U.S. OICTS creates Approved Supplier List for connected vehicle supply chains and narrows General Authorization 1

General Authorization 3

Under the Connected Vehicles (CV) Rule, only “Connected Vehicle Manufacturers” and “VCS Hardware Importers,” as those terms are defined in the Rule, are eligible to apply for specific authorizations. This has created practical challenges for automotive suppliers, including Tier 1 and lower-tier suppliers, that want to demonstrate to their customers that their products are not prohibited or do not present the national security risks addressed by the rule. The issue is particularly acute for suppliers with some China- or Russia-related ownership (where there is no control or direction), historical development ties, or “legacy” Chinese or Russian software or hardware components that were designed or incorporated years ago but have since been modified and may no longer have any connection to the original Chinese or Russian designer. In those circumstances, buyers may be reluctant to proceed, even when the supplier believes the product is not prohibited under the Rule.

From the buyer’s perspective, the alternatives may be unattractive. A Connected Vehicle Manufacturer or VCS Hardware Importer may decide that the perceived risk is too great, or that seeking a specific authorization or advisory opinion from OICTS is not commercially practical. General Authorization 3 (GA 3) appears designed to address that gap by giving suppliers a direct path to engage with OICTS.

GA 3 now allows eligible automotive suppliers to apply for addition to an "Approved Supplier List." Once approved, the supplier may use that designation to demonstrate to customers that the relevant products do not raise the national security concerns targeted by the CV Rule. Connected Vehicle Manufacturers and VCS Hardware Importers may rely on the Approved Supplier List when selecting suppliers. This is a significant development for industry. The new process may reduce friction in supplier diligence, preserve commercial relationships that might otherwise be disrupted, and provide buyers with a more administrable basis for evaluating supplier risk under the rule.

OICTS has provided information about applying to the Approved Supplier List on its website: bis.gov/oicts/connected-vehicles/general-authorizations, but generally speaking:

• OICTS has added the Approved Supplier List application process to its Compliance Application and Reporting System (CARS).
• Applicants should be prepared to explain in detail why their products do not present a national security risk.
• Applicants also should be prepared to identify any mitigation measures they are willing to implement.
• A supplier may submit a single application covering multiple items of VCS hardware or covered software.

Although GA 3 should be helpful for both suppliers and buyers, companies should consider the process carefully before seeking or relying on inclusion on the Approved Supplier List. Suppliers may be subject to mitigation agreements and “certain agreed upon conditions.” The content of those conditions remains to be seen. Depending on how OICTS administers the process, the conditions could require operational changes (including committing to move some manufacturing to the United States), reporting commitments, or other obligations that a supplier may not wish to undertake if it can otherwise demonstrate to customers that its products are not prohibited under the rule.

Buyers also should not treat the Approved Supplier List as eliminating the need for diligence. OICTS may remove a supplier from the list if the supplier fails to comply with applicable conditions or a mitigation agreement. CV Manufacturers and VCS Hardware Importers may have limited visibility into whether a supplier is complying with those requirements and may be affected if a supplier is removed from the list after a sourcing decision has been made.

Accordingly, companies relying on the Approved Supplier List should consider contractual protections requiring notice of any change in status, commitments to maintain compliance with any applicable mitigation agreement or conditions, and contingency planning for supplier removal.

General Authorization 1

OICTS also has amended General Authorization 1 (GA 1). Most of the amendments appear administrative, including changes that replace references to China and Russia with citations to the regulation. Three changes are more notable:

• Testing limitation. OICTS narrowed the fewer than 30-day authorization in paragraph (a)(1) to apply “solely for the purpose of testing, such as safety testing.” Companies that have relied on the prior version of GA 1 for social media campaigns, photo shoots, industry events, or other non-testing activities should assess whether those activities can be considered “testing.”
• Personal-use language. OICTS added the phrase “and not for personal use” to paragraph (a)(1). This change does not appear to have significant operational effect because the Connected Vehicles Rule regulates Connected Vehicle Manufacturers and VCS Hardware Importers, not individual end users’ personal operation of vehicles after sale. The change appears intended to address scenarios in which individuals may drive Chinese vehicles from Mexico or Canada into the United States, but that conduct is not prohibited under the rule.
• Sporting events. OICTS modified the authorization in paragraph (a)(4) to clarify that vehicles imported under that provision may be used on or off public roadways for sporting events for up to one year from import. This may be helpful for certain OEMs and event-related use cases.

Authored by Elizabeth Cannon, Ajay Kuntamukkala, Anthony Capobianco, and Stephen Propst.