformity to the government will motivate them to conduct supply chain 
due diligence in order to make the required certifications. Because 
companies are conducting proactive due diligence, they will be able to 
detect prohibited components and mitigate risks before they enter the 
larger connected vehicle ecosystem.
    Given the national security risks posed by the ADS and VCS supply 
chains, BIS requires that industry actively participate in securing the 
supply chain. By requiring certifications in the Declaration of 
Conformity, BIS creates an incentive for industry to invest in supply 
chain review and assessment and to accelerate necessary changes to 
ensure each regulated entity achieves compliance. The act of requiring 
affirmative certification encourages the adoption of enhanced supply 
chain due diligence and begins the process of standardizing how 
industry will be required to respond to foreign adversary ICTS in the 
automotive supply chain. Public comments to the ANPRM and the NPRM and 
information conveyed in BIS's external engagements indicate that much 
of the industry does not factor national security issues into their 
supply chain operations. Ultimately, by requiring connected vehicle 
manufacturers and VCS hardware

[[Page 5396]]

importers to submit Declarations of Conformity, BIS ensures that 
parties subject to this final rule implement necessary procedures to 
fully understand their VCS hardware and covered software supply chains. 
Declarations of Conformity are an important tool in ensuring that 
parties subject to this final rule comply with the prohibitions on the 
incorporation of VCS hardware or covered software that has been 
designed, developed, manufactured, or supplied by persons owned by, 
controlled by, or subject to the jurisdiction or direction of the PRC 
or Russia.
    Apart from encouraging suppliers to re-examine their supply chains, 
the certification process will also help the U.S Government execute its 
responsibility to maintain the national security interests of the 
American people. Through requirements for recordkeeping and due 
diligence on the part of declarants, BIS will be able to obtain data 
which may not otherwise exist in a useable format without such 
requirements to verify Declarations of Conformity, such as 
documentation of the tiers of ICTS suppliers (section 791.312, 
``Recordkeeping'') (section 791.313, ``Reports to be furnished on 
demand''). BIS will further use such information to better inform and 
identify risks as they evolve within ADS and VCS supply chains. For 
example, if, through the verification process, BIS determines that a 
supplier has a nexus to foreign adversary, BIS can highlight to other 
companies that the supplier is prohibited by using an ``Is-Informed'' 
notice. Additionally, if a company previously acting under a 
Declaration of Conformity must, due to their own discovery of a change 
in circumstance, cease acting under a Declaration of Conformity, and 
instead submit an application for a specific authorization, BIS may, 
upon receipt of said specific authorization, be able to identify supply 
chain issues impacting other companies acting under a Declaration of 
Conformity. Receipt of Declarations of Conformity will also help BIS to 
spot trends in the importation of covered software and VCS hardware 
with a foreign interest into the U.S., which will allow BIS to 
appropriately analyze the hardware and software with the largest risk 
of evasion by prohibited companies. In sum, through receipt of 
Declarations of Conformity, BIS will be more capable of monitoring the 
pervasiveness of the risk and gain insight into any additional 
mitigation measures which may be required to secure the continuously 
evolving ICTS supply chain, as authorized by E.O. 13873.
    The information collected through Declarations of Conformity will 
be essential for BIS to effectively protect U.S. national security from 
the risks identified in this rule. BIS has generally found that 
research using publicly available data is often incapable of revealing 
whether a supplier has ties to the PRC or Russia. As BIS has detailed 
extensively in this rule, there are myriad ways in which an entity may 
be owned by, controlled by, or subject to the jurisdiction of a foreign 
adversary, and not all of these circumstances will be publicly 
disclosed. Additionally, regulated entities working directly in the 
sector will have a far more intimate understanding of the parties with 
whom they transact, another form of information which is often 
otherwise undisclosed. BIS will need access to both types of 
information in order to execute on the goals of this rule. As such, to 
ensure industry-wide compliance with this rule and maintain the 
understanding of the connected vehicle sector necessary to conduct 
enforcement, BIS will require companies to maintain such information, 
and submit said information in the case that it is otherwise 
unavailable. Without the Declaration of Conformity certifications, BIS 
will be unable to receive a fulsome picture of the regulated supply 
chain and relevant technologies, and it will be left with a needle-in-
a-haystack approach when assessing companies' compliance with this 
rule. Ultimately, the certification process will bring transparency to 
an opaque supply chain.
    In the proposed rule, BIS proposed including several reporting 
requirements for connected vehicle manufacturers, connected vehicle 
importers, and VCS hardware importers that submit Declarations of 
Conformity. These reporting requirements included, but were not limited 
to, submitting SBOMs and HBOMs and a list of third-party external 
endpoints to which the VCS hardware connects, including the country 
where each endpoint is located and the identity and location of the 
service provider, as applicable.
    After considering public comments, BIS has restructured the 
Declarations of Conformity requirement to clarify the certification, 
narrow the reporting requirements, and add recordkeeping elements. The 
final rule requires that Declarations of Conformity would be submitted 
in two instances by persons not engaged in prohibited transactions: (1) 
Declarations by entities engaged in VCS hardware transactions; and (2) 
Declarations by entities engaged in covered software transactions.
    Persons required to submit a Declaration of Conformity need to do 
so once per model year for units associated with a vehicle model year, 
or once per calendar year for units not associated with a vehicle model 
year, and only for the categories of transactions they seek to execute 
during that period. Several commenters voiced confusion and requested 
clarification on the timeline for Declarations of Conformity. BIS has 
extended the timeline for submitting updates to a Declaration of 
Conformity from 30 to 60 days.
    BIS further clarifies the certification statement that connected 
vehicle manufacturers and VCS hardware importers must make. BIS agrees 
that the use of terms like ``knowingly engaged,'' which is past tense, 
made the timing for submission of a Declaration of Conformity 
confusing. Therefore, BIS has adjusted the language to require a more 
straightforward certification: that the VCS hardware or covered 
software triggering the need for, and described in, the Declaration of 
Conformity was not designed, developed, manufactured, or supplied by 
persons owned by, controlled by, or subject to the jurisdiction or 
direction of the PRC or Russia.
    In the final rule, entities must submit to BIS the name and contact 
information of the VCS hardware importer or connected vehicle 
manufacturer, as well as additional information outlined in section 
791.305, based on whether the entity is engaging in a covered software 
or VCS hardware transaction. Entities must also certify to BIS that 
they have conducted due diligence into their supply chain and that 
their VCS hardware or covered software was not designed, developed, 
manufactured, or supplied by persons owned by, controlled by, or 
subject to the jurisdiction or direction of the PRC or Russia. Primary 
business records documenting these due diligence efforts, which may 
include the optional use of independent or hired third-party research 
(section 791.315, ``Third-party verification and assessments''), must 
be maintained by the declarant or a third-party and made available to 
BIS upon request. HBOMs and SBOMs are no longer required to be 
submitted as part of a Declaration of Conformity but can function as a 
method of recordkeeping.
    Several commenters expressed fundamental disagreement with BIS's 
proposed regulatory approach for connected vehicle supply chains. One 
commenter suggested that BIS adopt a framework like the NHTSA Federal 
Motor Vehicle Safety Standards (FMVSS), which allows companies to 
import restricted components provided

[[Page 5397]]

they conduct their own due diligence and risk analysis. NHTSA FMVSS 
establishes minimum performance requirements for manufacturers and the 
equipment used to make vehicles, prioritizing safety standards for 
drivers and passengers. BIS's concern with ADS and VCS technology is 
broader than that of public safety of drivers and passengers, but also 
addresses additional concerns, including national security risks posed 
by adversary countries, such as data exfiltration and remote access 
control that may compromise critical infrastructure. BIS does not 
believe that the NHTSA FMVSS provides a framework that is designed to 
address national security concerns, however, BIS has adopted some 
similar characteristics of this framework. For example, BIS may allow 
companies to import restricted components through specific 
authorizations if those companies show a certain degree of due 
diligence, risk analysis, and risk mitigation to minimize the threat 
present in otherwise prohibited ICTS.
    One commenter requested withdrawal of the use of the Declaration of 
Conformity in favor of a presumption of conformance, claiming that a 
presumption of conformance would reduce regulatory burden, address the 
national security risk, and remove potential hurdles to innovation 
posed by the NPRM. BIS rejects utilizing a presumption of conformance. 
The risks identified in this rulemaking are too great to rely solely on 
a presumption of conformance by commercial companies, which is only 
exacerbated by the opacity of the supply chain as discussed above. A 
presumption of conformance would also allow hardware and software to 
linger and remain in the U.S. ecosystem for a longer period of time as 
BIS would not have insight or confirmation of the existence of such 
hardware or software. Through receipt of declarants' certification 
regarding VCS hardware or covered software, that they have conducted 
due diligence to inform this certification, and that they, or a 
designated third party, maintain documentation related to this 
certification as part of their Declarations of Conformity, BIS will be 
able to more accurately and efficiently confirm and verify that no VCS 
hardware or covered software designed, developed, manufactured, or 
supplied by persons with a sufficient nexus to the PRC or Russia 
continues to operate in the United States.
    In the final rule, BIS has largely adopted a certification and 
recordkeeping approach in Declarations of Conformity that significantly 
lessens the burden on regulated entities. Entities can now certify to 
BIS that they have conducted due diligence into their covered software 
and VCS hardware supply chains without needing to submit such 
documentation to BIS. A recordkeeping requirement alone would not be 
sufficient to mitigate the identified risk because it would not create 
the incentive to change business processes to identify and address 
risks in their supply chains. Requiring certifications in Declarations 
of Conformity, on top of a recordkeeping requirement, creates an 
enforceable incentive for industry to invest in supply chain review and 
assessment thereby furthering mitigation of the risks identified in 
this rule.
    Commenters also requested that software traceability be included in 
the compliance requirements of this regulation. BIS believes that in 
order to determine compliance, entities regulated under this rule will 
be required to conduct the necessary software traceability as part of 
their supply chain due diligence. For example, in submitting a 
Declaration of Conformity, declarants are required to certify both that 
the covered software was not designed, developed, manufactured, or 
supplied by persons owned by, controlled by, or subject to the 
jurisdiction or direction of the PRC or Russia and that the declarant 
has conducted due diligence to inform its certification. If such due 
diligence determines that certain VCS hardware or covered software was 
designed, developed, manufactured, or supplied by a foreign adversary, 
such use of ICTS would be prohibited and the entity would need to apply 
for a specific authorization. Furthermore, an applicant for a specific 
authorization may be required to furnish additional information to BIS 
prior to the granting of a specific authorization, which may require 
applicants to conduct further due diligence into their software supply 
chain.
    Some commenters criticized the NPRM for being developed in 
isolation from other automobile trade actions taken by the U.S. 
government, suggesting that this lack of coordination prevents the 
streamlining of existing governmental processes related to the 
automotive industry. BIS emphasizes that the statement in the NPRM that 
one commenter referenced, which stated that the proposed rule was 
issued irrespective of other trade policies, does not mean to imply 
that this action was undertaken without coordination with other 
government agencies regulating vehicle safety or the trade of vehicles. 
Rather, BIS emphasizes that this regulation is being promulgated 
strictly on national security grounds that exist irrespective of 
specific trade policy surrounding connected vehicles, which do not 
adequately (or at all) address the national security risks articulated 
in this rule. BIS emphasizes that the ANPRM, the NPRM, and this final 
rule all underwent extensive interagency review and incorporated views 
of all other relevant Federal agencies. In addition, BIS met weekly 
with an interagency technical working group as part of its drafting 
process.
    Existing trade actions do not sufficiently address the national 
security risks identified by BIS in the connected vehicle supply chain. 
In response to commenters requesting that BIS clarify the role of 
coordinating agencies or other regulations, such as the FCC Covered 
List, BIS anticipates that it will continue closely collaborating with 
relevant government agencies including when adjudicating applications 
for specific authorizations or determining if and when updates to this 
rule are necessary. BIS emphasizes that regulated entities will be 
responsible for verifying compliance with all laws and regulations 
applicable to the transactions in which they seek to engage but may 
request an advisory opinion from BIS if unsure that a specific 
transaction is subject to the prohibitions of this rule.
    Commenters raised a series of concerns with the SBOM and HBOM 
requirements in the Declarations of Conformity requirement. Most of 
these concerns involved the ambiguity of the SBOM and HBOM requirements 
described in the NPRM and what should be included in these documents. 
Commenters argued that the NPRM's HBOM and SBOM requirements are overly 
burdensome, demanding both regulated entities and BIS to devote 
substantial resources to meet compliance. Commenters also wanted 
clarity on when companies would be required to submit an HBOM or SBOM, 
and for BIS to specify whether they would be required to do so every 
time an SBOM or HBOM changes. In response to comments, BIS is no longer 
requiring the submission of SBOMs and HBOMs in Declarations of 
Conformity. Entities will instead be required to certify to BIS that 
they have conducted due diligence in analyzing their VCS hardware and 
covered software supply chains and maintain documentation in support of 
this certification. The documentation may take the form of an SBOM or 
HBOM or another appropriate format. Entities must also certify that 
this documentation can be made available to BIS upon request.

[[Page 5398]]

    Commenters wanted BIS to describe how it will receive, store, 
protect, and use SBOMs and HBOMs. Commenters repeatedly raised concerns 
about the protections of sensitive proprietary information in 
Declarations of Conformity. Commenters argued that BIS is creating a 
heightened risk that hostile actors may attempt to exfiltrate sensitive 
technical specifications, software components, or system designs, 
leading to significant economic damage and undermining the global 
competitiveness of U.S. companies if BIS fails to adopt protective 
measures. Commenters often sought BIS assurance that their data will be 
protected and secured. Commenters recommended that BIS adopt strict 
access controls for submitted Declarations of Conformity, particularly 
those containing classified or sensitive proprietary information. These 
controls could include encryption of submissions, limiting access to 
authorized personnel only, and ensuring that proprietary information is 
not unnecessarily shared during any public disclosure or regulatory 
review processes. One commenter also requested that BIS delete CBI 
provided in support of a submission after a period of time.
    BIS acknowledges commenters' concerns related to the submission of 
sensitive information in the Declarations of Conformity. In response, 
BIS has limited the amount of sensitive information required as part of 
the submission by eliminating the requirement to submit SBOMs and 
HBOMs. BIS has also included a section in the rule (section 791.314, 
``Confidential Business Information'') dedicated to the submission of 
CBI, which would cover the submission of SBOMs or HBOMs if they were 
ever required for third-party verification purposes. Section 791.314 
outlines the confidentiality of information the same as in BIS 
regulation 15 CFR 791.102 including that information or documentary 
materials, not otherwise publicly or commercially available, submitted 
or filed with the Secretary under this part will not be released 
publicly except to the extent required by law. BIS declines the 
suggestion to delete CBI after a period of time, as such information 
may need to be referenced in future investigations due to evolving 
national security concerns.
    Tier one and tier two suppliers often explained that providing 
SBOMs and HBOMs to customers, such as OEMs, can potentially undermine 
their business value because it is equivalent to giving their 
proprietary information to their client. These suppliers would rather 
submit this information directly to BIS. In response to these comments, 
and apart from removing the mandatory submission of SBOMs and HBOMs as 
part of the Declaration of Conformity process, BIS has allowed 
connected vehicle manufacturers and VCS hardware importers to rely on 
third parties as part of their due diligence efforts. If BIS requires 
the submission of additional documentation in the verification of a 
Declaration of Conformity, suppliers would be allowed to submit the 
required documentation directly to BIS.
    Commenters offered ideas on how BIS could enact different models to 
limit the burdens imposed on both BIS and regulated entities, as well 
as ensure the protection of IP. A handful of commenters suggested 
implementing the NHTSA self-certification model requiring VCS hardware 
importers and connected vehicle manufacturers to produce and retain 
their Declarations of Conformity and provide them to BIS on an as-
needed basis. Commenters also suggested implementing other attestation 
or self-certification programs, including those that could be modeled 
by Federal agencies, such as U.S. Customs and Border Protection's 
Certifications of Origin template or the Food and Drug Administration's 
Importation of Electronic Products declarations. One commenter in 
particular emphasized that the adoption of these methods would create a 
streamlined self-certification compliance process that eases production 
burdens on regulated entities and allows BIS to focus on monitoring for 
prohibited transactions, rather than processing and maintaining a 
substantial amount of information through Declarations of Conformity 
that may not provide meaningful data. As described above, BIS 
determined that relying entirely on a self-certification system for 
Declarations of Conformity would be insufficient given the nature of 
the national security risk and these self-certification models. Self-
certification would not give BIS the visibility that Declarations of 
Conformity provide to track and monitor the connected vehicle supply 
chain industry, specifically as it relates to the timeliness of 
identifying potential violations of this rule and the actions BIS would 
need to take to remedy a national security issue stemming from 
prohibited covered software or VCS hardware that has entered the U.S. 
supply chain.
    Commenters suggested other ways of narrowing the scope of the 
Declaration to be less burdensome on regulated entities. For instance, 
some commenters recommended that BIS change the requirement to submit a 
Declaration of Conformity for every model year. While it has not 
removed the requirement to submit a Declaration of Conformity every 
model year, BIS has updated the Declaration of Conformity submission 
requirements to be less burdensome on regulated entities by allowing 
declarants to submit a confirmation that a prior Declaration of 
Conformity remains accurate in lieu of submitting a new Declaration of 
Conformity. Some commenters also requested BIS allow regulated entities 
to rely on statements, attestations, or affirmations from suppliers 
regarding the origins of components and software so as to limit 
reporting requirements and ensure that tiered suppliers did not have to 
share their intellectual property with their customers. Based on 
comments, BIS will allow connected vehicle manufacturers to rely on 
their suppliers' submissions of supply chain information to BIS, if an 
agreement between the connected vehicle manufacturer and supplier 
permits such sharing of information. Commenters suggested that entities 
should be able to simply provide a comprehensive list of all imported 
VCS and ADS fleet-wide for a given model year. BIS accepts this 
suggestion as the Declaration of Conformity procedures would allow for 
connected vehicle manufacturers or VCS hardware importers to submit a 
single comprehensive submission. Other commenters strongly recommended 
that BIS abandon the universal submissions requirements of SBOM and 
HBOM and instead require them only in the event of an investigation or 
audit. BIS acknowledges commenters' feedback, and in response has 
adjusted SBOM and HBOM submission requirements. BIS accommodates the 
requests to forego the submissions of HBOMs, SBOMs, and other 
proprietary information, and rely more on a certification-based model 
as commenters suggested.
    As such, for the purposes of submitting a Declaration of 
Conformity, BIS has clarified that a certification is a written 
statement or attestation, made in relation to section 791.305(a) of 
this rule, to the U.S. Government, signed by a duly authorized 
designee, certifying under the penalties provided in 18 U.S.C. 1001, 
that the information provided is accurate and complete in all material 
respects to the best knowledge of the designee on behalf of the entity 
filing the Declaration of Conformity. BIS further clarified that for 
the purposes of a Declaration of Conformity, a duly authorized designee 
is:
    (i) In the case of a partnership, any general partner thereof;

[[Page 5399]]

    (ii) In the case of a corporation, the chief executive officer, or 
any officer with the authority to bind the corporation;
    (iii) An employee with authority to make certifications on behalf 
of the company as designated by a person in (i) or (ii); and
    (iv) In the case of an entity lacking partners and officers, any 
individual manager, or designated agent who has been explicitly 
authorized by the board of directors or equivalent to sign contracts 
and make legally binding agreements on behalf of the entity.
    BIS concluded that this approach provides the declarant with clear 
instructions as to who may make certifications as part of Declarations 
of Conformity. While the requirements for a certification have certain 
guidelines, BIS has still provided companies with flexibility to 
internally determine who may make these statements. BIS acknowledges 
that adopting a more certification-based model for Declarations of 
Conformity, as commenters suggested, requires an increased level of 
trust in such certifications on the part of BIS. BIS's guidelines as to 
who can make a certification ensures that only duly authorized 
individuals can attest to an entity's compliance and that supply chain 
security is a priority within the connected vehicle industry.
    BIS has additionally allowed for connected vehicle manufacturers 
and VCS hardware importers to rely on third parties as part of their 
due diligence requirements for a Declaration of Conformity. This could 
include a VCS hardware importer or connected vehicle manufacturer 
relying on assessments from suppliers, provided that they have arranged 
for suppliers to furnish documentation and third-party assessments (as 
applicable) to BIS upon request. Further, BIS confirms that the 
Declaration of Conformity requirement will be satisfied by VCS hardware 
importers and connected vehicle manufacturers who submit a compiled 
Declaration of Conformity that covers the covered entity's entire fleet 
for the given model year, so long as it appropriately identifies the 
minimum required information (including, without limitation, the FCC ID 
Number of the hardware, if known, and the makes, models, and trims of 
vehicles covered by the Declaration of Conformity).
    Commenters raised concerns about the efficiency of the compliance 
process and provided solutions to promote processing in a timely 
manner. Commenters suggested that Declarations of Conformity be 
replaced with dialogue between BIS and entities subject to regulation. 
Another commenter urged BIS to consider clarifying the applicability of 
the Declaration of Conformity requirement for import purposes in order 
to avoid a huge surge in advisory opinion requests, particularly for 
importers. To help with expediency, one commenter recommended that BIS 
use best-in-class documentation and verification standards to ensure 
that submission of compliance materials does not hinder the pace of 
commerce. This commenter also suggested that BIS allow companies to 
digitally present import and compliance documentation proactively via 
their due diligence processes. BIS took these comments under 
consideration when re-assessing the requirements in the Declarations of 
Conformity. While BIS did not accept all of the commenter's 
suggestions, BIS believes that the updated Declaration of Conformity 
provisions and clarifications in the final rule will increase the 
rule's efficiency. BIS believes that the Declaration of Conformity 
requirement will be integral to the expedient administration of this 
rule because it will incentivize industry compliance and help BIS 
administer this rule when reviewing industry compliance.
    Commenters advised BIS to reconsider the timeline submission 
requirements of Declarations of Conformity. Many commenters advised 
increasing the Declaration of Conformity submission deadline from 30 
days to 60 days to provide manufacturers and importers adequate time to 
prepare, verify, and submit updates. Another commenter requested more 
details on the timeline required for regulated entities to submit their 
initial Declarations of Conformity, urging BIS to provide more time for 
entities to initially review their supply chains. Commenters also 
recommended that BIS clarify that manufacturers or importers must 
submit amended Declarations of Conformity within 30 days if they 
discover errors, omissions, or other issues in previously submitted 
documents. BIS acknowledges commenters' concerns and has increased the 
submission deadline for Declarations of Conformity to 60 days in all 
instances. Connected vehicle manufacturers and VCS hardware importers 
must submit digital documentation of their compliance at least 60 days 
prior to the first import or first sale of each model year of a 
completed connected vehicle that incorporates covered software and the 
first import of VCS hardware for each model year or calendar year, as 
applicable.
    Commenters provided feedback on the ``material'' change 
requirements of Declarations of Conformity. Comments included 
conflicting opinions on when industry should be responsible for 
providing an updated Declaration of Conformity. One commenter requested 
that material changes be limited to the first submission because 
hardware can be used for several different makes, models, and trims. 
Another commenter suggested that a material change submission should 
require an updated Declaration of Conformity within 60 days. Several 
commenters suggested that BIS remove the requirement for annual 
certification and instead only require recertification if there is a 
material change to the model year. Separate from this, another 
commenter identified that the NPRM placed no limit on how far into the 
future automakers will have to declare material changes, suggesting 
that material changes be limited to 10 years to align with the document 
retention limit. One commenter also advised that BIS clarify when the 
material change clock starts, specifying it to be when the declarant 
first knows of the material change. More broadly, commenters urged BIS 
to define ``material'' change and provide examples.
    BIS has clarified the scope of a ``material'' change, which is 
limited to the ``discovery, by the declarant, of an omission, 
inaccuracy, or error in the information provided to the Department in a 
prior Declaration of Conformity that could reasonably mislead as to the 
true source of VCS hardware or covered software in question.'' BIS 
accepts the suggestion that connected vehicle manufacturers and VCS 
hardware importers must notify BIS of any material change to the 
information conveyed in a previously submitted Declaration of 
Conformity by submitting a revised Declaration of Conformity within 60 
days following the discovery of such change. BIS clarifies that covered 
software updates alone do not constitute a material change. BIS 
declines to remove the annual certification requirements for 
Declarations of Conformity as the information certified in an annual 
certification is more robust than that considered to be a ``material'' 
change. However, BIS confirms that connected vehicle manufacturers and 
VCS hardware importers may submit a confirmation that a prior 
Declaration of Conformity remains accurate by associating the relevant 
new model year of vehicles (if known) to an existing Declaration of 
Conformity. In addition,

[[Page 5400]]

BIS confirms that the declarant's obligation to inform BIS of material 
changes to the information on which a Declaration of Conformity depends 
ceases 10 years after submission of the original Declaration of 
Conformity for that model year or calendar year.
    Commenters also respectfully questioned whether a 10-year retention 
requirement for Declarations of Conformity is reasonable, appropriate, 
or practicable for the connected vehicle industry given that rate of 
technological advancement, ultimately recommending a shorter retention 
period. One commenter suggested to require only keeping records that 
would be retained in a normal course of the business. BIS declines to 
adjust the 10-year recordkeeping requirement so as to maintain 
consistency with the statute of limitations clause of IEEPA. 
Additionally, BIS understands that the connected vehicle industry 
generally maintains a minimum standard of 10-year spare parts 
availability. As such, BIS believes the 10-year recordkeeping 
requirement contained in this rule represents a relatively small 
additional burden to the industry. BIS agrees with the commenter's 
request to narrow the scope of recordkeeping to primary business 
records and has modified the final rule accordingly.
    Commenters shed light on a handful of other areas of improvement 
for the Declarations of Conformity. For example, one commenter 
requested that an incorrectly submitted Declaration of Conformity in 
good faith should not be considered a ``violation'' and should be 
excluded from the penalties listed in the BIS proposed rule. BIS 
acknowledges commenters' concerns and would advise commenters to review 
section 791.305(k) which subjects any person who submits false 
information in a Declaration of Conformity, with knowledge that such 
information is false, and engages in a prohibited transaction, to 
potential penalties. Furthermore, in response to commenters, BIS has 
provided an opportunity for connected vehicle manufacturers and VCS 
hardware importers who incorrectly submit a Declaration of Conformity 
in good faith to submit an updated Declaration of Conformity to BIS 
within 60 days of discovery of an error or omission in a previously 
submitted Declaration of Conformity.
    Other commenters highlighted a contradiction between the NPRM's 
discussion text and its regulation text about third-party research 
requirements. Commenters provided several examples of text to update 
this language. BIS appreciates this notification and has adjusted the 
discussion and regulation text to indicate that the use of third-party 
research is not required but may be used by declarants to fulfill due 
diligence requirements as part of the submission of a Declaration of 
Conformity.
    Commenters also pointed out that requiring importers and 
manufacturers to record all third-party external endpoints that VCS 
hardware connects is not possible because these connection points are 
inherently in the control of third parties, such as app providers. 
Further, to limit third-party external endpoints in order to create a 
complete list, VCS hardware manufacturers would need to develop and 
operate completely closed ecosystems, which is inconsistent with 
consumer demand. Ultimately, commenters recommend that BIS delete the 
requirement to record all third-party external endpoints or narrow the 
information requested to that which is in the possession and control of 
the VCS hardware manufacturer or importer. BIS agrees with these 
commenters and has removed reporting requirements related to external 
endpoints from the final rule.
    Commenters urged BIS to consider how it could streamline the 
approach for tier one, tier two, tier three, and below suppliers. One 
commenter recommended that BIS provide guidance on establishing a 
shared responsibility framework, making tier one and tier two suppliers 
equally accountable for compliance of their components in order to 
accelerate due diligence efforts. Another commenter advised that BIS 
form a volunteer certification process for VCS hardware suppliers to 
help streamline the process of compliance at the OEM level. Another 
commenter suggested that BIS provide additional clarity on how OEMs 
should interface with tier three suppliers and below, which was not 
contemplated in the NPRM. In an effort to create a semi-shared 
responsibility framework, BIS has allowed connected vehicle 
manufacturers and VCS hardware importers to rely on third-party 
assessments (including assessments from suppliers) as a part of the due 
diligence requirements for the submission of a Declaration of 
Conformity. If declarants rely on assessments from suppliers, 
declarants must certify that they have taken all possible measures, 
either contractually or otherwise, to ensure any necessary 
documentation and assessments from suppliers will be furnished to BIS 
upon request either by the declarant, or, in cases including CBI, 
directly by the supplier. BIS declines to create a volunteer 
certification process for VCS hardware suppliers at this time but may 
consider issuing a general authorization at a later date if applicable. 
With regard to interfacing with tier three suppliers and below, BIS 
declines to prescribe the nature by which OEMs conduct the required due 
diligence to allow each regulated entity the flexibility to align with 
their unique business model.
    As noted above, one commenter argued that BIS's broad definition of 
foreign interest would mean that a publicly traded company with some 
foreign shareholders would be required to submit a Declaration of 
Conformity. As explained above, BIS does not intend for every publicly 
traded company with minority foreign shareholders who do not affect 
management or control over the company to submit Declarations of 
Conformity if no other foreign interest exists. Therefore, BIS has 
created an exemption to the Declarations of Conformity requirement in 
section 791.305(l) for circumstances where the only foreign interest 
arises when a foreign person owns equity of a public company but does 
not affect the company's management or control.
    One commenter sought clarification on whether the NPRM requires 
that all OEMs must prepare and submit a Declaration of Conformity even 
when no foreign interest is involved. BIS clarifies that if VCS 
hardware or the addition of covered software to a completed connected 
vehicle involves components in which there is no foreign interest, then 
it would not fall within the scope of this rule. However, if there is a 
foreign interest in that VCS hardware or covered software transaction, 
then it would require a Declaration of Conformity or specific 
authorization.
    1. The sections below explain in greater detail the types of 
Declaration of Conformity that are required under the final rule.
i. VCS Hardware
    The Declarations of Conformity described in section 791.305(a)(1) 
require VCS hardware importers to provide information on the specific 
VCS hardware that the declarant plans to import into the United States 
for a given model year, or, for units not associated with a model year, 
a given calendar year. FCC regulations at 47 CFR 2.925 require any 
electronic device that emits RF waves, including those imported into 
the United States, to have an FCC ID number. The FCC ID is used to 
identify and certify that the device meets the necessary regulatory 
standards for wireless communication. BIS will require the Declaration 
of Conformity to contain the FCC ID

[[Page 5401]]

number(s) of the VCS hardware if known. BIS will also require the 
Declaration of Conformity to list any subcomponents in the VCS hardware 
that also have an FCC ID number if applicable. The final rule 
additionally requires VCS hardware importers to provide the make and 
model of the connected vehicle(s) for which the VCS hardware is 
intended or already integrated, if known. The VCS hardware importer 
submitting a Declaration of Conformity must certify that the VCS 
hardware was not designed, developed, manufactured, or supplied by 
persons owned by, controlled by, or subject to the jurisdiction or 
direction of the PRC or Russia, has conducted due diligence (with or 
without the use of third-party assessments), and maintains any 
supporting documentation (either through an HBOM or otherwise) and 
third-party assessments (as applicable). Declarants must also specify 
who maintains the supporting documentation or assessments and certify 
that the declarant has arranged for suppliers to furnish any 
documentation or third-party assessments upon request by BIS.
ii. Covered Software
    The Declarations of Conformity described in section 791.305(a)(2) 
applies to connected vehicle manufacturers that import or sell 
completed connected vehicles in the United States that incorporate 
covered software, including U.S.-based OEMs and foreign-headquartered 
OEMs with operations in the United States. Section 791.305(a)(2) 
requires covered entities to provide information to BIS on the make, 
model, trim, and Vehicle Identification Number (VIN) series applicable 
to the completed connected vehicles that incorporate covered software. 
Persons submitting a Declaration of Conformity for covered software 
must certify that the covered software was not designed, developed, 
manufactured, or supplied by persons owned by, controlled by, or 
subject to the jurisdiction or direction of the PRC or Russia, has 
conducted due diligence (with or without the use of third-party 
assessments), and maintains any supporting documentation (either 
through an SBOM or otherwise) and third-party assessments (as 
applicable). Declarants must also specify who maintains the supporting 
documentation or assessments and certify that the declarant has 
authorized suppliers to furnish any documentation or third-party 
assessments upon request by BIS.
iii. Procedures To Submit Declarations of Conformity
    The NPRM contemplated that VCS hardware importers and connected 
vehicle manufacturers submitting a Declaration of Conformity would be 
required to submit the Declaration of Conformity to BIS annually, 60 
days prior to the first sale or first import of a VIN series of 
completed connected vehicles comprised of a single model year, or 60 
days prior to the import of VCS hardware covered by the Declaration of 
Conformity. The NPRM also provided that VCS hardware importers and 
connected vehicle manufacturers may, at their discretion, submit a 
combined Declaration of Conformity, or may submit separate Declarations 
of Conformity (e.g., one Declaration covering import of VCS hardware 
and another covering import of completed connected vehicles). 
Declarations of Conformity covering both the import or manufacture of 
completed connected vehicles and the import of VCS hardware should be 
submitted by the earlier of the two reporting dates. Additionally, the 
NPRM stipulated that in the event of material changes that impact the 
content of the Declaration of Conformity, VCS hardware importers or 
connected vehicle manufacturers would be required to submit an updated 
Declaration of Conformity and an updated HBOM or SBOM within 30 days of 
such a change.
    The final rule provides that connected vehicle manufacturers shall 
submit a Declaration of Conformity at least 60 days prior to the first 
import or first sale of each model year of completed connected vehicle 
that incorporates covered software. VCS hardware importers shall submit 
a Declaration of Conformity at least 60 days prior to the first import 
of VCS hardware for each model year for units associated with a vehicle 
model year, or calendar year for units not associated with a vehicle 
model year. BIS has chosen not to stipulate combined versus individual 
Declaration of Conformity submissions if an entity engages in both 
covered software and VCS hardware transactions at this time, but 
entities may do so if they choose for submission efficiency. The final 
rule also clarifies that connected vehicle manufacturers and VCS 
hardware importers must notify BIS of any material change to the 
information conveyed in a previously submitted Declaration of 
Conformity by submitting a revised Declaration of Conformity within 60 
days following the discovery of such change. A declarant's obligation 
to inform BIS of material changes to a Declaration of Conformity ceases 
10 years after the original submission. The final rule defines 
``material changes'' as any omissions, inaccuracies, or errors in the 
information provided to BIS in a prior Declaration of Conformity that 
could reasonably mislead as the true source of VCS hardware or 
connected software in question. Additionally, the final rule stipulates 
that, in lieu of submitting a new Declaration of Conformity, a 
declarant may, if applicable, submit a confirmation that an existing 
Declaration of Conformity remains accurate and encompasses relevant new 
model year of vehicles (if known). Declarants shall follow the 
electronic filing instructions on BIS's website.
2. General Authorizations
    In the NPRM, BIS provided for four general authorizations, which 
would have allowed VCS hardware importers and connected vehicle 
manufacturers to engage in otherwise prohibited transactions in certain 
low risk use cases without need to notify BIS. These general 
authorizations would have applied if (1) the connected vehicle 
manufacturer or VCS hardware importer produced fewer than 1,000 
connected vehicles or VCS hardware units; (2) the completed connected 
vehicle was used on public roadways for fewer than 30 calendar days in 
a year; (3) the completed connected vehicle or VCS hardware was used 
solely for purposes of display, testing, or research; or (4) the 
completed connected vehicle was imported solely for repair, alteration, 
or competition off public roads and would have been exported within one 
year of import. Persons availing themselves of a general authorization, 
while not required to notify BIS, would have been required to monitor 
their usage of the authorization for any change in use and would have 
been subject to audit and inspection by BIS. VCS hardware importers and 
connected vehicle manufacturers who were themselves owned by, 
controlled by, or subject to the jurisdiction or direction of the PRC 
or Russia would have been ineligible for a general authorization.
    Commenters nearly universally supported BIS's decision to include a 
provision for general authorizations while raising a variety of 
concerns or suggestions related to general authorizations, which are 
discussed below. However, it is important to note that in this final 
rule, BIS has amended the provision to allow BIS to issue general 
authorizations on its website and in the Federal Register, rather than 
provide for predetermined general authorizations in this rule. Several

[[Page 5402]]

commenters encouraged BIS to consider issuing more general 
authorizations, including to consider issuing general authorizations 
for connected vehicle manufacturers who meet a certain set of robust 
security standards to mitigate the national security risks described in 
this notice. BIS's decision to provide for the issuance of general 
authorizations as and when it determines, rather than enumerate four 
specifying categories of general authorizations in this rule, will 
enable BIS to more nimbly and quickly issue general authorizations as 
appropriate, without the need for a lengthy rulemaking process to issue 
or amend such general authorizations. BIS anticipates that it will 
issue a set of general authorizations shortly after publication of this 
rule that align with the general authorizations outlined in the NPRM. 
This will include general authorizations for small businesses; for 
connected vehicles used infrequently on public roads; for display, 
testing, or research purposes; and for repair, alteration, or 
competition.
    The following is a summary of public comments received regarding 
the general authorizations provisions and BIS's response.
    Commenters urged BIS to raise the cap for the small business 
general authorization from 1,000 vehicles or units to 5,000 vehicles or 
units in order to align with other regulatory authorities. BIS 
acknowledges that differing standards exist across regulation and 
legislation that define small manufacturers. BIS is continuing to 
consider this threshold but anticipates that it will retain the 1,000-
vehicle threshold because this aligns with the high-volume manufacturer 
definition found in Vehicle Identification Number (VIN) requirements in 
49 CFR 565. BIS emphasizes that this general authorization threshold 
will apply to U.S. production, not global production. BIS anticipates 
that it will limit this general authorization to all entities under 
common control so as to prevent the misuse of this general 
authorization by numerous subsidiaries of a single entity that are 
purpose-built to circumvent the prohibitions of this rule. Some 
commenters urged BIS to clarify that vehicles assembled in the United 
States for export to foreign markets qualify for a general 
authorization. BIS does not intend for this rule to capture vehicles 
manufactured exclusively for export outside of the United States and 
anticipates that it will issue a general authorization to this effect 
shortly after publication of this rule. One commenter recommended that 
BIS implement a general authorization for re-imported hardware. The 
commenter highlighted that the prohibitions could capture hardware that 
is manufactured in the United States, exported abroad to locations 
other than the PRC or Russia for integration, and then imported back 
into the United States. BIS does not anticipate that it will institute 
a general authorization to this effect as it believes that such a 
transaction is already permitted under the terms of the rule. In this 
scenario, the supply chains in question ``do not involve the PRC or 
Russia,'' as the commenter noted. In this scenario, products are not 
designed, developed, manufactured or supplied by persons owned by, 
controlled by, or subject to the jurisdiction or direction of the PRC 
or Russia, and thus are permitted. Further, this final rule 
substantially reduces the burden of submitting Declarations of 
Conformity for imported VCS hardware, so BIS believes that BIS's 
decision to decline to add this general authorization will not 
negatively affect the manufacture of VCS hardware in the United States 
that is later reimported. Another commenter requested BIS add a general 
authorization exempting hardware ``for general communications 
purposes'' that is ``not integrated into a VCS.'' BIS believes that 
modifications of the terms VCS and VCS hardware eliminate the need for 
this general authorization, as the revisions clarify that hardware that 
does not ``directly enable'' VCS, is not destined for VCS, or is not 
already incorporated in VCS is not captured by the rule.
    Commenters identified challenges with the software prohibition 
timeline (discussed below). To remedy this challenge, commenters 
recommend that BIS provide time-limited general authorization for its 
software prohibition. Given that BIS has amended the definition of 
covered software to exclude software developed prior to one year 
following the effective date of this rule, BIS believes such a general 
authorization to be unnecessary at this time.
    General authorizations allow certain VCS hardware importers and 
connected vehicle manufacturers to engage in otherwise prohibited 
transactions without the need to notify BIS prior to engaging in the 
transaction. When issuing a general authorization, BIS will publish 
this decision on its website (https://www.bis.gov/OICTS) and will also 
publish the decision in the Federal Register. Notices regarding 
individual general authorizations may contain specific instructions 
that persons must follow if they wish to avail themselves of a general 
authorization, which could include filing regular reports with BIS 
regarding their use of the general authorization. However, BIS 
anticipates that most general authorizations will not require reports 
to BIS. Under the amended provisions for general authorizations, VCS 
hardware importers and connected vehicle manufacturers availing 
themselves of general authorizations must monitor their use of such 
authorizations, and, within 30 days of discovering a change in 
circumstance, conduct an inquiry as to if the general authorization 
still applies. Should the importer or manufacturer determine the 
general authorization no longer applies, it must, within an additional 
30 days, cease all prohibited conduct and submit a report to BIS 
detailing the incident and proposing remediation.
    BIS may, at its discretion, contact VCS hardware importers or 
connected vehicle manufacturers to determine if the party is availing 
itself of a general authorization. If the party confirms that it is 
indeed availing itself of one or more general authorizations, BIS 
reserves the right to request documentation to verify compliance with 
these provisions. Such documents would include the primary 
documentation upon which the VCS hardware importer or connected vehicle 
manufacturer has relied to determine that it is eligible (and has 
remained eligible) for the general authorization(s). For more 
information, see ``Reports to be furnished on demand.''
    A connected vehicle manufacturer or VCS hardware importer that is a 
subsidiary, joint venture, affiliate, or other entity subject to the 
ownership, control, jurisdiction, or direction of the PRC or Russia 
would be ineligible for general authorizations and is required to apply 
for a specific authorization before engaging in an otherwise prohibited 
transaction.
3. Specific Authorizations
    In the NPRM, BIS proposed a specific authorization process by which 
VCS hardware importers and connected vehicle manufacturers could apply 
to engage in an otherwise prohibited transaction. Commenters provided a 
variety of feedback on the specific authorization criteria. One 
commenter suggested that BIS specify requirements for conducting proof 
of concept testing in the United States with Chinese network access 
device technologies only available from the PRC. Multiple commenters 
recommended that BIS consider utilizing industry or government 
standards and frameworks when granting specific authorizations. These 
recommended standards include NIST standards, the ISO/SAE 21434 
Standard, UNR155, the ``Proposal for

[[Page 5403]]

Recommendations on Uniform Provisions Concerning Cyber Security and 
Software Updates'' by the World Forum for Harmonization of Vehicle 
Regulations in April 2026, and the Multiple Independent Levels of 
Security (MILS) standards. Although not within the scope of the NPRM, 
one commenter recommended that BIS develop standards with NIST for 
vehicle to cloud interfaces and incorporate this as part of the 
specific authorizations process. BIS agrees with commenters that 
standards and assessments should be considered when reviewing specific 
authorization applications. In the final rule, BIS lists several 
examples of documentation that could be used to support the information 
contained in a specific authorization application, including the ISO/
SAE 21434 Threat Analysis and Risk Assessments. However, BIS intends to 
leave the documentation that can be used to support the information 
contained in a specific authorization application broad to give 
applicants flexibility in how they wish to support their application.
    Commenters recommended different forms of preclearance procedure to 
ensure auto manufacturers and suppliers have advance approval for the 
use of certain covered software. One commenter recommended that BIS 
establish a process for companies to obtain preclearance for certain 
covered software items, such as base code that is not specifically 
designed or developed for automotive applications. In addition to 
allowing preclearance with respect to certain covered software, BIS 
could require companies seeking preclearance to meet specified 
cybersecurity standards and risk mitigation measures specific to 
ensuring the integrity of the relevant code, including third-party 
vulnerability testing as applicable. Another commenter suggested that 
this preclearance could replace specific authorizations for companies 
that demonstrate that they meet the provided preclearance requirements. 
BIS appreciates these recommendations but finds conducting a case-by-
case review to be a more effective method of risk management. BIS 
notes, however, that VCS hardware importer or connected vehicle 
manufacturers may request an advisory opinion that may inform a 
specific authorization at any time in accordance with section 791.310 
and may apply for a specific authorization as early as sufficient 
information is known to fulfill the requirements of section 791.307. 
BIS also retains the right to issue a general authorization at a later 
date.
    Multiple commenters urged BIS to establish with more clarity as to 
how frequently specific authorizations must be submitted. In response, 
specific authorizations will generally be approved for a duration of no 
less than one (1) model year or calendar year. At the time of issuance, 
BIS will advise specific authorization applicants the duration of any 
approved specific authorizations. BIS clarifies that in situations in 
which BIS may make an exception to approve a specific authorization for 
less than one (1) model or calendar year such as for model years that 
are actively being sold or imported as of the effective date of the 
rule, for situations in which supply chains are affected by force 
majeure events, or due to an unexpected change in the supply chain 
during model year production. BIS believes these exceptions will allow 
companies to continue to operate while a long-term solution is pursued. 
BIS anticipates that each specific authorization granted under an 
exception will be superseded by a more permanent and long-term specific 
authorization.
    Commenters asked that BIS be more transparent about its specific 
authorization procedures, such as its approach to public disclosure and 
preferential status. In response to these comments BIS has indicated 
that it will not publicly disclose any approved specific 
authorizations. With regards to commenters' request for preferential 
status to auto manufacturers headquartered in, incorporated in, or 
otherwise organized under the laws of an allied country, BIS believes 
that granting this preferential status will not limit the risk posed by 
foreign adversaries that are intertwined within supply chains. 
Therefore, BIS will not provide preferential treatment to companies on 
the sole basis of being headquartered in, incorporated in, or otherwise 
organized under the laws of a non-foreign adversary.
    Another commenter argued that BIS should also include a mechanism 
for an emergency authorization such as in cases of supply chain 
disruption, natural disaster, or other temporary emergencies. BIS has 
accepted this feedback and incorporated it into the regulation text, 
allowing for the ability to grant exceptions to the default minimum 
one-year specific authorization and for durations of less than one year 
in response to force majeure events. BIS believes this change will 
allow companies to continue to operate while a long-term solution is 
pursued. BIS anticipates that each specific authorization granted under 
an exception will be superseded by a more permanent and long-term 
specific authorization. In addition to force majeure events, BIS 
recognizes that other potential exigencies may arise causing supply 
chain challenges for companies, thus requiring a specific authorization 
to mitigate national security risk while BIS collaborates with 
companies to integrate them into the standard specific authorization 
process. BIS has included these additional scenarios which it believes 
cover a wide scope of exceptions so as to be flexible with companies 
regulated under this rule: 2027 Model Years that include covered 
software and are actively being sold or imported as of the effective 
date of this rule; as a result of a corporate merger, investment, 
acquisition, joint venture, or conversion of equity (such as from debt) 
that occurs during model year production; as a result of the closure or 
relocation of facilities involved in the production of covered software 
or VCS hardware; and other instances as determined by BIS. BIS 
envisions that specific authorizations granted under an exception with 
be shorter than one year in length and include proactive measures such 
as more frequent reporting requirements while BIS works with companies 
that are actively implementing or modifying corporate security policies 
or control measures for a more permanent solution and for which BIS 
would be more comfortable in granting a standard specific 
authorization.
    Commenters additionally recommended that BIS adopt a portfolio 
phased approach for both software and hardware compliance. One 
commenter in particular highlighted that BIS could require OEMs to need 
only a portion of their portfolio to be compliant in the first year and 
then increasing each year after (e.g., 33 percent the first year, 66 
percent the second year, 100 percent the third year). BIS appreciates 
this as a recommendation and will consider it as a compliance approach 
when issuing specific authorizations.
    Based upon this review of commenters' feedback and further 
consideration, BIS has modified the specific authorization process to 
provide more clarity to industry. VCS hardware importers and connected 
vehicle manufacturers wishing to engage in an otherwise prohibited 
transaction who are ineligible for an exemption or general 
authorization will have to apply for and receive a specific 
authorization to engage in the otherwise prohibited transaction. The 
purpose of specific authorizations is to allow BIS on a case-by-case 
basis to determine the nature and scope of the undue or unacceptable 
risk to U.S. national

[[Page 5404]]

security posed by transactions involving VCS hardware and covered 
software, including the extent of foreign adversary involvement in the 
transactions, as well as potential mitigations.
    VCS hardware importers and connected vehicle manufacturers must not 
engage in an otherwise prohibited transaction until BIS grants the 
application for a specific authorization. If a party engages in a 
prohibited transaction prior to receiving a specific authorization from 
BIS, that transaction would constitute a violation of this final rule. 
Specific authorization requests will be reviewed on a case-by-case 
basis, and a decision regarding the application will be provided within 
90 days unless BIS determines and notifies the applicant within the 90-
day period that additional time is required. Applications for a 
specific authorization must contain detailed information on the 
proposed transaction, including each party to the transaction, an 
overview of the covered software and/or the VCS hardware designed, 
developed, manufactured, or supplied by a person owned by, controlled 
by, or subject to the jurisdiction or direction of the PRC or Russia, 
information on the connected vehicles in which the VCS hardware of 
covered software will be integrated, the intended use of the covered 
software and/or VCS hardware, and documentation to support the 
information contained in the application. Persons seeking a specific 
authorization will submit an application according to instructions 
available on the BIS website. Applicants should take care to submit to 
BIS only one copy of an application pertaining to each transaction for 
which they seek specific authorization to avoid processing delays. BIS 
may request additional information from an applicant about any matter 
related to the specific authorization request. In rare situations, as 
part of its review of an application for specific authorization, BIS 
may, in its sole discretion, request an oral briefing by the applicant 
and any other relevant parties. At any point between initial submission 
of an application for specific authorization and a final decision 
issued by BIS, an applicant may submit additional information to 
bolster the application or provide clarity on any aspect thereof.
    When reviewing applications for a specific authorization, BIS will 
consider factors that may pose undue or unacceptable risks, 
particularly as they relate to transactions that could result in the 
exfiltration of connected vehicle or U.S. persons' data, or the remote 
manipulation or operation of a connected vehicle. Examples of factors 
that BIS may consider include: ISO/SAE 21434 Threat Analysis and Risk 
Assessments; the applicant's ability to limit PRC or Russian government 
access to, or influence over the design, development, manufacture, or 
supply of the VCS hardware or covered software; security standards used 
by the applicant and if such standards can be validated by BIS or a 
third party; and other actions or proposals the applicant offers to 
implement as a way to mitigate undue or unacceptable risk.
    BIS's decision regarding any application for specific authorization 
will apply only to the actual parties and transaction outlined in the 
application and described in the decision notice. Additionally, the 
decision notice from BIS to the applicant(s) may contain any conditions 
that must be met by the parties for a transaction to be authorized. 
Such conditions, which are subject to revision by BIS, may include 
technical controls (e.g., software validation) or operational controls 
(e.g., physical and logical access monitoring procedures), that are 
either permanent or temporary. These controls will focus on the supply 
chain element that involves a link to a foreign adversary to mitigate 
any undue or unacceptable risk posed by the transaction. For connected 
vehicle manufacturers owned by, controlled by, or subject to the 
jurisdiction or direction of the PRC or Russia, a specific 
authorization may include a requirement that all VCS hardware and 
covered software be assembled and integrated into the connected vehicle 
in the United States. In the approval letter for specific 
authorization, BIS will determine the effective date and duration of 
the authorization on a case-by-case basis. As a default, specific 
authorizations will be approved for a duration of no less than one (1) 
calendar year, except on a case-by-case basis under certain exceptions 
including model years that are actively being sold or imported as of 
the effective date of the rule, for situations in which supply chains 
are affected by force majeure events, or due to an unexpected change in 
the supply chain during model year production.
    Applicants with denied authorizations would not be precluded from 
submitting new applications for specific authorizations for different 
transactions involving different parties and/or different covered 
software or VCS hardware. BIS will reconsider a previously denied 
application for a specific authorization only if the applicant 
demonstrates a material change in circumstances.
4. Exemptions
    In the NPRM, BIS delineated several exemptions to the proposed 
rule. First, VCS hardware importers could engage in prohibited 
transactions described in section 791.302 without a general or specific 
authorization, and would be exempt from submitting Declarations of 
Conformity with respect to all other transactions, as described in 
section 791.305, provided that (1) the import of the VCS hardware 
occurred prior to January 1, 2029 for VCS hardware units not associated 
with a vehicle model year, or (2) the VCS hardware was associated with 
a vehicle model year prior to 2030 or the VCS hardware was imported as 
part of a connected vehicle with a model year prior to 2030. Second, 
connected vehicle manufacturers could engage in prohibited covered 
software transactions described in section 791.303 without a general or 
specific authorization and would be exempt from submitting Declarations 
of Conformity with respect to all other transactions described in 
section 791.305, provided that the completed connected vehicle that 
incorporates covered software described in section 791.303(a)(1) was 
manufactured prior to model year 2027. Third, it was contemplated in 
the NPRM that connected vehicle manufacturers who are owned by, 
controlled by, or subject to the jurisdiction or direction of the PRC 
or Russia could engage in prohibited transactions without a general or 
specific authorization, and would be exempt from submitting 
Declarations of Conformity for all other transactions, provided that 
the completed connected vehicle that incorporated VCS hardware and/or 
covered software was manufactured prior to model year 2027. The final 
rule has maintained this existing list of exemptions while adding a 
specific exemption for parts that are imported for purposes of warranty 
or repair of a completed connected vehicle with a model year prior to 
2030.
    Many commenters requested that BIS extend the software and hardware 
prohibition timelines in the rule so that industry has sufficient time 
to adjust their supply chains. For example, one commenter claimed that 
the proposed timelines do not account for existing contracts between 
manufacturers and suppliers. Commenters requested compliance timeline 
extensions ranging from one to five years for the software prohibition 
to go into effect, and one to six additional years for the hardware 
prohibition to go into effect. Alternatively, multiple commenters

[[Page 5405]]

recommended incorporating a phased-in approach for both the software 
and hardware prohibitions. In contrast, two commenters recommend that 
BIS shorten the implementation timeline due to the national security, 
privacy, and safety risks posed by the software and hardware 
transactions. Due to the national security risk being addressed by this 
regulation as discussed in Section IV, BIS has declined to extend the 
proposed software and hardware implementation timelines. For situations 
in which connected vehicle manufacturers or VCS hardware importers 
anticipate this regulation will impact connected vehicles or VCS 
hardware currently under production, those connected vehicle 
manufacturers or VCS hardware importers may apply for a specific 
authorization. Furthermore, with the exclusion of legacy software from 
the definition of covered software, BIS anticipates the regulatory 
burden to be lessened for industry, allowing regulated entities to more 
easily comply with the timeline.
    Regarding exemptions, commenters recommended that BIS clarify 
whether systems which include their own communication but are only 
operational during parking are covered by the regulation. BIS declines 
to confirm whether systems which include their own communication but 
are only operational during parking are covered by the regulations, as 
this would require a case-by-case analysis. BIS advises industry to 
reference the definition of Vehicle Connectivity System.
    Lastly, multiple commenters urged BIS to clarify that spare, 
replacement, or warranty parts imported after January 1, 2029, but for 
integration into a vehicle with a model year prior to 2030 which are 
exempted from the rule. BIS understands that connected vehicle 
manufacturers may have warranty or repair obligations that extend years 
past the date of manufacture of the vehicle. BIS does not intend for 
this rule to interfere with those obligations, and BIS believes the 
rule as written adequately allows for the import of otherwise 
prohibited VCS hardware if it is for a vehicle with a model year prior 
to 2030. Some commenters envisioned a scenario in which a VCS hardware 
importer may wish to import a specific component after January 1, 2029, 
but the component is not yet ``associated'' with a model year and would 
thus be prohibited. In response, BIS has amended the exemptions to 
clarify that VCS hardware components imported for repair or warranty 
purposes for a vehicle model year prior to 2030 are exempt.
5. Appeals
    In the NPRM, BIS proposed a process by which any person whose 
application for a specific authorization is denied, whose specific 
authorization is suspended or revoked, or who has received a written 
notification of ineligibility for a general authorization may appeal 
that decision to the Under Secretary. Commenters suggested that BIS 
expand the appeals section and create a detailed framework for 
navigating the process, including procedures for a software supplier to 
participate in a connected vehicle manufacturer's appeal. Commenters 
also suggested that BIS be specific in defining a ``reasonable time'' 
for appealing decisions. In response to comments, BIS has included a 
provision that allows third parties to submit amicus filings in support 
of parties undergoing an informal appeals hearing if, for example, 
their technology is the subject of the appeal. BIS also specified that 
45 days is the reasonable amount of time to file an appeal and is 
consistent with 15 CFR 756.2(c).
    Based on commenters' feedback, BIS has further clarified the 
appeals process. In the final rule, the appeals process remains a 
mechanism by which any person whose application for a specific 
authorization is denied, whose specific authorization is suspended or 
revoked, or who has received a written notification of ineligibility 
for a general authorization may appeal that decision to the Under 
Secretary. Appeals must be submitted in writing by email or mail to the 
Office of the Under Secretary within 45 days of the date on the notice 
of the adverse administrative action by BIS. The appeal must detail how 
the party submitting the appeal has been directly and adversely 
affected by BIS's action, and the reasons BIS's action should be 
reversed or otherwise modified. The Under Secretary, at his or her 
discretion, may delegate to the Deputy Under Secretary of Commerce for 
Industry and Security or another BIS official responsibility to review 
and decide appeals, including arranging, at the official's discretion, 
informal hearings with relevant parties regarding the appeal.
    On their own accord or at the request of the Under Secretary or 
designated reviewing official, appellants may submit supplementary 
information in support of their appeal. However, the Under Secretary or 
designated reviewing official generally will not consider additional 
information submitted on an appellant's own accord more than 30 days 
after submission of the original appeal. Appellants may also request an 
in-person informal hearing in writing at the time of submission. A 
hearing is not required, and the Under Secretary or designated official 
may, at his or her sole discretion, grant or deny a request for an 
informal hearing. Parties not subject to the administrative action 
under appeal may submit an amicus filing in support of an appellant as 
part of a granted informal hearing.
6. Advisory Opinions
    In the NPRM, BIS proposed the inclusion of an advisory opinion 
provision in order to provide interested parties greater clarity about 
how to comply with the proposed rule on an as-needed basis. Commenters 
supported BIS's inclusion of an advisory opinion mechanism in the rule. 
Some commenters urged BIS to set a deadline by which BIS must respond 
to a request for an advisory opinion. In response, BIS has implemented 
a 60-day deadline for advisory opinion requests unless BIS determines 
that additional time is needed. BIS also emphasizes the timely issuance 
of an advisory opinion will depend upon prompt responses by the 
requester in the event that BIS requests additional documents or 
information to inform the advisory opinion. BIS may publish on its 
website an advisory opinion that may be of broad interest to the 
public, with redactions where necessary to protect CBI. To solicit an 
advisory opinion from BIS, persons will be required to submit a written 
request to BIS by email or through a portal that will be available on 
the BIS website. BIS will not accept advisory opinion requests 
submitted by mail. A request for an advisory opinion must contain 
contact information for the submitter as well as all current 
information on the prospective transaction to assist BIS in making a 
determination.
    In response to the NPRM's stipulation that advisory opinion 
requests be only for real and not hypothetical transactions, some 
commenters suggested that BIS allow an initial period after the rule 
comes into effect during which BIS will allow advisory opinion requests 
for hypothetical transactions. One commenter also recommended that BIS 
use the advisory opinion mechanism to create a trusted supplier program 
for connected vehicle manufacturers and VCS hardware importers. Another 
commenter urged BIS to issue advisory opinions for hypothetical 
transactions to avoid compliance challenges and high costs. BIS 
declines these suggestions, as such reviews for hypothetical 
transactions could burden the department for transactions that may 
never materialize and for which the binding opinion risks

[[Page 5406]]

being made on incomplete facts. The intent of limiting advisory opinion 
requests to actual transactions is to allow BIS to provide thorough 
responses to each request that would ultimately bind the Department 
with regard to that transaction. Permitting entities to submit requests 
for vague, unspecified transactions would likely result in an untenable 
influx of requests and therefore undermine BIS's ability to provide 
comprehensive responses to each request. BIS emphasizes that a 
transaction need not have been initiated or executed in order to 
qualify for an advisory opinion request. Indeed, where a regulated 
entity believes that the transaction may be prohibited, the entity 
should request an advisory opinion before initiating or executing the 
transaction. BIS stresses that an advisory opinion request must contain 
real, specified parties to the transaction and real, specified VCS 
hardware or covered software in order for BIS to issue the opinion.
    One commenter requested that BIS allow suppliers or other relevant 
parties to submit information in support of an advisory opinion request 
in order to avoid the forced transfer of IP from the supplier to the 
customer who is seeking the advisory opinion. In response, BIS has 
clarified that interested parties may submit information directly to 
BIS in support of an advisory opinion request.
    Another commenter recommended that BIS hold compliance forums to 
assist regulated persons in implementing the provisions of this rule. 
BIS will take this suggestion under advisement and will consider 
holding such forums after the publication of this rule. BIS further 
anticipates posting guidance and responses to frequently asked 
questions on its website (https://www.bis.gov/OICTS) to assist the 
public in complying with the rule.
    Multiple commenters addressed the concept of preclearance and urged 
BIS to consider implementing such a process in parallel to the advisory 
opinion program. While BIS declines to institute a preclearance program 
given the need to adequately address the national security concerns 
posed by otherwise prohibited transactions, BIS has emphasized in the 
advisory opinion stipulations that a regulated entity may rely upon an 
advisory opinion issued by BIS in seeking a specific authorization or 
submitting an appeal to BIS to the extent that the facts and assertions 
made in the request remain truthful and accurate. BIS also believes 
that the exclusion of legacy software and refinement of the open-source 
software exclusion further address this commenter's point. Finally, BIS 
reiterates that it may publish certain advisory opinions, in accordance 
with the CBI section of this rule, in the case that it may be of 
general interest to regulated entities or relating to a supplier with 
which many entities wish to transact.
7. ``Is-Informed'' Notices
    BIS received no comments on the proposed ``Is-Informed'' notice 
provision and retains the same ``Is-Informed'' notice provision for the 
final rule (section 791.311, ``Is-Informed notices'').
    BIS may notify connected vehicle manufacturers or VCS hardware 
importers, either through direct letters or through a Federal Register 
notice meant to inform a broader set of persons, that a transaction 
involving certain covered software, VCS hardware, or entities, requires 
a specific authorization because it would constitute a prohibited 
transaction according to the terms of this final rule. Any person who 
engages in a transaction covered by an ``Is-Informed'' notice without 
first receiving a specific authorization from BIS would have knowledge 
that such transaction is prohibited and would therefore be in violation 
of the rule. ``Is-Informed'' notices may only be delivered by or at the 
direction of the Under Secretary or a BIS official designated by the 
Under Secretary.
8. Recordkeeping, Reporting Requirements, and Confidential Business 
Information
    BIS made a few notable changes from the NPRM to the final rule. 
First, BIS no longer requires submission of SBOMs and HBOMs, mitigating 
concerns about the retention of CBI and complexity of reporting 
requirements. Additionally, BIS has reworked the estimates of 
compliance costs in response with comments. As described below in more 
detail, BIS estimates that the initial cost of compliance will 
increase, but the annual cost to conduct ongoing due diligence and 
resubmit Declarations of Conformity will be less due to the decreased 
reporting requirements. BIS declined, however, to change the timeline 
for the retention of business records, as it is in line with IEEPA 
authority.
    Commenters urged BIS to provide explicit assurance for protecting 
CBI and limit the scope of recordkeeping requirements. Some commenters 
provided suggestions that delineated how BIS should protect CBI and 
limited recordkeeping requirements. Other commenters advised that BIS 
establish robust protections for CBI and sought that BIS provide more 
information on how the agency will identify and redact CBI in published 
advisory opinions. Several commenters also expressed that recordkeeping 
requirements of the regulation were unduly burdensome and requested 
that BIS restructure the requirements. One commenter suggested 
narrowing the scope to ``primary business records, such as contracts, 
import records, bills of sale, essential correspondence, and other key 
documents specified for compliance assessment.'' BIS understands the 
concerns surrounding CBI and burden posed by recordkeeping 
requirements. Accordingly, BIS has determined that the final rule will 
not require the submission of SBOMs and HBOMs. BIS notes that CBI still 
may be submitted pursuant to other provisions of the final rule, but 
not to the extent proposed in the NPRM.
    A commenter urged BIS to adopt robust CBI protections given that 
requests for an advisory opinion will almost certainly contain 
proprietary information. BIS believes this comment is addressed by its 
addition of a new section of the rule detailing the submission of CBI. 
Furthermore, entities submitting CBI should refer to 15 CFR 791.102, 
which outlines the circumstances under which the Secretary of Commerce 
may authorize the disclosure of CBI materials submitted to BIS. BIS 
emphasizes that any information submitted as confidential will be 
handled in compliance with applicable laws and regulations, to ensure 
proper handling and to prevent unauthorized disclosure. The CBI will be 
used exclusively for investigative, enforcement, or regulatory 
purposes.
    One commenter requested that BIS provide guidance on how suppliers 
should mark CBI in their submissions and implement a secure CBI portal. 
In response, BIS encourages the commenter to refer to section 791.314, 
which captures the CBI submission and procedures, including how the CBI 
files should be marked ``CONFIDENTIAL BUSINESS INFORMATION'' at the top 
of the page. Submission will occur as indicated on the BIS website, 
initially via email, and eventually through a submission portal which 
will be described in more detail on the BIS website once available.
    Another commenter asked if all reports to be furnished on demand 
are covered in the 10-year recordkeeping requirement. BIS requires that 
primary business records be retained for 10 years and furnished to BIS 
upon request. Based on this feedback, BIS confirms that all reports to 
be furnished on

[[Page 5407]]

demand are covered by the 10-year requirement.
    Commenters provided conflicting feedback on the time requirements 
of recordkeeping. One commenter suggested that recordkeeping 
requirements be lowered to five years. Another commenter suggested 
increasing it to fifteen years. Another commenter noted 10-year 
recordkeeping requirements but said the information collected should be 
limited. BIS agrees that recordkeeping should be limited solely to 
primary business records related to the execution of a transaction. 
However, BIS declines to adjust the 10-year recordkeeping requirement 
so as to maintain consistency with IEEPA.
    One commenter suggested that suppliers should be responsible for 
recordkeeping. BIS underscores that the primary compliance 
responsibility is on the connected vehicle manufacturer and VCS 
hardware importer. However, when submitting a Declaration of 
Conformity, entities must certify that they have arranged for suppliers 
to furnish any documentation and third-party assessments (as 
applicable) upon request by BIS.
    One commenter requested information on ``permissible locations for 
data centers.'' BIS declines to explicitly name permissible locations 
for data centers for vehicle-external data storage but may consider the 
location of a data center as it relates to the design, development, 
manufacturing, and supplying of covered software or VCS hardware for 
applicants of specific authorizations.
    Several commenters expressed that BIS's recordkeeping cost 
estimates are inaccurate. A few commenters argued that the initial 
range of ``$30,964 and $38,554 per regulated entity, followed by 
estimated yearly costs of $16,133 to $80,667'' to comply with the rule 
was underestimated. One commenter noted that two staff members managing 
this regulation compliance would prevent BIS from sufficiently 
processing all Declarations of Conformity and relevant materials. After 
reviewing the comments and re-analyzing the cost to entities to read 
the rule, understand the rule, and conduct initial due diligence, BIS 
re-estimates that this initial cost is between $56,671 and $77,055. 
Additionally, BIS re-estimates that the estimated yearly costs to re-
conduct due diligence and potentially re-submit a Declaration of 
Conformity is between $24,200 and $48,400. While BIS agrees that its 
initial estimate of conducting due diligence with the rule was 
understated due to the complexity of automotive supply chains, BIS 
estimates that the annual cost to re-conduct due diligence and 
potentially re-submit Declarations of Conformity is reduced due to the 
decreased reporting requirements. Additional information on these new 
estimates can be found in the Paperwork Reduction Act section of this 
final rule, and the accompanying Final Regulatory Impact Analysis.
    A few commenters also noted that the estimates do not reflect BIS's 
own suggestion that regulated entities provide evidence of due 
diligence ``to include independent or hired third-party research.'' BIS 
clarifies that third-party research and assessments is optional when 
submitting a Declaration of Conformity. However, BIS notes that third-
party verification may be required as a condition for the approval of a 
specific authorization.
    Commenters suggested implementing lists of trusted countries or 
suppliers in order to reduce the due diligence burden on connected 
vehicle manufacturers and VCS hardware importers. The publication of a 
list of trusted countries or suppliers would complicate compliance for 
BIS. The broad application of trusted countries or suppliers undercuts 
BIS's ability to address each transaction on a case-by-case basis with 
proportionate mitigation measures, as may be necessary. Creating a 
preapproved list of countries and suppliers would also lead to a more 
uncertain regulatory environment as BIS may be required to update such 
a list from time to time as the threat environment evolves.
    BIS has chosen to require connected vehicle manufacturers and VCS 
hardware importers to maintain complete records related to any 
transaction for which a Declaration of Conformity, general 
authorization, or specific authorization would be required by this 
rule, for a period of 10 years. This recordkeeping requirement applies 
regardless of whether the transaction is subject to a general 
authorization or specific authorization, or whether the connected 
vehicle manufacturer or VCS hardware importer has not yet sought an 
authorization. Records subject to the recordkeeping requirement include 
all information pertinent to transactions completed pursuant to a 
general authorization or submitted when applying for a specific 
authorization, as well as business records related to the execution of 
the transaction, such as contracts, import records, bills of sale, 
relevant correspondence, and all other files specified in sections 
791.312 and 791.313 to assess compliance with the rule.
    All connected vehicle manufacturers and VCS hardware importers are 
required to submit records when requested by BIS related to any 
transaction for which a Declaration of Conformity, general 
authorization, or specific authorization would be required by this 
rule, whether or not said transaction was carried out under a general 
authorization, specific authorization, or without an authorization from 
BIS. As such, BIS may request business records, before, during, or 
after the transaction in question has taken place.
    In response to numerous public comments requesting deeper 
commitments by BIS to protect CBI as well as greater clarity regarding 
how BIS will protect CBI, BIS has included a new section in this final 
rule detailing relevant measures BIS will take. Under these new 
provisions, entities submitting information that they wish to receive 
CBI protections should clearly mark any pages containing such CBI in 
their submission. Additionally, the entity requesting CBI handling 
should submit a statement to BIS that justifies non-disclosure by 
citing the specific legal authority on which the entity believes BIS 
should rely, such as Exemption 4 of the Freedom of Information Act 
(FOIA) as codified at 5 U.S.C. 552(b)(4), or other relevant 
authorities. As stated above, BIS will maintain confidential 
information in accordance with 15 CFR 791.102.
9. Third Party Verification and Assessments
    In response to numerous public comments, BIS decided to further 
clarify the voluntary use of third-party assessments. Several comments 
indicated that for many of the rule's regulated entities, companies 
would need to outsource to third parties to maintain compliance and 
assist in preparing documentation for recordkeeping and submission of 
Declarations of Conformity. BIS emphasized that the use of third 
parties to maintain compliance with this rule is generally voluntary 
but may be required by BIS as a condition for granting a specific 
authorization. While regulated entities may use a third party to assist 
with compliance checks, the final rule does stipulate that such third 
parties may not be a person owned by, controlled by, or subject to the 
jurisdiction or direction of the PRC or Russia. Additionally, any 
reports produced by these third parties would be subject to the final 
rule's recordkeeping requirements.

d. Enforcement

    BIS notes as a threshold matter that it has reordered the 
enforcement sections

[[Page 5408]]

of this rule to flow more naturally and to provide readers with a 
better sense of the chronology and sequencing of enforcement actions as 
compared to the structure in the NPRM. The reorder of these sections in 
the regulatory text has no bearing on the substance of the sections nor 
the rule as a whole. BIS's consideration of comments related to the 
enforcement provisions is discussed in the sections that follow.
1. Penalties
    One commenter requested that BIS provide greater clarity on how it 
will determine whether a civil or criminal penalty will be assessed, as 
well as provide means by which an entity may rectify an error before a 
penalty is assessed. In response, BIS emphasizes, as detailed below, 
that the penalties in this rule are derived from IEEPA, and the 
individual nature of the violation will determine both the type of 
penalty and the amount to be assessed. Additionally, this rule contains 
multiple paths through which VCS hardware importers and connected 
vehicle manufacturers may rectify errors. For example, BIS may issue an 
``Is-Informed'' notice to a party informing them that a specific 
authorization is needed to continue with a certain transaction. As 
provided below, BIS may also issue a pre-penalty notice outlining BIS's 
intention to issue a penalty and providing the party with the 
opportunity to respond and present any potentially mitigating or 
exculpatory evidence or remediation proposals. Lastly, in response to a 
request from a commenter, BIS has included in this rule a clarification 
that it will take into account voluntary self-disclosures of potential 
violations when deciding to issue a penalty.
    IEEPA provides the authority for this rulemaking. Thus, persons who 
violate, attempt to violate, conspire to violate, or knowingly cause a 
violation of this rule will be subject to civil and/or criminal 
penalties under IEEPA (50 U.S.C. 1705), depending on the circumstances 
of the violation. Potential violations of this final rule that would be 
subject to penalties include, but are not limited to, engaging in a 
prohibited transaction without an applicable general authorization or 
specific authorization, or failure to abide by the conditions 
enumerated in a specific authorization. Willfully providing false or 
fictitious information to the U.S. Government may be subject to 
criminal fines, imprisonment, or both. A civil penalty may be imposed 
on any person who violates, attempts to violate, conspires to violate, 
or causes a violation of any exemption, authorization, order, 
regulation, directive, instruction, or prohibition issued under IEEPA 
and this rule.
    Under the Federal Civil Penalties Inflation Adjustment Act 
Improvements Act of 2015, the specific maximum civil penalty will be 
adjusted by notice in the Federal Register effective each calendar year 
by the Office of the Secretary of the Department of Commerce. At the 
time of publishing of this final rule, the maximum civil penalty for 
violations of IEEPA is $368,136 per violation and the maximum criminal 
penalty is $1,000,000.
    Under the final rule, should BIS have reason to believe that a 
violation has occurred and intends to issue a civil monetary penalty, 
it will inform the alleged violator through a written notice of the 
intent to impose a penalty (pre-penalty notice). BIS will generally 
transmit the pre-penalty notice electronically but may additionally 
mail notice. The recipient of a pre-penalty notice may respond in 
writing to BIS to provide additional information or otherwise contest 
the penalty. BIS must receive this response within 30 days of the 
transmission of the original pre-penalty notice. A response to a pre-
penalty notice does not constitute a formal appeal, but it allows the 
recipient of the pre-penalty notice to contest facts set forth by BIS 
in the pre-penalty notice, provide exculpatory evidence, or otherwise 
respond to the violation alleged in the pre-penalty notice. BIS may 
seek to initiate settlement discussions in the pre-penalty notice or 
may conduct separate outreach following transmission of the pre-penalty 
notice. Recipients of a pre-penalty notice may additionally request to 
initiate settlement discussions in their response to BIS or may conduct 
separate outreach to do so.
    Following the delivery of the pre-penalty notice, and after 
considering any responses from the alleged violator, BIS will inform 
the alleged violator in writing as to whether it has found that a 
violation in fact occurred. Should BIS find that a violation has indeed 
taken place and no settlement has been reached, BIS will issue a final 
penalty notice to the violator specifying the violation and determining 
the specific civil monetary penalty to be imposed. This penalty may not 
be appealed following the procedures in section 791.309, as it is a 
final agency action that the violator may contest in the appropriate 
U.S. District Court.
    Should a violator fail to pay the penalty as specified in the final 
penalty notice or fail to make alternative payment arrangements 
approved by BIS, BIS may refer the matter to the Department of the 
Treasury for administrative collection or to the Department of Justice 
for collection via civil suit in U.S. District Court.
2. Finding a Violation
    BIS did not receive any feedback on this in the NPRM and retains 
its approach for ``finding a violation'' in its final rule.
    Under the final rule, there may be cases in which BIS determines 
that a violation has taken place but that a civil monetary penalty is 
not appropriate. In such cases, BIS would issue a finding of violation 
that identifies the violation. The finding of violation could also 
contain an administrative response other than a civil monetary penalty, 
such as an order to cease and desist from conduct or activities that 
are prohibited by the final rule. Consistent with the procedures listed 
above regarding a pre-penalty notice, recipients of a finding of 
violation may file a response within 30 days contesting the facts of 
the finding of violation and/or providing information relevant to BIS's 
determination of whether a violation has occurred. BIS will consider 
any new information and inform the party in writing whether a violation 
has or has not occurred. A recipient that does not respond within 30 
days of receipt of the finding of violation will be deemed to have 
waived the right to respond. Any action taken in a finding of violation 
issued by BIS constitutes a final agency action that is not subject to 
appeal following the procedures in section 791.309.
3. Severability
    BIS did not receive any feedback on this in the NPRM and retains 
its approach to ``Severability'' in its final rule.
    This rule implements, and is fully consistent with, governing law. 
However, in the event of legal challenge. BIS intends for the 
provisions of the final rule to be severable from each other. If a 
court holds that any provision in the final 15 CFR 791, subpart D, is 
invalid or unenforceable, BIS intends that the remaining provisions of 
the final 15 CFR 791, subpart D, as relevant, would continue in effect 
to the greatest extent possible. In addition, if a court holds that any 
such provision is invalid or unenforceable as to a particular person or 
circumstance (such as the recordkeeping or Declarations of Conformity 
requirements), BIS intends that the provision would remain in effect as 
to any other person or circumstance. Each provision of the final rule 
and application thereof serves an important, related, but distinct

[[Page 5409]]

purpose; provides a distinct benefit separate from, and in addition to, 
the benefit provided by other provisions and applications; is supported 
by evidence and findings that stand independent of each other; and is 
capable of operating independently such that the invalidity of any 
particular provision or application would not undermine the operability 
or usefulness of other aspects of the final rule. Depending on the 
circumstances and the scope of the court's order, BIS believes that the 
remaining provisions of the final rule likely could continue to 
function sensibly independent of any provision or application held 
invalid or unenforceable. For example, the prohibitions related to 
transactions involving VCS hardware could continue to apply as 
intended, even if a court finds that the prohibitions on transactions 
involving ADS are invalid. Similarly, the final rule could be applied 
with respect to relevant hardware and software designed, developed, 
manufactured, or supplied by persons owned by, controlled by, or 
subject to the jurisdiction or direction of the PRC, even if a court 
finds its application with respect to relevant hardware and software 
from Russian-linked persons is invalid.

e. Other Commentary

1. Coordination With Interagency and Industry
    Commenters urged BIS to consider its overlap with other government 
agencies in a variety of ways. One commenter suggested that BIS conduct 
a conflict-of-laws analysis to ensure there is no overlap with the 
Committee on Foreign Investment in the United States (CFIUS) 
authorities. In response, BIS clarifies that its authorities are 
different from CFIUS authorities, the latter of which apply to certain 
foreign investments in the United States and are coordinated by the 
Department of the Treasury.
    One commenter urged BIS to coordinate more closely with the NHTSA, 
the Federal Motor Carrier Safety Administration (FMCSA), and industry 
when finalizing the rule. Additional commenters advised BIS to evaluate 
its overlapping authorities with other government bodies. Another 
commenter claimed that the telecommunications supply chain is subject 
to overlapping authorities and regulations and therefore BIS should 
ensure the rule is narrowly tailored to connected vehicles. BIS 
acknowledges these suggestions and notes for commenters that it has 
robustly engaged with its interagency partners to deconflict any 
overlap in authorities. As noted previously, BIS's ICTS authorities are 
explicitly focused on addressing unique national security risks from 
foreign adversary involvement in the ICTS supply chain such as those 
articulated in Section IV of this rule and differ from other programs 
in the U.S. government. BIS has coordinated with interagency partners 
and industry to inform the development of this final rule and has 
worked with them to ensure this rule does not conflict with but 
complements other governmental efforts.
2. Global Standards/Regulations for Consideration
    Multiple commenters stated that BIS should consider adopting the 
United Nations regulations concerning cybersecurity and software update 
management, such as UN Regulation 155 and UN Regulation 156. Other 
commenters proposed utilizing standards and frameworks including ISO/
SAE 21434, ISO 26262, CISA's Autonomous Ground Vehicle Security 
(TISAX), Auto-ISAC Cybersecurity Best Practices, NHTSA's Cybersecurity 
Best Practices for the Safety of Modern Vehicles, 2024 Technical 
Requirements for Vehicle Overall Information Security (GB44495), and 
the United Nations World Forum for Harmonization of Vehicle Regulations 
(WP.29). In response, BIS wants to voice its appreciation for the 
commenters' input and thoughts on incorporating these standards into 
its regulation format. However, after consideration, BIS does not 
assess these standards as sufficient methods to mitigate the identified 
risk within the connected vehicle supply chain. These standards and 
frameworks all have different scopes that do not accurately match BIS's 
goal of mitigating national security risk posed by the connected 
vehicle technology supply chain when containing a nexus with adversary 
countries.
    However, some of these standards and frameworks may offer support 
for the compliance process. For example, when processing specific 
authorizations, BIS will take into consideration existing cybersecurity 
measures employed by the entity, such as the implementation of UN 
Regulation 156, which involves software update and software update 
management systems, or SAE Standard 21434, as they relate to the unique 
ICTS transaction. BIS's review for specific authorizations will be 
conducted on a case-by-case basis, and BIS therefore does not see it 
beneficial to provide blanket clearance for any one cybersecurity 
standard at this time. In addition to advocating for BIS to consider 
international standards, one commenter asked BIS to reconsider the 
impact of its regulation, arguing that it will hinder the United 
States' ability to meet its 2030 goal under the Paris Agreement. This 
commenter urged BIS to prepare an environmental assessment of the rule. 
Given that the focus of BIS's authority is limited to national security 
threats from adversary countries, an environmental evaluation is 
neither pertinent nor required.
    Commenters also sought clarification on how BIS would consider 
international standards to which adversary countries had input. One 
commenter asked BIS to clarify that vehicle technologies would not be 
prohibited simply because they had been developed according to 
international standards in which the PRC had been a party. A separate 
commenter stated that BIS should clarify that the participation of 
Chinese or Russian citizens in international technical standards-
setting would not deem the VCS hardware subject to that standard as 
captured by the rule. BIS appreciates these comments but notes that PRC 
or Russia support in an international standard development process does 
not fall within the scope of this regulation.
3. Stakeholder Meetings
    Between September 24 and December 13, 2024, BIS conducted 35 
meetings with industry stakeholders to gather information, follow up on 
ambiguous comments, and better understand current business practices in 
the U.S. connected vehicle supply chain.\2\
---------------------------------------------------------------------------

    \2\ These meetings included 20 meetings held after the close of 
the comment period. BIS met with all stakeholders who requested 
meetings until the draft final rule was submitted to OMB for 
coordinated interagency review under Executive Order 12866.
---------------------------------------------------------------------------

    In each meeting, BIS encouraged the participant(s) to submit 
written comments to the public docket. For the most part, commenters in 
these meetings offered views that they previously or subsequently 
submitted in written comments. BIS summarizes below additional points 
not addressed in written comments. In many of the meetings, 
participants provided BIS with confidential business information 
relating to their design and manufacturing of completed connected 
vehicles and/or components to provide context for points made in 
written submissions.
    Across all meetings, stakeholders generally reiterated information 
submitted in written comments regarding specific authorizations; 
advisory opinions; Declarations of Conformity; definitions of terms 
such as person owned by, controlled by, or

[[Page 5410]]

subject to the jurisdiction or direction of a foreign adversary and 
foreign interest; a whitelist for approved components; unconventional 
ownership structures; and commercial trucking. As stated above, BIS has 
addressed each of these issues in the final rule by: clarifying the 
process for specific authorizations (Section VI.c.3) and advisory 
opinion requests (Section VI.c.6); greatly reducing the burden for 
Declarations of Conformity (Section VI.c.1), including exclusion of 
SBOMs and HBOMs; updating the definition of covered software (Section 
VI.a.5); and providing more examples regarding the definition of a 
person owned by, controlled by, or subject to the jurisdiction or 
direction of a foreign adversary (Section VI.a.14) and foreign interest 
(Section VI.a.8); providing more examples on unconventional ownership 
structures (Section VI.a.14); and scoping the rule to address only 
those vehicles under 10,001 pounds (Section VI.a.3). For the reasons 
stated above, BIS declines to implement a whitelist (Section VI.a.12).
    Finally, a stakeholder expressed interest in whether like-minded 
countries would be encouraged to adopt similar provisions to this 
regulation. BIS notes that throughout the rulemaking process it has 
been working closely with international allies and partners and has 
experienced high interest. BIS also participated in a meeting with 
interested foreign governments convened by the Department of State and 
the White House on July 31, 2024, to jointly address the national 
security risks associated with connected vehicles.

f. Classification

1. Executive Order 12866
    Executive Order 12866, as reaffirmed by Executive Order 13563 and 
amended by Executive Order 14094, directs agencies to assess all costs 
and benefits of available regulatory alternatives and, if regulation is 
necessary, to select regulatory approaches that maximize net benefits 
(including potential economic, environmental, public health, and safety 
effects, and distributed impacts and equity). This final rule has been 
designated a significant regulatory action by the Office of Information 
and Regulatory Affairs (OIRA) under section 3(f)(1) of Executive Order 
12866, as amended by Executive Order 14094.
2. Unfunded Mandates Reform Act of 1995
    This final rule would not produce a Federal mandate (under the 
regulatory provisions of title II of the Unfunded Mandates Reform Act 
of 1995) for state, local, and Tribal governments or the private 
sector.
3. Executive Order 13132 (Federalism)
    This final rule does not contain policies having federalism 
implications requiring preparations of a Federalism Summary Impact 
Statement.
4. Executive Order 12630 (Governmental Actions and Interference With 
Constitutionally Protected Property Rights)
    This final rule does not contain policies that have takings 
implications.
5. Executive Order 13175 (Consultation and Coordination With Indian 
Tribes)
    The Department has analyzed this final rule under Executive Order 
13175 and has determined that the action would not have a substantial 
direct effect on one or more Indian Tribes, would not impose 
substantial direct compliance costs on Indian Tribal governments, and 
would not preempt Tribal law.
6. National Environmental Policy Act
    The Department has reviewed this rulemaking action for the purposes 
of the National Environmental Policy Act (42 U.S.C. 4321, et seq.). It 
has been determined that this final rule would not have a significant 
impact on the quality of the human environment.
7. Paperwork Reduction Act
    There are several changes between the NPRM and the final rule 
regarding information collection requirements. First, BIS has 
significantly decreased the reporting requirements in the Declaration 
of Conformity provision, including eliminating the need to submit 
SBOMs/HBOMs or a list of third-party external endpoints to which the 
VCS hardware connects. These provisions have been replaced with 
certification and recordkeeping requirements, with specific 
documentation and assessments on due diligence only needing to be 
submitted to BIS upon request. Additionally, BIS has removed the 
submission of an SBOM/HBOM for advisory opinion requests. Lastly, BIS 
has specified in the final rule that only primary business records 
relating to VCS hardware and covered software need to be maintained. 
These changes have significantly reduced the recurring annual cost and 
burden hour estimates.
    Several commenters noted that the initial estimation to read the 
rule, understand the rule, and conduct initial due diligence in 
preparation to comply with the rule was significantly underestimated. 
One commenter noted that the approximately $39,000 per entity estimate 
to initially read and understand the rule and comply with its 
requirements is under-representative of the scope of activity required 
by the new proposed restrictions, compliance activities, and 
certification requirements. It was also noted that one of the main 
compliance tasks for OEMs would be the supply chain due diligence, 
which is time consuming and resource intensive. After internal 
deliberation, BIS agrees with commenters that the initial estimations 
to read the rule, understand the rule, and conduct initial due 
diligence in preparation to comply with the rule were likely 
underestimated, most significantly is the initial time burden for 
entities.
    The initial time burden hour estimate for operations managers in 
the Preliminary Regulatory Impact Analysis was between 50 to 70 hours. 
BIS now estimates that the burden hour estimate for operations managers 
is between 100 to 160 hours. BIS evaluates that the burden hours for 
operations managers is essentially doubled compared to the estimation 
in the proposed rule due to improved insight into the complexities 
surrounding mapping supply chains and the initial efforts that will 
need to be invested in preparing to comply with the rule. BIS assesses 
that this updated hour estimate more accurately reflects these 
activities.
    The initial burden hour estimate for lawyers in the Preliminary 
Regulatory Impact Analysis was between 80 and 100 hours. BIS now 
estimates that the burden hour estimate for lawyers is between 160 and 
200 hours. Similarly to operations managers, BIS evaluates that the 
burden hours for lawyers is doubled compared to the estimation in the 
proposed rule due to improved insight into the legal efforts needed to 
(1) ensure that complex supply chains are compliant with the 
requirements outlined in the rule, and to (2) establish the reporting 
and recordkeeping practices as prescribed in the rule. The increase in 
lawyer burden hours also accounts for potential outside counsel 
engagement if a company does not have the proper in-house legal support 
or expertise.
    Lastly, the initial burden hour estimates in the Preliminary 
Regulatory Impact Analysis assumed a time burden of 50 to 70 hours for 
engineers. This estimation remains the same in this final rule. After 
internal deliberation, BIS estimates that the burden to read the rule, 
understand the rule, and conduct initial due diligence in preparation 
to comply with the rule will largely fall on operations managers and 
lawyers.

[[Page 5411]]

Therefore, BIS did not increase the engineer burden hour estimate.
    In the NPRM and Preliminary Regulatory Impact Analysis, BIS 
estimated that the cumulative initial burden (in hours) placed on 
applicable entities would be 180 to 240 hours and that the initial cost 
burden for these entities would be between $30,964 and $38,554. This 
estimate took into account the one-time initial cost (in hours) per 
entity to comply with the rule, including reading and understanding the 
rule's provisions. Every subsequent year, BIS estimated that the total 
annual cost burden (in hours) for applicable entities to implement the 
rule would be 100 to 500 hours and that the total annual cost burden 
for applicable entities to implement the rule would be $16,133 to 
$80,667 a year. In the final rule and final Regulatory Impact Analysis, 
BIS re-estimates that the cumulative initial burden (in hours) placed 
on applicable entities is between 310 and 430 hours to initially read 
the rule, understand the rule, and conduct initial due diligence in 
preparation to comply. The re-estimated cost burden for these entities 
to read the rule, understand the rule, and conduct initial due 
diligence is between $56,671 and $77,055. Every subsequent year after 
the publication of the final rule, the Department anticipates that the 
total annual burden (in hours) for connected vehicle manufacturers and 
VCS hardware importers to re-conduct due diligence into their VCS 
hardware or covered software supply chains and potentially re-submit a 
Declaration of Conformity will be 150 to 300 hours. BIS estimates that 
the total annual cost burden for a connected vehicle manufacturer or 
VCS hardware importer to re-conduct due diligence into their VCS 
hardware or covered software supply chains and potentially re-submit a 
Declaration of Conformity will be $24,200 to $48,400 per year.
    BIS has also re-calculated the expected cost to the U.S. 
Government. Consistent with the proposed rule, BIS estimates that it 
will take staff an average of 20 hours to review and, if applicable, 
respond to each Declaration of Conformity, specific authorization 
application, or advisory opinion request. However, BIS has corrected 
the calculation by removing the 20 percent overhead addition, as 
overhead is already captured in staff wages. For this final rule, BIS 
has increased the expected legal support personnel from one to two 
employees in response to comments related to staffing needs in managing 
compliance with the rule. The re-estimated annual cost to the U.S. 
Government in the final rule is $1,299,728, a slight decrease from the 
$1,437,982 estimate in the NPRM.
    Some commenters to the NPRM expressed that BIS did not provide 
adequate time to review the costs of the rule. BIS acknowledges the 
short publication timeline of this rule, but also recognizes that the 
national security risks the rule addresses are severe. BIS also aims to 
address national security risks in a way that does not unduly burden 
the industry, as reflected by changes in the final rule. In its efforts 
to reduce associated costs and compliance burden, BIS has revised the 
final rule to reduce information submission requirements and expand on 
provisions that are designed to help the industry comply with the rule. 
For example, BIS has dramatically reduced the information submission 
requirements by removing the HBOM and SBOM submission requirements, 
which not only meets the industry where they are but also reduces the 
cost of this regulation. BIS has also established a process for issuing 
advisory opinions to assist parties who are unsure how the requirements 
in this rule affect them, and a process for requesting specific 
authorizations if a party believes that certain transactions prohibited 
by this rule should be permitted to go forward. BIS also notes that the 
delayed implementation of this rule will provide additional time for 
the industry to come into compliance with its requirements and seek 
specific authorizations or advisory opinions, as applicable. Also, BIS 
emphasizes that it will continue to engage with industry following 
publication of this rule to educate and facilitate compliance.
    One commenter also indicated concerns about ``the costs of hardware 
compliance, particularly regarding aftermarket suppliers in the 
trucking industry.'' BIS has since chosen to exclude commercial 
vehicles from this regulation and intends to propose a subsequent rule 
to address specific national security risks tailored towards this 
sector.
    Commenters urged BIS to re-evaluate the broader impact of the 
regulation and noted the potential impact the rule would have on the 
automotive supply chain. BIS has been working to carefully scope the 
rule so that it does not place an undue burden on industry or the 
broader automotive supply chain. One commenter expressed concern about 
similar actions potentially being taken by other governments. BIS notes 
that this rule is focused on the domestic market within the United 
States.
    As described above, BIS agrees with commenters who indicated the 
initial compliance cost estimates described in the NPRM were 
understated. However, BIS believes that subsequent annual costs will be 
lower due to the decreased reporting requirements in this final rule. 
BIS has revised this PRA section to account for compliance costs new to 
the final rule, the initial cost to comply with the rule, and lower 
annual cost to comply with the rule due to decreased reporting 
requirements.
    One commenter wanted to ensure that the rule does not impair the 
ability for American consumers to access the data from their own 
vehicles. BIS notes that this concern is not implicated by this final 
rule. Relatedly, a few commenters shared the view that the rule will 
limit consumer choice and innovation, is a form of economic 
protectionism, and is overly broad. BIS has worked to carefully scope 
this rule and notes that there are numerous firms both in the United 
States and abroad who are leading the development of innovative 
products. Moreover, BIS believes that it has narrowed the scope of this 
rule to the extent possible by solely focusing on VCS hardware and 
connected software designed, developed, manufactured, or supplied by 
entities with a sufficient nexus to the PRC and Russia. This rule 
leaves the remainder of the global market out of scope.
    The collections of information contained in this final rule have 
been submitted to the Office of Management and Budget (OMB) for review 
in accordance with the Paperwork Reduction Act of 1995 (44 U.S.C. 3501, 
et seq.) (PRA) under control number 0694-0145. This final rule will 
create new information collection requirements, which are subject to 
review and approval by OMB under the PRA.
    For regulated entities whose covered software or VCS hardware is 
not designed, developed, manufactured, or supplied by persons owned by, 
controlled by, or subject to the jurisdiction or direction of the PRC 
or Russia, the entity would be responsible for attesting to BIS that 
due diligence has been conducted through the submission of a 
Declaration of Conformity. Entities must submit to BIS the name and 
contact information of the VCS hardware importer or connected vehicle 
manufacturer, and additional pieces of information, if known, based on 
the type of declaring entity. Entities must also certify to BIS that 
they have conducted due diligence into their supply chain and can 
attest that their covered software and VCS hardware is not designed, 
developed, manufactured, or supplied by persons owned by, controlled 
by, or subject to the jurisdiction or direction of the PRC or

[[Page 5412]]

Russia. A Declaration of Conformity will need to be submitted to BIS 
each calendar year or for every new connected vehicle model year.
    Regulated entities whose covered software or VCS hardware is 
designed, developed, manufactured, or supplied by persons owned by, 
controlled by, or subject to the jurisdiction or direction of the PRC 
or Russia can apply for a specific authorization to engage in an 
otherwise prohibited transaction. In the application, an entity must 
submit information substantial enough to demonstrate to BIS that the 
otherwise prohibited transaction does not pose undue and unacceptable 
risk to U.S. national security. For example, entities may submit ISO/
SAE 21434 Threat Analysis and Risk Assessments, including an assessment 
on the applicant's ability to limit PRC or Russian government access 
to, or influence over, the design, development, manufacture, or supply 
of the VCS hardware or covered software; security standards used by the 
applicant with respect to the VCS hardware or covered software; and/or 
other actions or proposals such as technical controls (e.g., software 
validation) or operational controls (e.g., physical and logical access 
monitoring procedures) the applicant intends to take to mitigate undue 
or unacceptable risk. Because specific authorization applications can 
vary in the level of specificity and volume of submitted materials, BIS 
cannot accurately estimate the costs and burden hours associated with 
an entity applying for a specific authorization.
    Specific authorizations are reviewed and approved by BIS on a case-
by-case basis. The final rule specifies that BIS may stipulate a 
variety of measures as conditions for the issuance of a specific 
authorization based on the level of risk that needs to be mitigated. 
For example, BIS may require the submission of annual third-party 
assessments as a condition. This condition would incur annual costs for 
an entity that seeks to engage in an otherwise prohibited transaction. 
Due to the variety of mitigating factors that BIS may impose when 
issuing specific authorizations, BIS cannot accurately estimate the 
costs and burden hours associated with an entity adhering to the 
conditions in a specific authorization.
    There are several other compliance costs that regulated entities 
may incur from the rule, including the submission of advisory opinion 
requests and recordkeeping. Advisory opinions are voluntary requests 
that VCS hardware importers and connected vehicle manufacturers may 
submit to BIS to seek guidance on whether a prospective transaction is 
subject to a prohibition of the rule. BIS sought comments on the 
potential number of advisory opinions that regulated entities may 
submit and did not receive any. Additionally, all regulated entities 
are required to retain primary business records under the recordkeeping 
requirements in the rule. For instance, entities subject to a 
Declaration of Conformity will need to maintain primary business 
records related to their covered transactions, while entities subject 
to approved specific authorizations may need to record keep additional 
documentation based on the conditions of a specific authorization. Due 
to these varying circumstances, BIS cannot accurately estimate the 
costs and burden hours associated with recordkeeping or submitting 
voluntary advisory opinion requests.
    As noted above, BIS estimates that it will take regulated entities 
between 310 and 430 hours to initially read the rule, understand the 
rule, and conduct initial due diligence in preparation to comply. Every 
subsequent year after the publication of the final rule, the Department 
anticipates that the total annual burden (in hours) for connected 
vehicle manufacturers and VCS hardware importers to re-conduct due 
diligence into their VCS hardware or covered software supply chains and 
potentially re-submit a Declaration of Conformity will be 150 to 300 
hours.
    Based on analysis conducted in the accompanying final Regulatory 
Impact Analysis, BIS assesses that there are 27 to 215 entities 
potentially impacted by the rule. This range has been updated since the 
proposed rule to account for the removal of the commercial market from 
this regulation (narrowing the scope from NAICS: 3361 Motor Vehicle 
Manufacturing to NAICS: 33611 Automobile and Light Duty Motor Vehicle 
Manufacturing). The estimated cost burden for these entities to read 
the rule, understand the rule, and conduct initial due diligence is 
between $56,671 and $77,055. Every subsequent year, BIS estimates that 
the total annual cost burden for a connected vehicle manufacturer or 
VCS hardware importer to re-conduct due diligence into their VCS 
hardware or covered software supply chains and potentially re-submit a 
Declaration of Conformity will be $24,200 to $48,400 per year (average 
of operations manager, engineer, and lawyer hourly salaries [$484/hour/
3 = $161.33] * [150 and 300 hours]). This broad range accounts for the 
varying levels of information that entities need to update in a 
Declaration of Conformity per model year. For example, a material 
change in the covered software or VCS hardware could lead to the entity 
conducting more due diligence and then submitting a new Declaration of 
Conformity. Alternatively, where there are no material changes to the 
covered software or VCS hardware for a subsequent model year or 
calendar year, the connected vehicle manufacturer or VCS hardware 
importer can submit a confirmation that the previously submitted 
information remains accurate.
    The estimated annual Federal salary cost to the U.S. Government to 
review and, if applicable, respond to Declarations of Conformity, 
specific authorization applications, and advisory opinion requests 
after the rule is fully implemented is $971,800 [an estimated total of 
430 Declarations of Conformity, specific authorization applications, 
and advisory opinion requests per year * hourly GS-13 staff rate of 
$113/hour * average of 20 hours to review each Declaration of 
Conformity, specific authorization application, or advisory opinion 
request]. The $113 per staff member per hour cost estimate for this 
information collection is consistent with the GS-scale salary data for 
a GS-13 Step 1 (https://www.opm.gov/policy-data-oversight/pay-leave/salaries-wages/salary-tables/pdf/2024/DCB.pdf) multiplied by a factor 
of 2 to include the cost of benefits and overhead. While BIS expects 
the time to review and, if applicable, respond to Declarations of 
Conformity, specific authorization applications, and advisory opinion 
requests to vary, 20 hours is our best estimate of this average.
    The total estimated annual cost to the U.S. Government is 
$1,299,728. The calculation is as follows: Annual Federal Salary Cost 
[$971,800] + Legal Support (two GS-15 Step 1 employees (multiplied by 2 
to include the cost of benefits and overhead) @50% of their time) 
[$327,928] = $1,299,728.
    Under the PRA, an agency may not conduct or sponsor, and a person 
is not required to respond to, a collection of information unless the 
agency displays a valid control number assigned by OMB. Approved 
information collection requests may be viewed at https://www.reginfo.gov/public/do/PRAMain.
8. Regulatory Flexibility Act
    In compliance with Section 604 of the Regulatory Flexibility Act 
(RFA), 5 U.S.C. 601-612, the Department has prepared a final regulatory 
flexibility analysis (FRFA) for this final rule. The FRFA describes the 
economic impacts the action may have on small entities. Public comments 
to the initial regulatory flexibility analysis (IRFA) and BIS's 
response is captured in subsection 2 below.

[[Page 5413]]

    1. A statement of the need for, and objectives of, the rule. 
Connected vehicles contain a growing number of connected components. 
While these components provide greater safety and convenience through 
features like Wi-Fi, Bluetooth, cellular telecommunication, and 
satellite connectivity, the incorporation of progressively complex 
hardware and software systems enabling vehicle connectivity has also 
increased the attack surfaces through which malign actors and foreign 
adversaries may exploit vulnerabilities to gain access to vehicles. 
ICTS integral to connected vehicles present an undue or unacceptable 
risk to U.S. national security when those systems are designed, 
developed, manufactured, or supplied by persons owned by, controlled 
by, or subject to the jurisdiction or direction of the PRC or Russia. 
The PRC and Russia are able to leverage legal and regulatory regimes to 
compel private companies subject to their jurisdiction, including 
carmakers and vehicle importers, to cooperate with state security and 
intelligence services. Cooperation could include providing data, 
logical access, encryption keys, and other vital technical information, 
as well as installing backdoors or bugs on equipment or in software 
updates, ultimately making vehicle equipment exploitable by foreign 
adversaries. Such privileged access potentially enables the PRC and 
Russia to exfiltrate sensitive data collected by connected vehicles 
through their components and allows remote manipulation for vehicles 
driven by U.S. persons.
    2. A statement of the significant issues raised by the public 
comments in response to the IRFA, a statement of the assessment of the 
agency of such issues, and a statement of any changes made in the final 
rule as a result of such comments. BIS received minimal comments on the 
IRFA. One commenter noted that BIS should allow flexibility in the 
rulemaking approach where minimal or negligible risk is present, citing 
the IRFA. BIS agrees that there should be flexibility where minimal or 
negligible risk is present. To accomplish this, the rule's general and 
specific authorization mechanisms allow VCS hardware importers and 
connected vehicle manufacturers to engage in otherwise prohibited 
transactions if they meet certain requirements or conditions as will be 
identified by BIS. Another commenter noted that the NPRM, Preliminary 
Regulatory Impact Analysis, and IRFA did not adequately take into 
account the disruption the rule could cause to the availability of 
relevant hardware and software. BIS acknowledges this commenter's 
concern, and notes that although the market for component systems this 
rule targets has very limited publicly available data, BIS has 
presented its best estimates for the regulatory impact of this rule and 
updated its assumptions and calculations in the Regulatory Impact 
Analysis based on publicly available information and comments to the 
NPRM.
    3. The response of the agency to any comments filed by the Chief 
Counsel for Advocacy of the Small Business Administration in response 
to the proposed rule, and a detailed statement of any change made to 
the final rule as a result of the comments. BIS did not receive 
comments from the Chief Counsel for Advocacy of the Small Business 
Association in response to the proposed rule.
    4. A description of and an estimate of the number of small entities 
to which the rule will apply or an explanation of why no such estimate 
is available. BIS anticipates that the entities primarily responsible 
for compliance with this regulation will be connected vehicle 
manufacturers and VCS hardware importers. BIS assesses, based on 
publicly available information, that the U.S. connected vehicle 
supplier network is dominated by a small set of manufacturers, likely 
none of which would qualify as small entities. Additionally, BIS 
received no comments on the number of firms that engage in covered 
software and VCS hardware transactions in the United States. Based on 
information available, BIS currently estimates that there will be 27 to 
215 connected vehicle manufacturers and VCS hardware importers 
potentially affected by this rule. This range is the U.S. Census Bureau 
Statistics of U.S. Businesses' estimate for the number of firms 
operating at least one establishment in NAICS 33611: Automobile and 
Light Duty Motor Vehicle Manufacturing, with the low estimate being the 
number of firms with 500 or more employees in total nationwide and the 
high estimate being all firms (this therefore includes an estimate of 
188 firms with fewer than 500 employees). In comparison, the Small 
Business Administration's (SBA) small business size standard for NAICS 
336110: Automobile and Light Duty Motor Vehicle Manufacturing (covering 
both manufacturer and supplier activities) uses 1,500 employees or 
fewer. Despite having this small entity estimate of 188, BIS does not 
have knowledge of which of these entities engage, or have the potential 
to engage, in covered software and VCS hardware transactions. 
Therefore, BIS is unable to estimate how many entities captured in the 
27 to 215 range are small entities and engage in covered software and 
VCS hardware transactions, and cannot estimate the percentage of 
connected vehicle manufacturers and VCS hardware importers that qualify 
as small entities.
    We also note that it is possible that an affected entity may be 
considered a small entity using SBA's size standard based on employee 
counts for the automobile manufacturing industry, but could 
nevertheless have large sales or import volumes, which is BIS's primary 
concern because the national security risks are due to the number of 
connected vehicles on public roads rather than the size of the entities 
supplying them. For example, it is possible that a VCS hardware 
importer with fewer than 1,500 employees could be importing tens of 
thousands of VCS hardware units in a calendar year.
    5. A description of the projected reporting, recordkeeping, and 
other compliance requirements of the rule, including an estimate of the 
classes of small entities which will be subject to the requirement and 
the type of professional skills necessary for preparation of the report 
or record. As stated above, connected vehicle manufacturers and VCS 
hardware importers will bear the majority of the final rule's 
compliance costs. However, BIS maintains the flexibility to grant 
general authorizations to small entities that produce or import 
connected vehicles or VCS hardware units below a certain threshold each 
calendar year. The maintenance of records in support of the general 
authorization would be a compliance requirement for these small 
entities.
    This rule requires regulated entities that cannot avail themselves 
of a general authorization to examine their automotive supply chain and 
ensure that their covered software and VCS hardware is not designed, 
developed, manufactured, or supplied by persons owned by, controlled 
by, or subject to the jurisdiction or direction of the PRC or Russia. 
Entities that do not have supply chains that contain covered software 
and VCS hardware designed, developed, manufactured, or supplied by 
persons owned by, controlled by, or subject to the jurisdiction or 
direction of the PRC or Russia must attest to BIS that this due 
diligence has been conducted through the submission of a Declaration of 
Conformity. A Declaration of Conformity entails both reporting and 
recordkeeping elements. Entities must submit to BIS the name and 
contact information of the VCS hardware

[[Page 5414]]

importer or connected vehicle manufacturer, and additional information, 
if known, based on the type of declaring entity. Entities must also 
certify to BIS that they have conducted due diligence into their supply 
chain and can attest that their covered software and VCS hardware is 
not designed, developed, manufactured, or supplied by persons owned by, 
controlled by, or subject to the jurisdiction or direction of the PRC 
or Russia. Primary business records documenting these due diligence 
efforts, including the optional use of independent or hired third-party 
research, must be maintained by the declarant and made available to BIS 
upon request.
    Entities that do manufacture or import covered software and VCS 
hardware designed, developed, manufactured, or supplied by persons 
owned by, controlled by, or subject to the jurisdiction or direction of 
the PRC or Russia have the option of applying for a specific 
authorization. Specific authorizations will be reviewed by BIS on a 
case-by-case basis and, if granted, may require greater reporting 
requirements depending on BIS's assessment of the national security 
risks posed by the transaction. For example, BIS could require annual 
third-party verification as a condition for the issuance of a specific 
authorization.
    BIS is requiring the maintenance of primary business records 
related to any transaction subject to a specific authorization, 
Declaration of Conformity, or general authorization for a period of 10 
years, consistent with IEEPA's statute of limitations. Primary business 
records include contracts, import records, commercial invoices, bills 
of sale, essential correspondence, and any other records requested by 
BIS to assess compliance with this rule.
    6. A description of the steps the agency has taken to minimize the 
significant economic impact on small entities consistent with the 
stated objectives of applicable statutes, including a statement of the 
factual, policy, and legal reasons for selecting the alternative 
adopted in the final rule and why each one of the other significant 
alternatives to the rule considered by the agency which affect the 
impact on small entities was rejected. In the NPRM, BIS listed specific 
circumstances that would qualify for a general authorization, which 
would allow regulated entities to engage in otherwise prohibited 
transactions in certain lower-risk cases. Commenters suggested a 
variety of additional circumstances that BIS should consider qualifying 
for a general authorization. In the final rule, rather than provide 
predetermined general authorizations in the rule itself, BIS will 
instead separately issue general authorizations under any circumstances 
that it feels presents lower risk, allowing BIS to maintain the 
flexibility to grant as many general authorizations as possible and 
appropriate. For example, BIS may issue a general authorization to 
further minimize the impact of this rule on small entities that produce 
or import connected vehicles or VCS hardware units below a certain 
threshold each calendar year. If small entities do not qualify for a 
general authorization but feel they have been adversely affected by the 
rule, they can apply for a specific authorization related to their 
specific circumstances. Additionally, the requirements associated with 
submitting a Declaration of Conformity have been significantly reduced 
from those proposed in the NPRM, minimizing the economic impact on all 
submitting entities. Finally, based on public comments to the NPRM, 
many of the reporting requirements have been converted to recordkeeping 
and certification provisions. These changes will make Declarations of 
Conformity less burdensome for all regulated entities.

List of Subjects in 15 CFR Part 791

    Business and industry, Communications, Computer technology, 
Critical infrastructure, Executive orders, Foreign Persons, 
Investigations, National security, Penalties, Technology, 
Telecommunications.

Elizabeth L.D. Cannon,
Executive Director, Office of Information and Communications Technology 
and Services, Bureau of Industry and Security, United States Department 
of Commerce.

    For the reasons set out in the preamble, 15 CFR 791, is amended as 
follows:

PART 791--SECURING THE INFORMATION AND COMMUNICATIONS TECHNOLOGY 
AND SERVICES SUPPLY CHAIN

0
1. The authority citation for part 791 continues to read as follows:

    Authority:  50 U.S.C. 1701et seq.; 50 U.S.C. 1601et seq.; E.O. 
13873, 84 FR 22689; E.O. 14034, 86 FR 31.

0
2. Amend part 791 by adding subpart D, consisting of Sec.  791.300 
through Sec.  791.321, to read as follows:

Subpart D--ICTS Supply Chain: Connected Vehicles

Sec.
791.300 Purpose and scope.
791.301 Definitions.
791.302 Prohibited VCS hardware transactions.
791.303 Prohibited covered software transactions.
791.304 Related prohibited transactions.
791.305 Declaration of Conformity.
791.306 General authorizations.
791.307 Specific authorizations.
791.308 Exemptions.
791.309 Appeals.
791.310 Advisory opinions.
791.311 ``Is-Informed'' notices.
791.312 Recordkeeping.
791.313 Reports to be furnished on demand.
791.314 Confidential Business Information.
791.315 Third-party verification and assessments.
791.316 Finding of violation.
791.317 Pre-penalty notice; settlement.
791.318 Penalties.
791.319 Penalty imposition.
791.320 Administrative collection; referral to United States 
Department of Justice.
791.321 Severability.

Sec.  791.300  Purpose and scope.

    The inclusion in connected vehicles of certain ICTS designed, 
developed, manufactured, or supplied by persons owned by, controlled 
by, or subject to the jurisdiction or direction of certain foreign 
adversaries poses undue or unacceptable risks to U.S. national 
security. To address these undue or unacceptable risks, it is the 
purpose of this subpart to:
    (a) Prohibit ICTS transactions that involve certain software and 
hardware that are designed, developed, manufactured, or supplied by 
persons owned by, controlled by, or subject to the jurisdiction or 
direction of the People's Republic of China (PRC) or the Russian 
Federation (Russia), as defined in Sec.  791.4, and that directly 
enable connected vehicle Automated Driving Systems (ADS) or Vehicle 
Connectivity Systems (VCS), as defined in this subpart;
    (b) Implement Declarations of Conformity to provide a mechanism for 
connected vehicle manufacturers and VCS hardware importers to 
communicate to BIS that they have conducted supply chain due diligence, 
and to confirm that no prohibited transactions, as defined in this 
subpart, have knowingly occurred;
    (c) Provide for the issuance of general authorizations for certain 
transactions that would otherwise be prohibited by this subpart, but 
where certain factors described in the authorizations reduce the risk 
to an acceptable level;
    (d) Provide a mechanism to apply for specific authorizations for 
certain transactions that would otherwise be prohibited by this 
subpart, where the undue or unacceptable risks can be

[[Page 5415]]

reasonably mitigated, based on criteria and conditions that are 
specifically constructed for each applicant; and
    (e) Incentivize connected vehicle manufacturers, VCS hardware 
importers, and related suppliers to adopt and enhance measures to help 
secure the U.S. ICTS supply chain for connected vehicles.

Sec.  791.301  Definitions.

    The following definitions apply only to this subpart. For 
additional definitions applicable to all of part 791, see 15 CFR 791.2. 
If a term is defined differently in this subpart than in 15 CFR 791.2, 
the definition listed in this section will apply to this subpart.
    Automated Driving System means hardware and software that, 
collectively, are capable of performing the entire dynamic driving task 
for a completed connected vehicle on a sustained basis, regardless of 
whether it is limited to a specific operational design domain (ODD).
    Completed connected vehicle means a connected vehicle that requires 
no further manufacturing operations to perform its intended function. 
For the purposes of this subpart, the integration of an Automated 
Driving System into a connected vehicle constitutes a manufacturing 
operation for a completed connected vehicle.
    Connected vehicle means a vehicle driven or drawn by mechanical 
power and manufactured primarily for use on public streets, roads, and 
highways, that integrates onboard networked hardware with automotive 
software systems to communicate via dedicated short-range 
communication, cellular telecommunications connectivity, satellite 
communication, or other wireless spectrum connectivity with any other 
network or device. A vehicle operated only on a rail line is not 
included in this definition. For the purposes of this subpart, a 
connected vehicle with a gross vehicle weight rating of more than 4,536 
kilograms (10,000 pounds) is not included in this definition.
    Connected vehicle manufacturer means a U.S. person who:
    (1) Manufactures or assembles completed connected vehicles in the 
United States for sale in the United States;
    (2) Imports completed connected vehicles for sale in the United 
States; and/or
    (3) Integrates ADS software on a completed connected vehicle for 
sale in the United States. A connected vehicle manufacturer may also be 
a VCS hardware importer, as defined herein, if VCS hardware has already 
been installed in a connected vehicle when the connected vehicle 
manufacturer imports it.
    Covered software means the software-based components, including 
application, middleware, and system software, in which there is a 
foreign interest, executed by the primary processing unit or units of 
an item that directly enables the function of Vehicle Connectivity 
Systems or Automated Driving Systems at the vehicle level. Covered 
software does not include firmware, which is characterized as software 
specifically programmed for a hardware device with a primary purpose of 
directly controlling, configuring, and communicating with that hardware 
device. Covered software also does not include open-source software, 
which is characterized as software for which the human-readable source 
code is available in its entirety for use, study, re-use, modification, 
enhancement, and redistribution by the users of such software, unless 
that open-source software has been modified for proprietary purposes 
and not redistributed or shared.
    Covered software also does not include software subcomponents that 
were designed, developed, manufactured, or supplied prior to March 17, 
2026, as long as those software subcomponents are not maintained, 
augmented, or otherwise altered by an entity owned by, controlled by, 
or subject to the jurisdiction or direction of a foreign adversary 
after March 17, 2026.
    Declarant means the U.S. person submitting a Declaration of 
Conformity to BIS.
    FCC ID Number means the unique alphanumeric code identifying a 
product subject to certification by the Federal Communications 
Commission composed of a:
    (1) Grantee code; and
    (2) Product code.
    Foreign interest, for purposes of this subpart, means any interest 
in property of any nature whatsoever, whether direct or indirect, by a 
non-U.S. person.
    Hardware Bill of Materials (HBOM) means a formal record the supply 
chain relationships of parts, assemblies, and components required to 
create a physical product, including information identifying the 
manufacturer, and related firmware.
    Import means, in the context of this subpart, with respect to any 
article, the entry of such article into the United States Customs 
Territory. It does not include admission of an article from outside the 
United States into a foreign-trade zone for storage pending further 
assembly in the foreign-trade zone or shipment to a foreign country. 
This definition also applies to related terms such as importing or 
imported.
    Item means a component or set of components with a specific 
function at the vehicle level. A system may also be considered an item 
if it implements a function.
    Knowingly means having knowledge of a circumstance (the term may be 
a variant, such as ``know,'' ``reason to know,'' or ``reason to 
believe''), to include not only positive knowledge that the 
circumstance exists or is substantially certain to occur, but also an 
awareness of a high probability of its existence or future occurrence. 
Such awareness is inferred from evidence of the conscious disregard of 
facts known to a person and is also inferred from a person's willful 
avoidance of facts.
    Model year means the year used to designate a discrete vehicle 
model, irrespective of the calendar year in which the vehicle was 
actually produced, provided that the production period does not exceed 
24 months.
    Person owned by, controlled by, or subject to the jurisdiction or 
direction of a foreign adversary means:
    (1) Any person, wherever located, who acts as an agent, 
representative, or employee, or any person who acts in any other 
capacity at the order, request, or under the direction or control, of a 
foreign adversary or of a person whose activities are directly or 
indirectly supervised, directed, controlled, financed, or subsidized in 
whole or in majority part by a foreign adversary;
    (2) Any person, wherever located, who is a citizen or resident of a 
foreign adversary or a country controlled by a foreign adversary, and 
is not a United States citizen or permanent resident of the United 
States;
    (3) Any corporation, partnership, association, or other 
organization with a principal place of business in, headquartered in, 
incorporated in, or otherwise organized under the laws of a foreign 
adversary or a country controlled by a foreign adversary; or
    (4) Any corporation, partnership, association, or other 
organization, wherever organized or doing business, that is owned or 
controlled by a foreign adversary, to include circumstances in which 
any person identified in paragraphs (1) through (3) of this definition 
possesses the power, direct or indirect, whether or not exercised, 
through the ownership of a majority or a dominant minority of the total 
outstanding voting interest in an entity, board representation, proxy 
voting, a special share, contractual arrangements, formal or informal 
arrangements to act in concert, or other means, to determine,

[[Page 5416]]

direct, or decide important matters affecting an entity.
    Prohibited transactions mean, collectively, the transactions 
described in Sec.  791.302 (Prohibited VCS hardware transactions), 
Sec.  791.303 (Prohibited covered software transactions), or Sec.  
791.304 (Related prohibited transactions) of this subpart.
    Sale means, in the context of this subpart, distributing for 
purchase, lease, or other commercial operations a new completed 
connected vehicle for a price, to include the transfer of completed 
connected vehicles from a connected vehicle manufacturer to a dealer or 
distributor, as those terms are defined in 49 U.S.C. 30102. This 
definition also applies to the related terms such as sell or selling.
    Software Bill of Materials (SBOM) means a formal record containing 
the details and supply chain relationships of various components used 
in building software. Software developers and vendors often create 
products by assembling existing open source and commercial software 
components. The SBOM enumerates these components in a product.
    United States means the United States of America, the States of the 
United States, the District of Columbia, and any commonwealth, 
territory, dependency, or possession of the United States, or any 
subdivision thereof, and the territorial sea of the United States.
    Vehicle Connectivity System (VCS) means a hardware or software item 
installed in or on a completed connected vehicle that directly enables 
the function of transmission, receipt, conversion, or processing of 
radio frequency communications at a frequency over 450 megahertz. VCS 
does not include a hardware or software item that exclusively:
    (1) enables the transmission, receipt, conversion, or processing of 
automotive sensing (e.g., LiDAR, radar, video, ultrawideband);
    (2) enables the transmission, receipt, conversion, or processing of 
ultrawideband communications to directly enable physical vehicle access 
(e.g., key fobs);
    (3) enables the receipt, conversion or processing of unidirectional 
radio frequency bands (e.g., global navigation satellite systems 
(GNSS), satellite radio, AM/FM radio); or
    (4) supplies or manages power for the VCS.
    VCS hardware means software-enabled or programmable components if 
they directly enable the function of and are directly connected to 
Vehicle Connectivity Systems, or are part of an item that directly 
enables the function of Vehicle Connectivity Systems, including but not 
limited to: microcontroller, microcomputers or modules, systems on a 
chip, networking or telematics units, cellular modem/modules, Wi-Fi 
microcontrollers or modules, Bluetooth microcontrollers or modules, 
satellite communication systems, other wireless communication 
microcontrollers or modules, external antennas, digital signal 
processors, and field-programmable gate arrays. VCS hardware does not 
include component parts that do not contribute to the communication 
function of VCS hardware (e.g., brackets, fasteners, plastics, and 
passive electronics, diodes, field-effect transistors, and bipolar 
junction transistors).
    VCS hardware importer means a U.S. person who imports:
    (1) VCS hardware for further manufacturing, incorporation, or 
integration into a completed connected vehicle that is intended to be 
sold or operated in the United States; or
    (2) VCS hardware that has already been installed, incorporated, or 
integrated into a connected vehicle, or a subassembly thereof, that is 
intended to be sold as part of a completed connected vehicle in the 
United States.

Sec.  791.302  Prohibited VCS hardware transactions.

    (a) VCS hardware importers are prohibited from knowingly importing 
into the United States VCS hardware that is designed, developed, 
manufactured, or supplied by persons owned by, controlled by, or 
subject to the jurisdiction or direction of the PRC or Russia.
    (b) In the context of this subpart, VCS hardware will not be 
considered to be designed, developed, manufactured, or supplied by 
persons owned by, controlled by, or subject to the jurisdiction or 
direction of the PRC or Russia, based solely on the country of 
citizenship of one or more natural persons who are employed by, 
contracted by, or otherwise similarly engaged in such actions through 
the entity designing, developing, manufacturing, or supplying the 
hardware.

Sec.  791.303  Prohibited covered software transactions.

    (a) Connected vehicle manufacturers are prohibited from knowingly 
importing into the United States completed connected vehicles that 
incorporate covered software that is designed, developed, manufactured, 
or supplied by persons owned by, controlled by, or subject to the 
jurisdiction or direction of the PRC or Russia.
    (b) Connected vehicle manufacturers are prohibited from knowingly 
selling within the United States completed connected vehicles that 
incorporate covered software that is designed, developed, manufactured, 
or supplied by persons owned by, controlled by, or subject to the 
jurisdiction or direction of the PRC or Russia.
    (c) In the context of this subpart, covered software will not be 
considered to be designed, developed, manufactured, or supplied by 
persons owned by, controlled by, or subject to the jurisdiction or 
direction of the PRC or Russia, based solely on the country of 
citizenship of one or more natural persons who are employed by, 
contracted by, or otherwise similarly engaged in such actions through 
the entity designing, developing, manufacturing, or supplying the 
software.

Sec.  791.304  Related prohibited transactions.

    Connected vehicle manufacturers who are owned by, controlled by, or 
subject to the jurisdiction or direction of the PRC or Russia, are 
prohibited from knowingly selling in the United States completed 
connected vehicles that incorporate VCS hardware or covered software, 
regardless of whether such VCS hardware or covered software is 
designed, developed, manufactured, or supplied by persons owned by, 
controlled by, or subject to the jurisdiction or direction of the PRC 
or Russia. These connected vehicle manufacturers are also prohibited 
from offering commercial services in the United States that utilize 
completed connected vehicles that incorporate ADS.

Sec.  791.305  Declaration of Conformity.

    (a) Requirements--(1) VCS hardware: A VCS hardware importer must 
submit a Declaration of Conformity to BIS prior to importing VCS 
hardware, unless otherwise specified by this subpart. The Declaration 
of Conformity for VCS hardware shall include:
    (i) The name and address of the VCS hardware importer, to include 
identifying information for an individual point of contact (including 
name, email address, and phone number);
    (ii) If known, the FCC ID Number associated with the VCS hardware 
and, if applicable, of the subcomponents contained therein;
    (iii) If known, the make and model of the connected vehicle(s) for 
which the VCS hardware is intended, or already integrated;

[[Page 5417]]

    (iv) A certification that the VCS hardware described in the 
Declaration of Conformity was not designed, developed, manufactured, or 
supplied by persons owned by, controlled by, or subject to the 
jurisdiction or direction of the PRC or Russia;
    (v) A certification that the declarant has conducted due diligence 
(with or without the use of third-party assessments) to inform the 
above certification, and the declarant or a delegated third party 
maintains documentation (either through an HBOM or otherwise) and 
third-party assessments (as applicable) in support of the above 
certification, which can be made available upon request by BIS;
    (vi) Identification as to who maintains the documentation and 
third-party assessments (as applicable) as certified above;
    (vii) A certification that the declarant has taken all possible 
measures, either contractually or otherwise, to ensure any necessary 
documentation and assessments from suppliers will be furnished to BIS 
upon request either by the declarant, or, in cases including 
confidential business information, directly by the supplier; and
    (viii) If applicable, an indication as to whether the submission is 
an update to a prior Declaration of Conformity, and if so, the date of 
the last submission.
    (2) Covered software: A connected vehicle manufacturer must submit 
a Declaration of Conformity to BIS prior to importing or selling in the 
United States completed connected vehicles that incorporate covered 
software, unless otherwise specified by this subpart. The Declaration 
of Conformity for covered software shall include:
    (i) The name and address of the connected vehicle manufacturer, to 
include information identifying an individual point of contact 
(including name, email address, and phone number);
    (ii) The make, model, trim, and Vehicle Identification Number (VIN) 
series applicable to the completed connected vehicles that incorporate 
the covered software;
    (iii) A certification that the covered software described in the 
Declaration of Conformity was not designed, developed, manufactured, or 
supplied by persons owned by, controlled by, or subject to the 
jurisdiction or direction of the PRC or Russia;
    (iv) A certification that the declarant has conducted due diligence 
(with or without the use of third-party assessments) to inform the 
above certification, and the declarant or a delegated third party 
maintains documentation (either through an SBOM or otherwise) and 
third-party assessments (as applicable) that are sufficient to 
identify, at minimum, the author name, timestamp, component name, and 
supplier name of all proprietary additions to the development of the 
covered software, which can be made available upon request by BIS;
    (v) Identification as to who maintains the documentation and third-
party assessments (as applicable) as certified above;
    (vi) A certification that the declarant has taken all possible 
measures, either contractually or otherwise, to ensure any necessary 
documentation and assessments from suppliers will be furnished to BIS 
upon request either by the declarant, or, in cases including 
confidential business information, directly by the supplier; and
    (vii) If applicable, an indication as to whether the submission is 
an update to a prior Declaration of Conformity and the date of the last 
submission.
    (b) Certification. A certification is a written statement or 
attestation within a Declaration of Conformity in Sec.  791.305(a) 
above to the U.S. Government, signed by a duly authorized designee, 
certifying under the penalties provided in 18 U.S.C. 1001, that the 
information provided is accurate and complete in all material respects 
to the best knowledge of the designee on behalf of the entity filing 
the Declaration of Conformity.
    (1) For purposes of this section, a duly authorized designee is:
    (i) In the case of a partnership, any general partner thereof;
    (ii) In the case of a corporation, the chief executive officer, or 
any officer with the authority to bind the corporation;
    (iii) An employee with authority to make certifications on behalf 
of the company as designated by a person in (i) or (ii); and
    (iv) In the case of an entity lacking partners and officers, any 
individual manager, or designated agent who has been explicitly 
authorized by the board of directors or equivalent to sign contracts 
and make legally binding agreements on behalf of the entity.
    (c) Additional Information. BIS may request additional information 
after receipt of a Declaration of Conformity.
    (d) Reliance on Third-Party Assessments. Declarants are permitted 
to utilize assessments produced by third parties to assist and prepare 
a Declaration of Conformity, in addition to ensuring ongoing compliance 
with this rule, as long as such entities conform to Sec.  791.315 of 
this subpart.
    (e) Material Changes. The following events will require an update 
to a previously submitted Declaration of Conformity:
    (1) The discovery, by the declarant, of an omission, inaccuracy, or 
error in the information provided to BIS in a prior Declaration of 
Conformity that could reasonably mislead as to the true source of VCS 
hardware or covered software in question.
    (2) Covered software updates alone do not constitute a material 
change unless an additional condition above is true.
    (f) Change in circumstance. If the connected vehicle manufacturer 
or VCS hardware importer determines that articles subject to a 
Declaration of Conformity are no longer eligible, it must, within 30 
days, cease any prohibited conduct and submit a specific authorization 
application, pursuant to Sec.  791.307(m).
    (g) Deadline to Submit Declarations of Conformity. Connected 
vehicle manufacturers and VCS hardware importers shall submit 
Declarations of Conformity prior to the first sale of the subject 
connected vehicle in the United States, prior to the import of VCS 
hardware as specified in this section, and following discovery of a 
material change that makes a prior Declaration of Conformity no longer 
accurate.
    (1) Connected vehicle manufacturers shall submit a Declaration of 
Conformity at least 60 days prior to the first import or first sale of 
each model year of completed connected vehicle that incorporates 
covered software. Declarants may submit a single Declaration of 
Conformity for all connected vehicles that use the same covered 
software, grouped by make, model, and VIN series.
    (2) VCS hardware importers shall submit a Declaration of Conformity 
at least 60 days prior to the first import of VCS hardware for each 
model year for units associated with a vehicle model year, or calendar 
year for units not associated with a vehicle model year. VCS hardware 
importers may submit a single Declaration of Conformity detailing all 
VCS hardware models that will be imported in the model year or calendar 
year.
    (3) Connected vehicle manufacturers and VCS hardware importers must 
notify BIS of any material change to the information conveyed in a 
previously submitted Declaration of Conformity by submitting a revised 
Declaration of Conformity within 60 days following the discovery of 
such change. A declarant's obligation to inform BIS of material changes 
to the information ceases 10 years after submission of the

[[Page 5418]]

original Declaration of Conformity for that model year or calendar 
year.
    (h) Annual updates to Declarations of Conformity. If applicable, 
connected vehicle manufacturers and VCS hardware importers may, in lieu 
of submitting a new Declaration of Conformity, submit a confirmation 
that the prior Declaration of Conformity remains accurate and that 
associates the relevant new model year of vehicles (if known) in lieu 
of submitting a new Declaration of Conformity.
    (1) Where there are no material changes to the covered software for 
a subsequent model year of completed connected vehicles, the connected 
vehicle manufacturer may submit a confirmation no later than one year 
after the previous submission, certifying that the prior information 
remains accurate, and that associates the new relevant model year of 
vehicles to an existing Declaration of Conformity.
    (2) Where there are no material changes to the VCS hardware for a 
subsequent model year of completed connected vehicles (if known) or 
calendar year, the VCS hardware importer may submit a confirmation no 
later than one year after the previous submission, certifying that the 
prior information remains accurate, and that associates the new 
relevant model year of vehicles (if known) to an existing Declaration 
of Conformity.
    (i) Submission Instructions. The declarant shall follow the 
electronic filing instructions on BIS's website, https://www.bis.gov/OICTS.
    (j) Verification. BIS, in its sole discretion, may choose to verify 
Declarations of Conformity that have been submitted by VCS hardware 
importers and connected vehicle manufacturers.
    (k) Connected vehicle introduced by means of false information in 
the Declaration of Conformity. Any person who submits false information 
in a Declaration of Conformity, with knowledge that such information is 
false, and engages in one or more prohibited transactions, may incur 
penalties as defined in Sec.  791.318.
    (l) Exemptions. No Declaration of Conformity is required if the 
only foreign interest in a transaction arises from a foreign person's 
equity ownership of a U.S. person, whether through ownership of public 
shares or otherwise. This exemption has no effect on transactions where 
a foreign interest arises from a foreign entity's design, development, 
manufacture, or supply of VCS hardware or covered software for a U.S. 
person or where equity ownership allows a foreign person to exercise 
control over the U.S. person. Further, this exemption has no effect on 
the analysis of whether or not an entity is owned by, controlled by, or 
subject to the jurisdiction or direction of the PRC or Russia.

Sec.  791.306  General authorizations.

    (a) Overview. VCS hardware importers and connected vehicle 
manufacturers may rely on a general authorization to engage in an 
otherwise prohibited transaction if they meet the stated requirements 
or conditions identified in the general authorization and are not 
subject to the restrictions identified in this section. Records 
demonstrating compliance with the terms of general authorizations must 
be retained for a period of 10 years, as specified in Sec.  791.312, 
and be made available to BIS upon request.
    (b) General course of procedure. BIS may issue general 
authorizations for certain types of transactions subject to the 
prohibitions contained in this subpart. In determining whether to issue 
a general authorization, BIS may consider any information or material 
BIS deems relevant and appropriate, classified or unclassified, from 
any Federal department or agency, or from any other source. BIS will 
publish general authorizations it issues under this subpart on its 
website (https://www.bis.gov/OICTS), and will also publish them in the 
Federal Register.
    (c) Relationship with specific authorizations. BIS will not grant 
specific authorizations for transactions in which a general 
authorization is applicable.
    (d) Instructions. Persons availing themselves of certain general 
authorizations may be required to file reports and statements in 
accordance with the instructions specified by BIS in each general 
authorization. Failure to fulfill instructions provided in a general 
authorization may nullify the authorization and result in a violation 
of the applicable prohibitions that may be subject to BIS enforcement 
action.
    (e) Change in circumstance. Unless otherwise prescribed by BIS, 
within 30 days of discovering a change in circumstance, the VCS 
hardware importer or connected vehicle manufacturer must assess if it 
still qualifies for the general authorization.
    (1) If the connected vehicle manufacturer or VCS hardware importer 
determines that articles subject to a general authorization have been 
used outside the conditions of the general authorization, it must, 
within 30 days of such a determination, cease any prohibited conduct, 
conduct an internal inquiry, and submit to BIS a report identifying any 
prohibited transactions, the number of connected vehicles or VCS 
hardware units implicated, and proposed remedial measures.
    (f) Verification. BIS may, at its discretion, seek verification 
from VCS hardware importers and connected vehicle manufacturers as to 
whether they are relying on a general authorization, and if so, may 
request documentation to verify compliance with this subpart.
    (g) Restrictions. VCS hardware importers and connected vehicle 
manufacturers may not avail themselves of any general authorization if 
any one or more of the following apply:
    (1) BIS has notified, either directly or through an advisory 
opinion, the VCS hardware importer or connected vehicle manufacturer is 
not eligible for a general authorization; or
    (2) The VCS hardware importer or connected vehicle manufacturer is 
owned by, controlled by, or subject to the jurisdiction or direction of 
the PRC or Russia.

Sec.  791.307  Specific authorizations.

    (a) Prohibited transactions authorized. Upon receipt of a valid and 
complete application, BIS may grant specific authorizations to permit a 
VCS hardware importer or connected vehicle manufacturer to engage in an 
otherwise prohibited transaction.
    (b) Policy. It is the policy of BIS not to review applications for 
specific authorizations for transactions that are otherwise permitted 
by a general authorization.
    (c) Applications for specific authorizations. Applications for 
specific authorizations shall include, at a minimum, a description of 
the nature of the otherwise prohibited transaction(s), including the 
following:
    (1) The identity of the parties engaged in the transaction, 
including relevant corporate identifiers and information sufficient to 
identify the ultimate beneficial ownership of the transacting parties;
    (2) An overview of the VCS hardware or covered software that is 
designed, developed, manufactured, or supplied by a person owned by, 
controlled by, or subject to the jurisdiction or direction of the PRC 
or Russia, including persons responsible for assembling and packaging 
VCS hardware or covered software;
    (3) If known, the make, model, and trim of the connected vehicle(s) 
in which the VCS hardware or covered software will be integrated;
    (4) The intended function of the VCS hardware or covered software;
    (5) Documentation to support the information contained in the

[[Page 5419]]

application, such as any ISO/SAE 21434 Threat Analysis and Risk 
Assessments (if available);
    (6) An assessment of the applicant's ability to limit PRC or 
Russian government access to, or influence over the design, 
development, manufacture, or supply of the VCS hardware or covered 
software;
    (7) Security standards used by the applicant with respect to the 
VCS hardware or covered software; and
    (8) Other actions and proposals such as technical controls (e.g., 
software validation) or operational controls (e.g., physical and 
logical access monitoring procedures) the applicant intends to take to 
mitigate undue or unacceptable risk, if applicable.
    (d) Application submission procedures and timing. VCS hardware 
importers or connected vehicle manufacturers who seeks to engage in an 
otherwise prohibited transaction must submit an application for a 
specific authorization in writing prior to engaging in the transaction, 
and await a decision from BIS prior to engaging in the transaction. 
Specific authorization submissions must be delivered to BIS as 
specified on its website, https://www.bis.gov/OICTS.
    (e) Additional conditions. Only one application for a specific 
authorization should be submitted to BIS for each otherwise prohibited 
transaction; multiple parties submitting an application for a specific 
authorization for the same transaction may result in processing delays.
    (f) Information to be supplied. An applicant may be required to 
furnish additional information as BIS deems necessary to assist in 
making a decision. BIS may request an oral briefing by the applicant 
and any other relevant parties. The applicant may present additional 
information concerning an application for a specific authorization at 
any time before BIS issues its decision regarding the application.
    (g) Review and decisions. Applications for specific authorizations 
will be reviewed on a case-by-case basis, and conditions to be applied 
to each specific authorization may vary as needed to mitigate any risk 
that arises as a result of the otherwise prohibited transaction. Such 
review will include an evaluation of the risks and potential mitigation 
measures proposed by the applicant for the particular transaction. The 
risks that BIS may consider include, but are not limited to, risks of 
data exfiltration from, and remote manipulation or operation of, the 
connected vehicle and the extent and nature of foreign adversary 
involvement in the design, development, manufacture, or supply of the 
VCS hardware or covered software. Mitigation may include the 
applicant's ability to limit PRC or Russian government access to, or 
influence over the design, development, manufacture, or supply of the 
VCS hardware or covered software; security standards used by the 
applicant and if such standards can be validated by BIS or a third 
party; and other actions or proposals the applicant intends to take to 
mitigate undue or unacceptable risk. BIS will advise each applicant in 
writing of the decision respecting the filed application. Decisions 
regarding specific authorizations will not be made publicly available.
    (h) Processing period. BIS will provide a decision regarding an 
application for a specific authorization within 90 days unless BIS 
determines, in its sole discretion, and notifies the applicant within 
that 90-day period, that additional time is required. Failure or delays 
by the applicant in submitting additional information requested by BIS 
may delay or prevent BIS's ability to issue a specific authorization.
    (i) Scope. (1) Unless otherwise specified in the authorization, a 
specific authorization applies only to the transaction:
    (i) Between the parties identified in the specific authorization;
    (ii) With respect to the otherwise prohibited transaction(s) 
described in the authorization; and
    (iii) If the conditions specified in the specific authorization are 
satisfied. The applicant must inform any other parties identified in 
the specific authorization of the authorization's scope and specific 
conditions.
    (2) As a condition for the issuance of any specific authorization, 
BIS may require the applicant to submit third-party assessments or 
SBOMs/HBOMs as may be prescribed in the specific authorization or 
otherwise communicated to the applicant by BIS. Reports should be sent 
in accordance with the instructions provided in the applicable specific 
authorization.
    (3) Any materially false or misleading representation in or 
otherwise associated with the application, or in any document submitted 
in connection with the application under this section, shall cause the 
specific authorization to be deemed void as of the date of issuance, 
and the applicant may incur penalties as specified in Sec.  791.318.
    (j) Verification. BIS may establish, in its sole discretion as 
conditions for receiving a specific authorization, any compliance, 
auditing, or verification requirements.
    (k) Effect of denial. BIS's denial of a specific authorization may 
be appealed as described in Sec.  791.309. BIS's denial of a prior 
specific authorization does not preclude parties from filing an 
application for a specific authorization for a separate otherwise 
prohibited transaction. The applicant may at any time, by written 
correspondence, request reconsideration of the denial of an application 
based on new material facts or changed circumstances.
    (l) Effect of specific authorization. (1) No specific authorization 
issued under this subpart, or otherwise issued by BIS, permits or 
validates any prohibited transaction effectuated prior to the issuance 
of such specific authorization unless specifically provided for in the 
specific authorization.
    (2) No regulation, ruling, instruction, or authorization permits 
any prohibited transaction under this subpart unless the regulation, 
ruling, instruction or authorization is issued by BIS and specifically 
refers to this subpart. No regulation, ruling, instruction, or 
authorization referring to this subpart shall be deemed to permit any 
prohibited transaction prohibited by any provision of this subpart 
unless the regulation, ruling, instruction, or authorization 
specifically refers to such provision. Any specific authorization 
permitting any otherwise prohibited transaction has the effect of 
removing those prohibitions from the transaction, but only to the 
extent specifically stated by the terms of the specific authorization. 
Unless the specific authorization otherwise specifies, such an 
authorization does not create any right, duty, obligation, claim, or 
interest in, or with respect to, any property that would not otherwise 
exist under ordinary principles of law.
    (3) Nothing contained in this subpart shall be construed to 
supersede the requirements established under any other provision of law 
or to relieve a person from any requirement to obtain an authorization 
from another department or agency of the U.S. Government in compliance 
with applicable laws and regulations subject to the jurisdiction of 
that department or agency.
    (4) Specific authorizations will be approved for a duration of no 
less than one (1) model year or calendar year except as provided in 
Sec.  791.307(m).
    (m) Exceptions. BIS may approve specific authorizations for a 
period of less than one (1) calendar year on a case-by-case basis under 
the following circumstances:
    (1) 2027 model years that include covered software and are actively 
being

[[Page 5420]]

sold or imported as of the effective date of this rule;
    (2) Covered software and VCS hardware supply chains that are 
affected by force majeure events;
    (3) As a result of a corporate merger, investment, acquisition, 
joint venture, or conversion of equity (such as from debt) that occurs 
during model year production;
    (4) As a result of the closure or relocation of facilities involved 
in the production of covered software or VCS hardware; and
    (5) Other instances as determined by BIS.
    (n) Records. Persons receiving a specific authorization are 
required to maintain records for a period of 10 years, as required in 
Sec.  791.312, as well as to submit reports and statements in 
accordance with the instructions specified in each specific 
authorization.
    (o) Amendment, modification, or rescission. Except as otherwise 
provided by law, any specific authorization or instructions issued 
thereunder may be amended, modified, or rescinded by BIS at any time.

Sec.  791.308  Exemptions.

    (a) VCS hardware importers may engage in prohibited transactions 
described in Sec.  791.302 without an authorization as required under 
Sec. Sec.  791.306 and 791.307, and are exempt from submitting 
Declarations of Conformity with respect to all other transactions, as 
described in Sec.  791.305 provided that:
    (1) For VCS hardware units not associated with a vehicle model 
year, the import of the VCS hardware occurs prior to January 1, 2029; 
or
    (2) The VCS hardware is associated with a vehicle model year prior 
to 2030, the VCS hardware is imported as part of a connected vehicle 
with a model year prior to 2030, or the VCS hardware is imported for 
purposes of repair or warranty for a connected vehicle with a model 
year prior to 2030.
    (b) Connected vehicle manufacturers may engage in prohibited 
transactions described in Sec.  791.303 without authorization as 
required under Sec. Sec.  791.306 or 791.307 and are exempt from 
submitting Declarations of Conformity with respect to all other 
transactions, as described in Sec.  791.305, provided that the 
completed connected vehicle that incorporates covered software 
described in Sec.  791.303(a)(1) was manufactured prior to model year 
2027.
    (c) Connected vehicle manufacturers who are owned by, controlled 
by, or subject to the jurisdiction or direction of the PRC or Russia 
may engage in prohibited transactions described in Sec.  791.304 
without authorization as required under Sec. Sec.  791.306 or 791.307, 
and are exempt from submitting Declarations of Conformity to all other 
transactions, provided that the completed connected vehicle that 
incorporates VCS hardware and/or covered software was manufactured 
prior to model year 2027.

Sec.  791.309  Appeals.

    (a) Scope. Any person claiming to be directly and adversely 
affected by any of the listed administrative actions taken by BIS 
pursuant to this subpart may appeal to the Under Secretary for 
reconsideration of that administrative action. Only the following types 
of administrative actions are subject to the appeals procedures 
described in this subpart:
    (1) Denial of an application for a specific authorization;
    (2) Suspension or revocation of an issued specific authorization; 
or
    (3) Determination of ineligibility for a general authorization.
    (b) Designated appeals reviewer and coordinator. The Under 
Secretary may delegate to the Deputy Under Secretary of Commerce for 
Industry and Security or to another BIS official the authority to 
review and decide the appeal, and to exercise any other function of the 
Under Secretary under this section. In addition, the Under Secretary 
may designate any employee of BIS to be an appeals coordinator to 
assist in the review and processing of an appeal under this subpart. 
The responsibilities of an appeals coordinator may include presiding 
over informal hearings.
    (c) Appeals procedures--(1) Filing. An appeal under this subpart 
must be submitted to the Under Secretary by email or at the following 
address: Bureau of Industry and Security, U.S. Department of Commerce, 
Room 3898, 14th Street and Pennsylvania Avenue NW, Washington, DC 20230 
no later than 45 days after the date appearing on the written notice of 
administrative action.
    (2) Content of appeal. The appeal must include a full written 
statement in support of the appellant's position. The appeal must 
include a precise statement of the reasons that the appellant believes 
that the administrative action has a direct and adverse effect and 
should be reversed or modified. The Under Secretary or the designated 
official may request additional information that would be helpful in 
resolving the appeal, and may accept additional submissions from the 
appellant. The Under Secretary or the designated official will not 
ordinarily accept any submission filed voluntarily more than 30 days 
after the filing of the appeal.
    (3) Request for informal hearing. In addition to the written 
statement submitted in support of an appeal, an appellant may request, 
in writing, at the time an appeal is filed, an opportunity for an 
informal hearing. A hearing is not required, and the Under Secretary or 
the designated official may grant or deny a request for an informal 
hearing at the Under Secretary or the designated official's sole 
discretion. Any hearings will be held in the District of Columbia 
unless the Under Secretary or the designated official determines, based 
upon good cause shown, that another location would be preferable.
    (d) Informal hearing procedures--(1) Presentations. If a hearing 
request is granted, the Under Secretary or the designated official may 
provide an opportunity for the appellant to make an oral presentation 
at an informal hearing based on the materials previously submitted by 
the appellant or made available by BIS. The Under Secretary or the 
designated official may require that any facts in controversy be 
covered by an affidavit or testimony given under oath or affirmation.
    (2) Evidence. The rules of evidence prevailing in courts of law do 
not apply, and all evidentiary material deemed by the Under Secretary 
or the designated official to be relevant and material to the 
proceeding, and not unduly repetitious, will be received and 
considered.
    (3) Procedural questions. The Under Secretary or the designated 
official has the authority to limit the number of people attending the 
hearing, to impose any time or other limitations deemed reasonable, and 
to determine all procedural questions.
    (4) Transcript. A transcript of an informal hearing shall not be 
made, unless the Under Secretary or the designated official determines 
that the national interest or other good cause warrants it, or if the 
appellant requests a transcript. If the appellant requests, and the 
Under Secretary or the designated official approves the taking of, a 
transcript, the appellant will be responsible for paying all expenses 
related to production of the transcript.
    (5) Report. Any person designated by the Under Secretary to conduct 
an informal hearing shall submit a written report containing a summary 
of the hearing and recommended action to the Under Secretary.
    (e) Amicus filings. At the request of the appellant, parties not 
subject to the administrative action under appeal may submit amicus 
filings in support of the appellant prior to any informal hearing.

[[Page 5421]]

    (f) Decisions. In addition to the documents specifically submitted 
in connection with the appeal, the Under Secretary or the designated 
official may consider any recommendations, reports, or other relevant 
documents available to BIS in determining the appeal, but shall not be 
bound by any such information, nor prevented from considering any other 
relevant information, or consulting with any other person or groups, in 
making a decision. The Under Secretary or the designated official may 
adopt any other procedures deemed necessary and reasonable for 
considering an appeal, including by providing the appellant with an 
interim or proposed decision and offering the appellant an opportunity 
to provide comments. The Under Secretary or the designated official 
shall decide an appeal within a reasonable time after receipt of the 
appeal. The decision shall be issued to the appellant in writing and 
contain a statement of the reasons for the action and address any 
arguments contrary to the decision presented by the appellant. The 
decision of the Under Secretary or the designated official shall be 
final.
    (g) Effect of appeal. Acceptance and consideration of an appeal 
shall not affect any administrative action, pending or in effect, 
unless the Under Secretary or the designated official, upon request by 
the appellant and with opportunity for a response, grants a stay.

Sec.  791.310  Advisory opinions.

    (a) VCS hardware importers and connected vehicle manufacturers may 
request an advisory opinion from BIS to determine whether a prospective 
transaction is subject to a prohibition, or requirement under this 
subpart. The requestor must have a direct financial interest in the 
substance of the question(s) presented, and the submission must include 
the name of the parties to the transaction.
    (b) Requests for advisory opinions must be delivered to BIS as 
specified on its website, https://www.bis.gov/OICTS.
    (c) Persons submitting advisory opinion requests are encouraged to 
provide as much information as possible to assist BIS in making a 
determination, to include the following information:
    (1) The name, title, telephone, and email address of the submitter;
    (2) The submitter's complete address, comprised of street address, 
city, state, country, and postal code;
    (3) All available information identifying the parties to the 
prospective transaction;
    (4) Information regarding the VCS hardware and/or covered software 
and any descriptive literature, brochures, technical specifications, or 
papers that provide sufficient technical detail to enable BIS to verify 
whether the prospective transaction would constitute a prohibited 
transaction as defined in this subpart;
    (5) For connected vehicle manufacturers: the make, model, and trim 
level, or other identifying information of the completed connected 
vehicle;
    (6) For VCS hardware importers: the identification of the system; 
and, if known, the make, model, and trim of the group of completed 
connected vehicles for which the equipment is intended; and
    (7) Any other information that the submitter believes to be 
material to the prospective transaction.
    (d) BIS may consider third-party materials on a case-by-case basis 
as part of its review of an advisory opinion request. Each person that 
submits an advisory opinion request or information in support of 
another party's advisory opinion request shall provide any additional 
information or documents that BIS may thereafter request in its review 
of the matter.
    (e) BIS shall issue an advisory opinion within 60 days of the 
request unless it notifies the requester within that 60-day period that 
more time is required. Failure or delays by the applicant in submitting 
additional information requested by BIS may delay or prevent BIS's 
ability to issue an advisory opinion.
    (f) Each advisory opinion can be relied upon by the requesting 
party or parties to the extent the disclosures made pursuant to this 
subpart were accurate and complete and to the extent the disclosures 
continue to reflect circumstances accurately and completely after the 
date of the issuance of the advisory opinion. An advisory opinion will 
not restrict enforcement actions by any agency other than BIS. It will 
not affect a requesting party's obligations to any other agency or 
under any statutory or regulatory provision other than those 
specifically discussed in the advisory opinion.
    (g) BIS may publish on its website an advisory opinion that may be 
of broad interest to the public, with redactions where necessary to 
protect Confidential Business Information.
    (h) BIS may, at its sole discretion, decline to issue an advisory 
opinion within 60 days after receipt of the request.

Sec.  791.311  ``Is-Informed'' notices.

    (a) BIS may inform VCS hardware importers or connected vehicle 
manufacturers either individually by specific notice or, for larger 
groups, through a separate notice published in the Federal Register, 
that a specific authorization is required because an activity could 
constitute a prohibited transaction.
    (b) Specific notice that a specific authorization is required may 
be given only by, or at the direction of, the Under Secretary or a BIS 
official designated by the Under Secretary.

Sec.  791.312  Recordkeeping.

    (a) Except as otherwise provided herein, or through subsequent 
communication with BIS, VCS hardware importers, connected vehicle 
manufacturers, and/or third-party assessors (if applicable) shall keep 
all primary business records related to the execution of each 
transaction for which a Declaration of Conformity, general 
authorization, or specific authorization would be required under 
Sec. Sec.  791.305, 791.306, or 791.307. Primary business records 
include contracts, import records, commercial invoices, bills of sale, 
corporate policy documentation, and reports produced by third parties 
created for the purposes of compliance with this rule. Regardless of 
whether these transactions are effectuated pursuant to a general 
authorization, specific authorization, or otherwise, such records shall 
be available for examination for at least 10 years after the date of 
such transactions.
    (b) Third-party assessors are required to maintain all records 
relating to third-party verification or assessment of a U.S. person's 
compliance with this rule.

Sec.  791.313  Reports to be furnished on demand.

    (a) VCS hardware importers and connected vehicle manufacturers must 
furnish, under oath, in the form of reports or as otherwise specified 
by BIS, and at any time as may be required by BIS, complete information 
regarding any transaction involving the import of VCS hardware or the 
import or sale of completed connected vehicles incorporating covered 
software. This requirement applies regardless of whether such 
transaction is affected pursuant to a general or specific authorization 
or otherwise, subject to the provisions of this subpart. BIS may 
require that such reports include the production of any books, 
contracts, letters, papers, or other hard copy or electronic documents 
relating to any transactions, in the custody or control of the persons 
required to make such reports. Reports being submitted to BIS pursuant 
to this section must be retained for a period of 10 years, as specified 
in Sec.  791.312.

[[Page 5422]]

    (b) BIS may, through any person or agency, conduct investigations, 
hold hearings, administer oaths, examine witnesses, receive evidence, 
take depositions, and require by subpoena the attendance and testimony 
of witnesses and the production of any books, contracts, letters, 
papers, and other hard copy or electronic documents relating to any 
matter under investigation, regardless of whether any report has been 
required or filed in connection therewith.
    (c) Persons providing records to BIS pursuant to this section shall 
follow the electronic filing instructions on BIS's website, https://www.bis.gov/OICTS.

Sec.  791.314  Confidential Business Information.

    (a) Confidential business information. Confidential Business 
Information is defined in 19 CFR 201.6.
    (b) Submission procedures. Any information or material submitted to 
BIS which the entity or any other party desires to submit in confidence 
as a part of a Declaration of Conformity, specific authorization 
application, advisory opinion request, record to be furnished on 
demand, or is otherwise Confidential Business Information should be 
contained within a file beginning its name with the characters ``CBI.'' 
Any page containing Confidential Business Information must be clearly 
marked ``CONFIDENTIAL BUSINESS INFORMATION'' on the top of the page. 
Any pages not containing Confidential Business Information should not 
be marked. By submitting information or material identified as 
Confidential Business Information, the entity or other party represents 
that the information is exempted from public disclosure, either by the 
Freedom of Information Act (5 U.S.C. 552 et seq.) or by another 
specific statutory exemption. Any request for Confidential Business 
Information treatment must be accompanied at the time of submission by 
a statement justifying non-disclosure and referring to the specific 
legal authority claimed.
    (c) Confidentiality of information. Confidentiality of information 
is subject to 15 CFR 791.102.

Sec.  791.315  Third-Party Verification and Assessments.

    (a) Overview. U.S persons subject to this subpart may hire, 
consult, or otherwise contract with a third-party to ensure compliance 
with this rule. In certain cases, the use of a third-party assessor 
will be mandated in the terms of an approved specific authorization.
    (b) Third-Party Assessors. U.S. persons should determine whether a 
third-party assessor is qualified and competent, such as through 
industry certification or standard, to examine, to verify, and attest 
to the U.S. person's compliance with and the effectiveness of the 
security requirements implemented for VCS hardware or covered software 
transactions.
    (1) The third-party assessor cannot be a person owned by, 
controlled by, or subject to the jurisdiction or direction of the PRC 
or Russia.
    (2) In determining the reasonableness of an entity's reliance on a 
third-party assessment, BIS will consider the independence of the 
third-party, including any financial incentives between the third-party 
and the entity.
    (c) Scope. The use of a third-party assessor for U.S. persons 
submitting Declarations of Conformity is voluntary; however, if 
utilized, BIS recommends such third-party assessments to:
    (1) identify and examine the VCS hardware importer or connected 
vehicle manufacturer's VCS hardware and covered software supply chains 
in relation to the prohibitions in this subpart;
    (2) examine compliance relating to each Declaration of Conformity, 
general authorization, or specific authorization pursuant to which an 
entity is conducting transactions;
    (3) use a reliable methodology to conduct the third-party 
verification; and
    (4) acknowledge that the assessment may be used by the U.S. 
government to verify compliance.
    (d) Assessment. To utilize third-party verification to fulfill the 
due diligence requirement for a Declaration of Conformity, the third-
party assessor should prepare and submit a written report to the VCS 
hardware importer or connected vehicle manufacturer. The third-party 
assessment should at minimum:
    (1) identify the suppliers of each relevant component and describe 
the nature of any foreign interest;
    (2) describe the methodology undertaken, including the policies and 
other documents reviewed, personnel interviewed, and any facilities, 
equipment, or systems examined;
    (3) describe the effectiveness of the VCS hardware importer or 
connected vehicle manufacturer's corporate policies related to 
compliance with this rule;
    (4) for VCS hardware importers or connected vehicle manufacturers 
conducting transactions under the auspices of a general authorization 
or specific authorization, describe any vulnerabilities or deficiencies 
in the implementation of the authorization; and
    (5) recommend any improvements or changes to policies, practices, 
or other aspects to maintain compliance with this subpart, as 
applicable to each transaction.
    (e) Recordkeeping. The third-party assessor must comply with all 
recordkeeping requirements, pursuant to Sec.  791.312.

Sec.  791.316  Finding of Violation.

    (a) When issued. (1) BIS may issue an initial finding of violation 
that identifies a violation if BIS:
    (i) Determines that there has occurred a violation of any provision 
of this subpart, or a violation of the provisions of any exemption, 
general authorization, specific authorization, regulation, order, 
directive, instruction, or prohibition issued by or pursuant to the 
direction or authorization of the Secretary pursuant to this subpart or 
otherwise under IEEPA;
    (ii) Considers it important to document the occurrence of a 
violation; and
    (iii) Concludes that an administrative response is warranted but 
that a civil monetary penalty is not the most appropriate response.
    (2) An initial finding of violation shall be in writing and may be 
issued whether or not another agency has taken any action with respect 
to the matter.
    (b) Response--(1) Right to respond. An alleged violator may contest 
an initial finding of violation by providing a written response to BIS.
    (2) Deadline for response; default determination. A response to an 
initial finding of violation must be made within 30 days as set forth 
in paragraphs (b)(2)(i) and (ii) of this section. The failure to submit 
a response within 30 days shall be deemed to be a waiver of the right 
to respond, and the initial finding of violation will become final and 
will constitute final agency action. The violator may seek judicial 
review of that final agency action in Federal district court.
    (i) Computation of time for response. A response to an initial 
finding of violation must be electronically transmitted on or before 
the 30th day after the date of delivery by BIS.
    (ii) Extensions of time for response. If a due date falls on a 
Federal holiday or weekend, that due date is extended to include the 
following business day. Any other extensions of time will be granted, 
at the discretion of BIS, only upon specific request to BIS.
    (3) Form and method of response. A response to an initial finding 
of violation need not be in any particular form, but it must be 
typewritten and signed by the alleged violator or a

[[Page 5423]]

representative thereof, contain information sufficient to indicate that 
it is in response to the initial finding of violation, and include the 
BIS identification number listed on the initial finding of violation. A 
digital signature is acceptable.
    (4) Information that should be included in response. Any response 
should set forth in detail why the alleged violator either believes 
that a violation of the provisions of this subpart did not occur and/or 
why a finding of violation is otherwise unwarranted under the 
circumstances. The response should include all documentary or other 
evidence available to the alleged violator that supports the arguments 
set forth in the response. BIS will consider all relevant materials 
submitted in the response.
    (c) Determination--(1) Determination that a finding of violation is 
warranted. If, after considering the response, BIS determines that a 
final finding of violation should be issued, BIS will issue a final 
finding of violation that will inform the violator of its decision and 
may include a responsive administrative action other than a civil 
monetary penalty. Any action taken in a final finding of violation 
shall constitute final agency action. The violator has the right to 
seek judicial review of that final agency action in Federal district 
court.
    (2) Determination that a finding of violation is not warranted. If, 
after considering the response, BIS determines a finding of violation 
is not warranted, then BIS will inform the alleged violator of its 
decision not to issue a final finding of violation.

Sec.  791.317  Pre-penalty notice; settlement.

    (a) When required. If BIS has reason to believe that there has 
occurred a violation of any provision of this subpart or a violation of 
the provisions of any exemption, general authorization, specific 
authorization, regulation, order, directive, instruction, or 
prohibition issued by or pursuant to the direction or authorization of 
the Secretary pursuant to this subpart or otherwise under IEEPA and 
determines that a civil monetary penalty is warranted, BIS will issue a 
pre-penalty notice informing the alleged violator of BIS's intent to 
impose a monetary penalty. A pre-penalty notice shall be in writing and 
issued either electronically or by mail to the alleged violator. The 
pre-penalty notice may be issued whether or not another agency has 
taken any action with respect to the matter. BIS will consider any 
voluntary disclosures of a violation prior to issuing such notice.
    (b) Response--(1) Right to respond. An alleged violator may respond 
to a pre-penalty notice in writing to BIS.
    (2) Deadline for response. A response to a pre-penalty notice must 
be made within 30 days as set forth below. The failure to submit a 
response within 30 days shall be deemed to be a waiver of the right to 
respond.
    (i) Computation of time for response. A response to a pre-penalty 
notice must be electronically transmitted on or before the 30th day 
after the date of delivery by BIS.
    (ii) Extensions of time for response. If a due date falls on a 
Federal holiday or weekend, that due date is extended to include the 
following business day. Any other extensions of time will be granted, 
at the discretion of BIS, only upon specific request to BIS.
    (3) Form and method of response. A response to a pre-penalty notice 
need not be in any particular form, but it must be typewritten and 
signed by the alleged violator or a representative thereof, contain 
information sufficient to indicate that it is in response to the pre-
penalty notice, and include the BIS identification number listed on the 
pre-penalty notice. A digital signature is acceptable.
    (4) Information that should be included in response. Any response 
should set forth in detail why the alleged violator either believes 
that a violation of the provisions of this subpart did not occur and/or 
why a civil monetary penalty is otherwise unwarranted under the 
circumstances. The response should include all documentary or other 
evidence available to the alleged violator that supports the arguments 
set forth in the response. BIS will consider all relevant materials 
submitted in the response.
    (c) Representation. A representative of the alleged violator may 
act on behalf of the alleged violator, but any oral communication with 
BIS prior to a written submission regarding the specific allegations 
contained in the pre-penalty notice must be preceded by a written 
letter of representation, unless the pre-penalty notice was served upon 
the alleged violator in care of the representative.
    (d) Settlement. Settlement discussions may be initiated by BIS, the 
alleged violator, or the alleged violator's authorized representative.

Sec.  791.318  Penalties.

    (a) Section 206 of the International Emergency Economic Powers Act 
(50 U.S.C. 1705) (IEEPA) is applicable to violations of the provisions 
of any general authorization, specific authorization, regulation, 
order, directive, instruction, or prohibition issued by or pursuant to 
the direction or authorization of the Secretary of Commerce (Secretary) 
pursuant to this subpart or otherwise under IEEPA.
    (1) A civil penalty not to exceed the amount set forth in section 
206 of IEEPA may be imposed on any person who violates, attempts to 
violate, conspires to violate, or causes a violation of any exemption, 
general authorization, specific authorization, regulation, order, 
directive, instruction, or prohibition issued under this subpart.
    (2) A person who willfully commits, willfully attempts to commit, 
willfully conspires to commit, or aids or abets in the commission of a 
violation of any exemption, general authorization, specific 
authorization, regulation, order, directive, instruction, or 
prohibition issued under this subpart is subject to criminal penalties 
and may, upon conviction, be fined not more than $1,000,000, or if a 
natural person, be imprisoned for not more than 20 years, or both.
    (b) The civil penalties provided in IEEPA are subject to adjustment 
pursuant to the Federal Civil Penalties Inflation Adjustment Act of 
1990 (Pub. L. 101-410, as amended, 28 U.S.C. 2461 note).
    (c) The criminal penalties provided in IEEPA are subject to 
adjustment pursuant to 18 U.S.C. 3571.
    (d) Pursuant to 18 U.S.C. 1001, whoever, in any matter within the 
jurisdiction of the executive, legislative, or judicial branch of the 
U.S. Government, knowingly and willfully falsifies, conceals, or covers 
up by any trick, scheme, or device a material fact; or makes any 
materially false, fictitious, or fraudulent statement or 
representation; or makes or uses any false writing or document knowing 
the same to contain any materially false, fictitious, or fraudulent 
statement or entry shall be fined under title 18, United States Code, 
imprisoned, or both.
    (e) Violations of this subpart may also be subject to other 
applicable laws and therefore may be subject to additional penalties 
not specified in this section.

Sec.  791.319  Penalty imposition.

    (a) If, after considering any written response to the pre-penalty 
notice and any relevant facts, including voluntary disclosure of a 
violation, BIS determines that there was a violation by the alleged 
violator named in the pre-penalty notice and that a civil monetary 
penalty is appropriate, BIS may issue a penalty notice to the violator 
containing a determination of the violation and the imposition of the 
monetary penalty.

[[Page 5424]]

    (b) The issuance of the penalty notice shall constitute final 
agency action. The violator may seek judicial review of that final 
agency action in Federal district court.

Sec.  791.320  Administrative collection; referral to United States 
Department of Justice.

    In the event that the violator does not pay the penalty imposed 
pursuant to this subpart or make payment arrangements acceptable to 
BIS, the matter may be referred for administrative collection measures 
by the United States Department of the Treasury or to the United States 
Department of Justice for appropriate action to recover the penalty in 
a civil suit in a Federal district court.

Sec.  791.321  Severability.

    If any provision of this subpart is held to be invalid or 
unenforceable by its terms, or as applied to any person or 
circumstance, or stayed pending further agency action or judicial 
review, the provision is to be construed so as to continue to give the 
maximum effect to the provision permitted by law, unless such holding 
will be one of utter invalidity or unenforceability, in which event the 
provision will be severable from this part and will not affect the 
remainder thereof.

[FR Doc. 2025-00592 Filed 1-14-25; 8:45 am]
BILLING CODE P
```