Detroit's New Enemy? Lines of Code From Abroad

Federal rules banning Chinese and Russian vehicle software took effect March 17, putting automakers on a tight clock to comply

7 May 2026

For US automakers, the clock is ticking. Federal rules banning software developed or supplied by Chinese and Russian-linked companies from connected vehicles took effect March 17, 2026, and the industry has little time to catch up.

Enforced by the Bureau of Industry and Security, the regulation covers a broad range of systems: telematics units, cellular and Bluetooth modules, Wi-Fi components, and Level 3 autonomous driving platforms. Automakers and connectivity hardware importers must now submit annual Declarations of Conformity to federal regulators, confirming prohibited software hasn't crept into their supply chains. Vehicles that fall short risk being blocked from US sale or import.

Timing couldn't be worse. Model year 2027 production is already underway, with those vehicles headed to dealerships in late 2026. That gives manufacturers only months to audit every software component in scope. Exemptions exist for legacy code written before March 17, but only if no foreign-adversary-linked entity has since updated or maintained it.

Modern automotive supply chains span dozens of tiers, and a single restricted component buried several layers down can make an entire vehicle non-compliant. That reality is forcing OEMs to demand supply chain transparency far beyond what was previously standard practice. US officials argue the rules are necessary to prevent foreign actors from harvesting data on American drivers, gaining unauthorized vehicle access, or interfering with critical infrastructure.

More is coming. Hardware-level restrictions are set to kick in for model year 2030 vehicles, and a separate rule covering commercial trucks is already in development. For automakers operating in the US, this isn't a one-time scramble. It's a new baseline.