BIS Updates Connected Vehicle Rule Authorizations: Amended Limited Use Authorization and New Approved Supplier Registry

The Connected Vehicles Rule prohibits the import and sale of connected vehicles and their related hardware and software with a sufficient Chinese or Russian nexus.

Specifically, BIS published (1) an amended General Authorization No. 1 (GA1), slightly revising the narrow limited-use exceptions for imports of completed connected vehicles incorporating covered software or vehicle connectivity system (VCS) hardware; and (2) a new General Authorization No. 3 (GA3), establishing an Approved Supplier Registry that will allow pre-cleared suppliers and products to be used without requesting specific authorization from BIS. The Approved Supplier Registry, when implemented, has the potential to ease and streamline automotive suppliers’ and manufacturers’ compliance with the Connected Vehicles Rule.

We have covered the Connected Vehicles Rule in greater depth in our previous alert, Taking Stock – Summary of BIS Actions From Fall 2024, and Peek at What Is Next Under the Trump Administration.

Scope of General Authorizations 

Amended General Authorization 1

The amended GA1 authorizes connected vehicle manufacturers to import completed connected vehicles incorporating covered software or VCS hardware — without being granted a specific authorization or submitting declarations of conformity — in four narrow circumstances. 

• For otherwise prohibited covered software or VCS hardware: Public road use is authorized for fewer than 30 calendar days in any 12-month period, starting from the vehicle’s first use on a public roadway, solely for testing purposes (e.g., safety testing by connected vehicle manufacturers, but not for personal use). Records of the date of first use and the intended duration must be maintained.
• For otherwise prohibited covered software or VCS hardware: Display, testing, or research only are authorized, but not on public roadways. 
• For covered software or VCS hardware that would otherwise be subject to a declaration of conformity requirement: Display, testing, or research are authorized, irrespective of use on public roadways. 
• Any covered software or VCS hardware: Temporary import for repair, alteration, or sporting competition are authorized, and the completed connected vehicle must be exported within one year from time of import. Records of import and subsequent export must be retained.

Below are the key changes from the new GA1 to the previous version published on November 19, 2025.

• The amended version specifically references whether covered software or VCS hardware is prohibited under 15 C.F.R. §§ 791.302–303 or still subject to the declaration of conformity requirement of 15 C.F.R. § 791.305.
• Adds testing-only and non-personal-use limits to the 30-day public-road use authorization for otherwise prohibited covered software and VCS hardware.
• Expands temporary import authorization to on-road use, while the prior version only applied to use off public roads.

GA 3

GA3 establishes a process for automotive suppliers to apply directly to the Office of Information and Communications Technology and Services (OICTS) for approval. If approved, the supplier and its specific products are added to an “Approved Supplier Registry.” 

Provided both the supplier and the relevant product are listed together on the registry, VCS hardware importers may then import otherwise-prohibited VCS hardware, and connected vehicle manufacturers may import or sell completed connected vehicles incorporating covered software without specific authorization. 

Key Conditions and Limitations

• The supplier and its respective VCS hardware or covered software are listed together in the Approved Supplier Registry. 
• Manufacturers and importers must monitor the registry for changes and file Declarations of Conformity under § 791.305 when relying on this GA.
• BIS may require letters of assurance, mitigation agreements, or conditions before inclusion of a supplier or VCS hardware importers on the Approved Supplier Registry.
• BIS may remove suppliers for non-compliance with conditions, new national security risk information, materially false representations, or “at its discretion at any time in the interest of national security.”

Application for Inclusion in the Approved Supplier Registry 

Eligible applicants for the Approved Supplier Registry include suppliers of connected vehicle manufacturers and VCS hardware importers that are not otherwise eligible to apply for a specific authorization under the Connected Vehicles Rule. 

For an application to receive consideration, BIS will review whether the applicant’s justification and detailed proposal is sufficient for BIS to determine whether the covered software or VCS hardware poses a national security risk, including a description of any existing or planned controls and measures implemented to prevent or mitigate potential risks. 

A supplier may include multiple covered software or VCS hardware items in a single application. 

General Requirements

The general requirements for both GAs still apply, namely:

• Records demonstrating compliance with the GA must be retained for 10 years and made available to BIS upon request.
• Within 30 days of discovering a change in circumstance, a connected vehicle manufacturer or VCS hardware importer availing itself of a GA must assess if it still qualifies for the GA, and, if not, cease any prohibited conduct, conduct an internal inquiry, and submit a report to BIS.
• BIS may at any time verify whether a connected vehicle manufacturer or VCS hardware importer is availing itself of a GA and request documentation to verify compliance.
• Connected vehicle manufacturers and VCS hardware importers may not avail themselves of a GA if BIS has notified them they are not eligible, or if they are owned by, controlled by, or subject to the jurisdiction or direction of foreign governments identified in 15 C.F.R. § 791.4(a)(1) or (a)(5) (the People’s Republic of China, including the Hong Kong Special Administrative Region and the Macau Special Administrative Region, and Russia), unless otherwise authorized through a specific authorization.

What Does This Mean for Regulated Parties?

GA3 is a significant development that may reduce diligence friction, preserve otherwise viable supplier relationships, and give regulated parties a more administrable way to assess supply chain risk. However, the utility of the Approved Supplier Registry will ultimately depend on how willing OICTS is to add suppliers, VCS hardware importers and their products to it. Additionally, regulated parties will still be faced with the burden of continuously monitoring the registry for any changes.