Who Owns the Car? The Connected Vehicles Rule and Discretionary Market Access

Introduction

Connected vehicles have gradually shifted from conventional transportation tools to sophisticated sensor platforms that remain in constant communication with external networks. Modern models collect a wide range of sensitive information, including high-definition video, cabin audio, biometrics, driving behavior, and location. Some systems also permit remote operational access. That capability has grown as automotive software has moved beyond simple navigation and telematics toward full-stack connectivity and increasingly automated driving functions.

As these technologies have matured, national security concerns have emerged. Policymakers worry that foreign control over manufacturers or the technologies they rely upon could create national‑security vulnerabilities in sectors characterized by continuous data flows and remote access. The U.S. has responded by building a regulatory regime that treats connected-vehicle technology as part of its broader information and communications security domain.

The Connected Vehicles Rule (CVR), issued by the Bureau of Industry and Security (BIS) in January 2025 and effective March 17 of that year, applies national-security controls to connected vehicles by examining corporate control and supply-chain links. It operates within a wider U.S. strategy to manage security‑sensitive technologies and cross‑border data risks in industries where connectivity and data collection are central features. The ongoing U.S.–China technology dispute now encompasses products that integrate hardware, software, and data infrastructure, and connected vehicles represent one of the sectors where these concerns have been translated into regulatory action.

The CVR evaluates corporate control and technological origin rather than manufacturing origin. It provides detailed definitions and phased compliance deadlines, but its application standards remain largely qualitative. This discretionary structure became visible in 2026 when Volvo Cars and Polestar, both assembling the relevant models in the U.S. and both connected through overlapping ownership and control links to Geely, a Chinese automotive group, received opposite outcomes. Volvo received authorization to continue U.S. sales. Polestar announced that authorization had not been granted for Model Year 2027.[1] Public materials do not disclose BIS’s full reasoning, but the outcomes show that U.S. assembly alone did not determine eligibility. The record indicates case-specific application of the rule, not inconsistent action by BIS.

This note examines the rule’s design, pending legislative changes, and consequences for automakers. Section 2 describes the rule’s legal architecture and the discretionary elements within it. Section 3 reviews congressional efforts to codify and expand the framework. Section 4 assesses exposure across major automakers and the structural implications for global automotive supply chains.  Section 5 concludes.

The BIS Rule: Structure, Authority, and Areas of Discretion

The CVR rests on the Information and Communications Technology and Services (ICTS) authority established under Executive Order 13873 and the International Emergency Economic Powers Act (IEEPA). The BIS uses this authority to regulate certain transactions involving connected vehicles and related technologies. The regulatory structure resembles other national-security regimes in that it combines defined terms, transaction prohibitions, conformity filings, due-diligence obligations, and authorization procedures.[2]

The rule is structured around two separate lines of analysis. One examines ownership and control. The other focuses on technology and supply‑chain networks. Each track supports a set of prohibitions that restrict the import of vehicle connectivity system (VCS) hardware, bar vehicles containing covered VCS or automated‑driving system (ADS) software, and limit dealings with entities linked to foreign adversaries identified in the rule.

The manufacturer and ownership track restricts the sale and import of connected vehicles from entities under the control or jurisdiction of adversaries such as Russia and China. The supply-chain prohibition blocks vehicles if their VCS or ADS parts were in any way designed or supplied by an entity associated with a foreign adversary. These restrictions apply even where the vehicle is assembled in the United States. The rule therefore prioritizes the identity of the controlling entity and the provenance of covered technology over the location of final assembly.

BIS provides detailed definitions for connected vehicles and covered components. A connected vehicle is one built for road use and equipped with hardware or software enabling external connectivity or autonomous operation. Covered hardware includes telematics control units and wireless modules. Covered software includes the application, middleware, and system layers run by the primary processor. Firmware that does not support those functions is excluded.

The rule contains legacy provisions for software established before March 17, 2026, provided a covered entity does not subsequently modify it. Hardware does not receive the same treatment. Instead, BIS uses a phased approach in which non-model-year hardware will face a distinct prohibition from January 1, 2029, followed by a full Model Year 2030 prohibition.[3] Manufacturers must consider these deadlines while preparing annual filings and conducting ongoing due diligence. Table 1 lists the complete schedule.

Manufacturers operate on a year‑to‑year cycle. They must submit a Declaration of Conformity before each model year and keep records for a decade. These obligations began on March 17, 2025, which means manufacturers therefore must file annual declarations before the software and hardware prohibitions take effect.[4] A manufacturer whose transactions would otherwise be prohibited may seek permission from BIS. Authorization can be obtained through three channels: general authorization for qualifying transactions, specific authorization on a case‑by‑case basis, and advisory opinions that provide informal guidance.[5] Enforcement is carried out through IEEPA, which provides civil and criminal penalties for non-compliance.[6]

Unlike the Committee on Foreign Investment in the United States (CFIUS), which reviews discrete investment transactions, the CVR is an ongoing product‑level regime. It governs specified connected vehicles and technologies regardless of investment activity. This structure places ongoing obligations on manufacturers and suppliers.

The BIS retains substantial discretion because the rule does not set numerical thresholds. The rule does not specify how minority stakes from a single jurisdiction should be aggregated. It also does not articulate a conclusive standard for assessing ownership or supply‑chain relationships. Public authorization materials sometimes reference data‑security or governance considerations, but the BIS has not identified those as formal criteria. Where ownership or supply-chain facts are uncertain, firms may need an Advisory Opinion or other formal BIS guidance.

Congressional Efforts to Codify and Broaden the Rule

Congress has begun to consider legislation that would convert several discretionary elements of the Connected Vehicles Rule into statutory requirements. As of August 7, 2026, multiple bills had been introduced to address three central issues: foreign-adversary designations, supply-chain coverage, and ownership thresholds.[7] These proposals would formalize parts of the existing rule while expanding its reach.

One set of proposals focuses on ownership limits. Under S. 4429 as introduced, the legislation would establish numerical limits that differ from BIS’s case by case approach. The bill sets limits at more than 15 percent for connected vehicles and more than 25 percent for covered software and hardware suppliers.  These thresholds would replace the current qualitative standard, although the bill does not specify how separate minority interests should be aggregated or when investors should be treated as acting together.[8] The House companion bill, H.R. 8730, contains similar provisions, while H.R. 7389 does not include the 15 and 25 percent thresholds.[9]

Other proposals would expand the definition of covered hardware. The CVR currently focuses on telematics control units and wireless modules. Legislative drafts would broaden this definition to include additional types of connectivity hardware, thereby extending the scope of prohibited supply-chain relationships.[10] The bills also attempt to clarify the degree of design, development, or manufacturing involvement that creates a covered relationship, an area where the current rule does not provide clear standards.

Foreign‑adversary designations represent a third area of proposed change. The CVR limits its prohibitions to adversaries specifically identified in the rule, including China and Russia.[11] The proposals would enlarge the set of covered jurisdictions and convert the designation process into a statutory mandate. They would also introduce criteria for additions and removals and a requirement for regular reassessment.

The proposals would not close every ambiguity in the current rule. Issues involving indirect ownership, passive stakes with limited governance rights, and the aggregation of minority interests would continue to depend on administrative interpretation. Even with statutory thresholds, firms would still need to manage areas where the rule leaves discretion to BIS.

Market Exposure and Structural Implications

As mentioned in Section 2, the CVR operates through two distinct regulatory tracks. One focuses on ownership and control. The other examines technology and supply‑chain relationships. Together, these tracks shape how manufacturers with a presence in the U.S. market are exposed to the rule’s requirements. Table 2 gives an overview of how major automakers with a presence in or connection to the U.S. market are exposed.

An ownership authorization does not eliminate a manufacturer’s separate obligations related to software, hardware, filing, or supply-chain diligence. Volvo’s Specific Authorization (a case-by-case exemption granted by BIS), for example, does not exempt the company from compliance requirements involving automated-driving system software, connectivity hardware, or vehicle-level due diligence. Because these obligations apply across models and suppliers, they must be reassessed each model year. The U.S. light‑vehicle market sells roughly 16 million vehicles annually, and the supply‑chain provisions can affect any manufacturer serving that market.[12]

The public record identifies relatively few manufacturers with apparent ownership exposure. The companies with documented BIS determinations or exposure under proposed legislative thresholds are those with links to Geely and, by the statutory aggregation rules, Mercedes Benz Group.[13] No public BIS ownership determination appears to cover the other automakers discussed here. They nevertheless remain subject to the supply-chain provisions even without ownership issues.

Polestar provides a clear example of how the ownership restriction operates. Before Polestar consolidated all Polestar 3 production in the United States in March 2026, the company manufactured vehicles both at the Ridgeville facility and in China. This period coincided with heightened tariff exposure for Chinese-built electric vehicles.[14] Polestar has since announced that it will discontinue new‑vehicle sales in the U.S. beginning with Model Year 2027, while continuing to support existing inventory and service obligations.[15]

A manufacturer without ownership exposure may still violate the supply-chain prohibition. Software restrictions begin in Model Year 2027 and hardware restrictions in Model Year 2030. Those deadlines apply even to manufacturers without an ownership issue.[16] They require manufacturers to examine the origin of connectivity components and automated‑driving software and to replace or redesign parts that involve covered entities.

Ford’s licensing agreement with CATL, a Chinese battery manufacturer, illustrates a gap in how the rule applies to technology‑transfer structures. CATL was designated under Section 1260H in January 2025, yet its lithium-iron-phosphate technology is licensed for use at Ford’s BlueOval Battery Park.[17] BIS has not indicated whether this licensing arrangement constitutes a prohibited relationship. The answer depends on how BIS interprets design and development involvement under the supply‑chain track.

A similar issue arises with General Motors and its 50 percent equity stake in SAIC Motor (a Chinese state-owned automaker)-GM joint venture.[18]  The joint venture has established a digital business unit to develop software for connected vehicles in China. Whether SAIC‑GM’s software activities create a covered relationship depends on the relevant technical and corporate details. BIS has not released a formal determination.[19]

The supply-chain prohibition reinforces a broader shift toward region-specific vehicle platforms and technology stacks. Company reporting suggests that manufacturers with substantial operations in both the U.S. and China are already separating suppliers and software by market. The 2027 software deadline increases this pressure.[20]  Although public sources do not quantify the cost of maintaining separate technology stacks, they indicate that the deadline is influencing sourcing decisions and software development strategies.

The CVR responds to concerns that connected vehicles collect sensitive data and may permit remote access by entities linked to a foreign adversary. Compliance may require manufacturers to replace China-linked components or software. These changes could increase production costs and alter competitive conditions.[21] Those costs will not fall evenly. Manufacturers with deeper China supply chain exposure face greater redesign burdens than firms already sourcing outside China. Established partnerships, such as Ford’s relationship with CATL or GM’s with SAIC Motor, may need to be revised or replaced. Affected components may need to be redesigned, which could raise costs and affect production timelines. The incidence of these costs will depend on manufacturers’ ability to substitute suppliers, redesign components, and pass costs through to buyers.

Chinese responses to U.S. measures remain a material risk for affected firms. China maintains its own connected‑vehicle data regime with stringent localization and security requirements. It could impose additional restrictions on cloud services or sensor components used by U.S. automakers, although the likelihood of such measures cannot be assessed from the available record. Because Ford, Volkswagen, Tesla, and GM have major operations in China, any countermeasure could affect their local production and technology arrangements.

Conclusion

The CVR reflects a targeted attempt by the BIS to manage national-security risks that arise when vehicles collect sensitive data and permit remote access. The rule addresses these concerns by imposing ownership and supply‑chain restrictions on specified imports, sales, and technology activities. It treats connected‑vehicle technology as part of the broader information‑security environment and applies controls that reach beyond traditional automotive regulation.

Pending legislation would formalize and expand several elements of the current rule. The proposals would introduce explicit ownership thresholds, broaden the definition of covered hardware, and enlarge the list of foreign adversaries. These changes would replace parts of BIS’s case-by-case BIS approach with statutory requirements. They would not resolve every ambiguity, particularly those involving passive stakes, indirect ownership, or the aggregation of minority interests. However, they would narrow the scope of administrative discretion.

The future of the rule will depend on developments in U.S.-China technology policy and on subsequent action from Congress, BIS, and the courts. Connected vehicles offer an early example of how data-security and supply-chain controls will apply to products that combine software, hardware, and cross-border manufacturing. The CVR is likely to function as an early regulatory model for future efforts in other sectors characterized by persistent connectivity and sensitive data flows.