Connected vehicles rule takes effect: Covered software supply chain requirements

March 17, 2026 marked a significant compliance milestone for the automotive industry under the United States Department of Commerce’s “Securing the Information and Communications Technology and Services Supply Chain: Connected Vehicles” final rule. As of that date, vehicle software enabling vehicle connectivity or automated driving systems that is sold or installed in vehicles offered for sale in the US may no longer be “designed, developed, manufactured, or supplied” by Chinese or Russian entities, unless the manufacturer has obtained a Specific Authorization or qualifies for a General Authorization from Commerce Department’s Bureau of Industry and Security (BIS). For vehicles that incorporate software enabling vehicle connectivity or automated driving, where that software has a foreign nexus in its supply chain, manufacturers must submit a Declaration of Conformity to BIS at least 60 days prior to the vehicle’s or software’s importation or sale in the US.

This alert discusses key compliance considerations for vehicle manufacturers under the final rule, including supply chain restrictions and related reporting obligations.

The regulatory significance of March 17, 2026

Under the final rule, the definition of “covered software” carves out software subcomponents that were designed, developed, manufactured, or supplied prior to March 17, 2026, provided that those subcomponents are not “maintained, augmented, or otherwise altered” after that date by an entity “owned by, controlled by, or subject to the jurisdiction or direction of a foreign adversary,” as defined in the final rule and currently identified as China and Russia. Prior to that effective date, vehicle software was excluded from the final rule’s prohibitions and compliance requirements.

Covered hardware is regulated beginning with Model Year 2030 if the hardware is associated with a vehicle model year. Covered hardware that is not associated with a vehicle model year will be regulated beginning January 1, 2029.

For vehicle and equipment manufacturers, this means that software with a nexus to China or Russia that is designed, developed, manufactured, or supplied on or after March 17, 2026 is now subject to the final rule’s prohibitions and requirements unless otherwise authorized.

Near-term considerations for vehicle manufacturers

For vehicle manufacturers, understanding the composition of their vehicle software supply chains is critical. This includes identifying what software qualifies as covered software and the presence of any nexus to China or Russia. The final rule was adopted one year prior to its effective date. During the interim period manufacturers could evaluate the rule’s potential impact and consider whether supply chain adjustments were necessary to support compliance beginning March 17, 2026.

Declarations of Conformity

Under the final rule, Declarations of Conformity are the required mechanism through which connected vehicle and software importers and manufacturers report to BIS that they have conducted supply chain due diligence and have complied with the rule’s requirements.

As set forth in the final rule, importers or manufacturers of vehicles containing covered software must submit Declarations of Conformity to BIS at least 60 days prior to the first importation or sale of each model year of a connected vehicle that incorporates covered software.

The final rule further requires declarants to certify that:

• The covered software was not designed, developed, manufactured, or supplied by persons with a nexus to China or Russia;


• Declarant has conducted due diligence to inform that no-nexus certification; and


• Supporting documentation is maintained and available upon BIS request

Any material changes to previously submitted Declarations of Conformity must also be reported within 60 days of discovery.

Specific Authorizations

Under the final rule, a Specific Authorization is required for vehicle manufacturers or importers who wish to engage in a transaction that would otherwise be prohibited, unless the transaction qualifies for one of the two General Authorizations announced by BIS to date.[1] The final rule provides that manufacturers or importers of connected vehicles or covered software that is designed, developed, manufactured, or supplied by persons with a nexus to China or Russia and intended for sale in the US must apply for and obtain a Specific Authorization prior to importing or selling the affected vehicle in the US.

Applications for a Specific Authorization must include, among other things, an overview of the software at issue, supporting documentation (e.g., threat assessments), and proposed mitigation measures, such as technical and operational controls, as specified by BIS.

BIS has indicated that it aims to issue decisions on Specific Authorization applications within 90 days. The final rule provides that applicants may not engage in a prohibited transaction unless and until BIS grants the authorization. Specific Authorizations are generally issued for at least one model year or calendar year and may be subject to additional conditions imposed by BIS.

Learn more

DLA Piper lawyers are closely monitoring developments in this area and are available to assist clients with questions regarding these requirements. Please contact the authors for additional information.

 

^{[1] General Authorization No. 1 covers limited use cases, including vehicles used on public roads for fewer than 30 days within any 12-month period, vehicles used solely for display, testing, or research off public roads, and vehicles temporarily imported for repair, alteration, or off-road sporting competition. General Authorization No. 2 permits temporary importation of vehicles or Vehicle Connectivity System hardware into the US solely for subsequent export to a non-US market. Both General Authorizations are subject to 10-year recordkeeping requirements and are unavailable to entities owned by, controlled by, or subject to the jurisdiction or direction of China or Russia.}