The US connected-vehicles rule, on paper: what BIS prohibits, and when the Model Year 2027 and 2030 deadlines bite

On January 14, 2025, the US Department of Commerce's Bureau of Industry and Security (BIS) announced a final rule prohibiting certain transactions involving the sale or import of connected vehicles and their components in the United States market, where those products have a sufficient nexus to the People's Republic of China (PRC) or Russia. BIS determined such transactions pose national security risks, saying companies from these countries may be compelled to share data or allow remote access to connected vehicles in the United States.

The stated concern is not mechanical safety but connectivity. According to the January 14, 2025 press release, the systems that allow a vehicle to communicate externally could, if accessed maliciously, expose drivers' personal data or allow remote manipulation of vehicles on American roads.

What the rule actually prohibits

The rule targets two categories of technology. The first is the Vehicle Connectivity System (VCS), defined by BIS as the set of systems that allow the vehicle to communicate externally, including telematics control units, Bluetooth, cellular, satellite, and Wi-Fi modules. The second is the Automated Driving System (ADS), which BIS describes as the components that collectively allow a highly autonomous vehicle to operate without a driver.

In concrete terms, the January 2025 announcement sets out three kinds of prohibition:

• Import of VCS hardware, or of connected vehicles containing such hardware, with a sufficient nexus to the PRC or Russia.
• Import and sale of vehicles containing VCS or ADS software with a sufficient nexus to the PRC or Russia.
• Sale of new connected vehicles in the United States by manufacturers with a sufficient nexus to the PRC or Russia — even if the vehicle was made in the United States.

Which vehicles are covered — and which are not

The rule applies to passenger vehicles only. BIS defines these, for this rule, as vehicles under 10,001 pounds. In the January 2025 press release, the agency attributed the limit to the complexity of the commercial vehicle supply chain and said it intends to issue a separate rulemaking addressing connected commercial vehicles, including trucks and buses, in the near future. At the time of the announcement, then, heavier commercial vehicles sat outside the scope of this rule.

The Model Year 2027 and 2030 timeline

The prohibitions do not all bite at once. The software-related prohibitions take effect for Model Year 2027, as does the bar on sales of connected vehicles by manufacturers with a sufficient nexus to the PRC or Russia. The hardware-related prohibitions take effect for Model Year 2030, or January 1, 2029 for units without a model year. The rule itself went into effect earlier, on March 17, 2025 — 60 days after publication — meaning the compliance framework was already live well before the first substantive prohibition dates.

The BIS Connected Vehicles program page, as read on September 22, 2026, restates the same phased structure: Model Year 2027 for sales of connected vehicles by manufacturers owned by, controlled by, or subject to the jurisdiction or direction of China or Russia, and vehicles using their covered software; Model Year 2030, or January 1, 2029 for non-model-year components, for imports of VCS hardware from such companies.

How compliance works

The rule builds a compliance framework around the prohibitions rather than leaving them absolute. Per BIS, the framework includes:

• Annual Declarations of Conformity to BIS from importers and manufacturers not engaging in prohibited transactions involving VCS hardware or covered software.
• General Authorizations for low-risk transactions.
• Specific Authorizations, allowing a regulated party to engage in an otherwise prohibited transaction.
• Advisory Opinions, through which a party can ask BIS for a determination on whether a prospective transaction may fall within the rule's scope.
• Submissions run through BIS's Compliance Application and Reporting System (CARS).

The rule is implemented under BIS's ICTS authorities provided for under Executive Order 13873, "Securing the Information and Communications Technology and Services Supply Chain." It followed an Advance Notice of Proposed Rulemaking published March 1, 2024 and a Notice of Proposed Rulemaking published September 26, 2024, with a public comment process in between.

The rule is a supply-chain and import measure, not a vehicle rating or a ban on any brand as such — it turns on whether specific hardware or software, or the manufacturer itself, has a sufficient nexus to the PRC or Russia. The commercial-vehicle side is expected in a separate rulemaking, and compliance details such as which authorizations are active can change; the BIS program page and the Federal Register text of the final rule are the controlling documents.

To check how this bears on a specific vehicle or component, consult BIS's Connected Vehicles program page for the current text of the prohibitions, the active General Authorizations, and the Small Entity Compliance Guide; the Federal Register carries the full final rule text. A manufacturer's Declaration of Conformity status and any Specific Authorization are matters BIS itself administers, so a prospective transaction can be tested directly by requesting an advisory opinion through the agency's CARS portal.