A key compliance milestone under the U.S. Department of Commerce's Connected Vehicles (CV) rule is fast approaching. The CV rule issued by the Bureau of Industry and Security (BIS), which went into effect on March 17, 2025, restricts the importation and sale of certain connected vehicles that contain software designed, developed, manufactured, or supplied by persons owned by, controlled by, or subject to the jurisdiction of foreign entities of concern, including the People's Republic of China (PRC).
Legacy Software Exemption
The rule includes a legacy software exemption for software developed by foreign adversary entities prior to March 17, 2026. Under the exemption, covered software that was designed, developed, manufactured, or supplied by a foreign adversary entity prior to this compliance date may continue to be used without being treated as prohibited "covered software," provided it is not subsequently maintained or updated by any foreign adversary entity after that date.
Compliance Considerations
- Timing Is Critical: To preserve the legacy exemption, any transfer of source code or rights to the software from a foreign adversary entity must be completed on or before March 17, 2026.
- Maintenance Restrictions: After the compliance date, all maintenance, patching, or updates to legacy code must be performed entirely by entities that are not covered persons under the CV rule.
- Documentation and Evidence: Manufacturers should maintain documentation demonstrating that control of any legacy software incorporated into vehicles on or after March 17, 2026 has been properly transferred to an entity that is not a covered person and that no covered person has any ability to access maintain, augment, or otherwise alter the software post-deadline.
What Happens Next?
After March 17, 2026, legacy code that satisfies these conditions may continue to be used in vehicles sold into the U.S. market without triggering the prohibitions on covered software. However, any continuing involvement by a covered person (such as a PRC software supplier) after that date could jeopardize the exemption.
Why It Matters
It is vital for vehicle manufacturers and importers to understand their supply chains and ensure that any covered software in their vehicles complies with the CV rule by the March 17 deadline. Violations of the CV rule are punishable by significant civil fines, and potential jail time if such violations are willfully committed.
Action Steps
- Complete transactions for the sale or assignment of covered software
- Conduct a software inventory and confirm incorporation dates relative to March 17, 2026
- Evaluate existing agreements to determine whether code rights and maintenance responsibilities have been transferred away from covered persons
- Ensure maintenance and update streams are fully controlled by non-covered entities post-compliance date
For assistance in completing the required actions prior to the compliance date, please reach out to Venable's Autonomous and Connected Mobility Group.