Connected Vehicles Final Rule Interview: What the "Connected Vehicles Final Rule" Means for the Industry

Related Vendors

FAULHABER Drive Systems

Wuxi InfiMotion Technology Co., Ltd.

The "Connected Vehicles Final Rule" tightens market access to the U.S. and presents the automotive industry with tricky compliance issues. Legal experts Daniel Wuhrmann, Equity Partner, and Dr. Volker Hartmann, Of Counsel, both at reuschlaw, explain what is important now.

With the "Final Rule" adopted in March 2025, the U.S. government drastically restricts market access for connected vehicles and components related to China or Russia. This has far-reaching consequences for the globally interconnected automotive industry, particularly for German manufacturers and suppliers.

In the interview, legal experts Daniel Wuhrmann, Equity Partner, and Dr. Volker Hartmann, Of Counsel, from reuschlaw, explain the specific risks involved, the leeway for exceptions, and how companies must now respond to safeguard their U.S. operations.

In summary: What exactly do the regulations enacted by the U.S. government state?

The regulations enforced by the US Department of Commerce in March 2025, often referred to simply as the "Connected Vehicles Final Rule" (15 C.F.R. § 791.300 et seq.), lead to strict market access restrictions for vehicles and vehicle components in the context of connected and automated driving if these technologies relate to the People's Republic of China or Russia. The Final Rule affects the entire globally connected automotive industry, including German manufacturers and suppliers at various levels of the value chain.

The background is that they must ensure comprehensive supply chain compliance if vehicles or components covered by the regulation are to be imported into or sold in the U.S. This applies from the 2027 model year for software and from the 2030 model year for hardware.

What legal risks do these regulations pose for German car manufacturers and suppliers?

The legal risks are partly that market participants face the loss of market access or a sales ban, which, due to the economic significance, certainly represents the overarching sword of Damocles. Furthermore, the law provides for civil and criminal sanctions.

Furthermore, the Final Rule currently only applies to passenger vehicles weighing less than 10,001 pounds - as the responsible authority has already announced, work is underway for a regulation for commercial vehicles to follow shortly. The approach of the US government could prospectively also affect other sectors and industries where connected products pose a similar risk potential. This would correspond to the "America First Trade Policy" of the Trump-II administration.

To what extent can German manufacturers legally challenge the regulation or apply for exemptions?

The law generally stipulates that otherwise prohibited transactions may be conducted if general and/or specific exceptions have been approved for this purpose. Such exceptions must be applied for separately and strict requirements apply in the respective procedures. Additionally, the responsible authority can impose additional conditions. Furthermore, German manufacturers can file legal remedies against relevant official decisions and make inquiries regarding the applicability of the law. Otherwise, proceeding for individual companies is likely to be difficult. An effective approach could be a coordinated substantive positioning through the EU Commission.

How should existing supply contracts with Chinese suppliers be adjusted to meet the new U.S. requirements?

Affected companies have a series of to-dos:

• In the first step, they must ensure clarity and transparency in the respective supply chains. The Final Rule references the due diligence obligations of manufacturers or importers at several points concerning the appropriate documentation regarding relevant parts and components - companies must therefore create so-called Software Bill of Materials and Hardware Bill of Materials.

• If affected market participants determine in this way whether a component could fall under the Final Rule, they must conduct legal assessments based on this as a second step.

• Thirdly, within the framework of compliance management, they must then weigh whether to apply for exemptions or whether specific supply relationships need to be adjusted, and how compliance can be documented and proven in a legally secure manner in individual cases.

What legal measures can companies take to protect themselves against sudden regulatory changes in the U.S.?

To mitigate these risks, companies should take the following measures:

• First, they must adjust their compliance resources and processes accordingly.

• Second, they must implement appropriate contractual safeguards in the supply chains.

• Third, it is crucial that they legally reconsider and realign strategic R&D collaborations, joint ventures, and other partnerships, especially in the area of Software Defined Vehicles, so that the new compliance requirements are already taken into account in vehicle platform strategies and fundamental technical architectures.

How can German car manufacturers and suppliers prove that their vehicles comply with the new U.S. requirements? Are there certification bodies or testing procedures?

The Final Rule prescribes three dimensions for compliance: (1) declarations of conformity must be issued, (2) record-keeping obligations apply, and (3) due diligence requirements in the supply chain, which corresponds to the aforementioned supply chain compliance.

Independent third parties can be involved in the conformity assessment; however, this is generally not mandatory. If a third party is engaged, manufacturers must disclose this and the party must meet certain minimum requirements under U.S. law.

Is it possible to have European cybersecurity standards (e.g., UNECE Regulation 155) recognized as equivalent to U.S. requirements?

Fundamentally, this is not the case, nor does the Final Rule in its regulatory part incorporate corresponding standards. However, the justification of the law does address the issue. It also mentions that the authority was advised in several comments within the framework of the standard-setting process, particularly by automotive industry associations, to please consider already existing regulations and standards. Notable among these are the UNECE regulations 155 and 156 on cybersecurity and software update management, as well as standards and frameworks like ISO/SAE 21434, ISO 26262, and others.

However, the authority believes that these norms and standards are insufficient and do not specifically serve the goal of the Final Rule, which is to mitigate the national security risk posed by the supply chain for connected vehicle technology when it has links to China or Russia.

However, it is acknowledged that some of these standards and frameworks can be used supportively to implement the process of complying with the regulations. Particularly when processing specific exemptions, the existing cybersecurity measures of the applicant company can be taken into account, which means that UNECE regulations 155 and 156 once again gain central importance, especially for German and European companies.

Are there instances where similar bans have been relaxed or lifted, and could manufacturers refer to these cases?

That would be conceivable. However, we currently see a contrary trend specifically for the Connected Vehicles Final Rule: the American approach is to be viewed in a larger geostrategic context of tech decoupling, particularly from China. China is to be kept away from certain technologies or from market entry in certain sectors identified as sensitive in the national security interest in the USA. Additionally, there is the risk that China will respond with countermeasures and the EU will have to choose between the two "blocks."

Product regulation thus intersects with security and geopolitics. In extreme cases, this can mean that Chinese technology is entirely "removed" from affected products. Especially in the globally connected automotive sector, this could ultimately lead manufacturers to increasingly think and develop in regional platforms. In other words: "US for US," "EU for EU," and "China for China." A digital, connected "world car" will thus become practically impossible.

(sb)

*Daniel Wuhrmann is an Equity Partner at reuschlaw, Dr. Volker Hartmann is Of Counsel at reuschlaw.