Secure Autonomous
FeedbackGet alertsCheck a deployment
Rules › RULE-017

Connected vehicles rule: vehicle connectivity systems and automated driving systems with a China or Russia nexus (15 CFR part 791, subpart D)

Prohibits importing vehicle connectivity system hardware, and importing or selling connected vehicles that run vehicle connectivity or automated driving system software, designed, developed, manufactured, or supplied by persons owned by, controlled by, or subject to the jurisdiction or direction of China or Russia; a manufacturer with that nexus may not sell connected vehicles in the United States at all. The stated risk is compelled data sharing and remote access to vehicles on US roads. If one subcomponent of an automated driving system is supplied from that nexus, the whole software suite is treated as such. Importers and manufacturers file annual Declarations of Conformity with recordkeeping; specific and general authorizations and advisory opinions are available.

Bureau of Industry and Security, Department of CommerceUnited StatesUnited States, federalregulationMachinesSoftware acting on machinesText of the rule ↗

Status in force from March 17, 2025; software prohibitions from model year 2027; hardware prohibitions from model year 2030 (January 1, 2029 for units without a model year); vehicles over 10,000 lb to be addressed in a later rule

Draft mapping. Drafted by the Register's agents from the rule's text and not yet confirmed by a person. It is the Register's reading, not legal advice: whether and how the rule applies to you is a question for counsel.

Controls this rule maps to

Required by the text The rule's text requires a measure that is this control, or plainly includes it. Implied A binding rule whose purpose needs this control, but whose text does not name it. The Register's reading. Recommended A voluntary standard or guidance recommends it; nothing binds you to it. Proposed Appears in a proposed rule or proposed provision that is not yet in force.

ControlStrengthWhere in the rule, and whyConfidenceMissing or failed in
Provenance of the actor's software and hardware C-A3Required by the text§§ 791.302–791.304: prohibited hardware, covered software (vehicle connectivity and automated driving system software), and manufacturer transactions with a China or Russia nexushigh1 case
Containment and isolation C-E5Impliedthe rule's stated purpose: removing a path by which a foreign party could reach vehicle systems remotely through the connectivity systemmedium5 cases
Reporting integrity C-V2Required by the text§ 791.305: annual Declaration of Conformity, with records kept and material changes reported within 60 dayshigh1 case
Is a mapping wrong? Dispute it with the clause that shows otherwise.

Help shape the Register

A person reads every answer; changes it leads to are logged in the methodology. To dispute a claim or reply for a named company, use Respond, dispute, or submit.

Did this page help with what you came to do?