The US Commerce Department's Bureau of Industry and Security finalized a rule restricting connected vehicle hardware and software with a sufficient nexus to China or Russia. Software prohibitions begin with model year 2027 and hardware prohibitions with model year 2030. It applies to passenger vehicles under 10,001 pounds, and trucks and buses are left for a separate rulemaking.
This is a summary for engineers, not legal advice. Have counsel read the rule before you act on it.
What it prohibits
Based on the Bureau's announcement, the rule covers three things for passenger vehicles:
- Importing vehicle connectivity system (VCS) hardware, or vehicles containing it, with a sufficient nexus to the PRC or Russia.
- Importing or selling vehicles that contain VCS or automated driving system (ADS) software with that nexus.
- Manufacturers with that nexus selling new connected vehicles with VCS or ADS hardware or software in the US, even if the vehicles were built domestically.
The dates
- Software prohibitions: model year 2027.
- Hardware prohibitions: model year 2030, or 1 January 2029 for units without a model year.
- Sales prohibition for manufacturers with the nexus, even for US-built vehicles: model year 2027.
The announcement says commercial vehicles such as trucks and buses are not covered yet and will be addressed separately.
The stated reason
The rule says that these systems present an undue and unacceptable risk to national security when linked to the PRC or Russia. The concern named is that adversaries could access sensitive data, including driver or owner information, or remotely control vehicles. It is issued under Executive Order 13873.
Why this lands on software teams
Even if you do not make cars, a rule like this changes what supplier questionnaires ask. Teams that build modules, telematics software or driving software should expect questions about where code is written, who maintains it and where components come from.
That is a supply chain provenance question, and software inventories help answer it. A current SBOM tells you which components are in a build, which is a precondition for answering any question about where they came from.
Practical steps:
- Build a complete inventory of components for each software release, including transitive dependencies.
- Record the supplier and maintainer of each significant component.
- Keep that inventory tied to specific release versions, not just the current branch.
- Decide who answers a customer's provenance question and how fast.
What it does not tell you
The rule text defines "sufficient nexus" in detail. This summary does not, and the definition matters. Whether a given supplier is covered is a legal question for your counsel, not an engineering one.
Safeguard's SBOM and dependency scanning can produce the inventory in step one for software you build.
Click through it at your own pace, or open it full screen.
Quick check
Does the rule cover trucks?
Not yet. Vehicles over 10,000 pounds are outside this rule, and a separate rulemaking is planned.
When do software restrictions start?
Model year 2027 for software, and model year 2030 for hardware, or 1 January 2029 for units without a model year.
Sources
Last reviewed: 19 October 2026.
