New US federal rules rip Chinese and Russian code out of connected cars—what that means for your OTA updates and long-term repairs
What the 2027 ban actually does
Starting with Model Year 2027, the U.S. bans “covered software” from Chinese- or Russian-controlled suppliers in any new connected vehicle sold here. It also bars sales by manufacturers with a sufficient nexus to China or Russia. For hardware in the Vehicle Connectivity System (VCS), the cut-off arrives in Model Year 2030 (or Jan 1, 2029 for components without a model year). Commerce’s Bureau of Industry and Security (BIS) finalized the rule in January 2025 and it took effect March 17, 2025
Figure 1 — Key dates: Rule effective Mar 17, 2025 → Software ban: MY2027 → Non-MY hardware cutoff: Jan 1, 2029 → VCS hardware ban: MY2030.
What you will notice (and what stays the same)
Steering feel, brake bite, and ride tuning don’t change. The swap happens behind the screen: telematics control units, radios, gateways, and over-the-air update stacks move to compliant suppliers. Carmakers can keep pushing map refreshes, bug fixes, and driver-assist tweaks; some brands will need to shuffle timing as they validate new modules; read probable delays. Shoppers will still cross-shop on charging speed, cabin quiet, and highway composure—Ioniq 5, Mustang Mach-E, ID.4—the winner is the one that steers cleanly, rides settled over sharp hits, and posts predictable charge curves.
Right-to-repair carve-outs and temporary use cases
The final rule allows import of VCS hardware for warranty or repair on vehicles with model years before 2030. BIS also issued General Authorizations that cover limited use cases and temporary importation (e.g., testing, display, off-road competition, or import-to-export scenarios), subject to record-keeping. These keep dealers and independent shops stocked for legacy repairs while the industry transitions.
Paper trail: declarations and records
Importers and auto makers must file a Declaration of Conformity before importing VCS hardware or selling a new model year with covered software. They must update that filing annually (or confirm no change) and keep records for 10 years. Translation: more supplier audits, clearer software bills of materials, and cleaner compliance notes in owner portals. We might expect some dodging during transition; be sure of conformity when you buy.
FCC’s “bad labs” rule closes a back door
Separately, the FCC now blocks test labs, TCBs, and accreditors tied to foreign adversaries from the U.S. equipment-authorization program. Telematics radios still pass FCC, just not through adversary-linked labs. That change reinforces the Commerce rule at the radio-approval gate.
My Verdict: what to do as a shopper and an EV driver
Shop the drive first, then the stack. On your test loop, pick the car that steers cleanly, rides settled over sharp hits, stays quiet at 75 mph, and follows a predictable charge curve. Before you sign, ask the sales manager for the brand’s connected-vehicle compliance note or equivalent—confirmation of MY2027 software and the plan for MY2030 hardware.
Check the owner portal or support site for quarterly OTA release notes; if a brand goes a year without updates, walk away, and fast. Confirm the TCU/modem and OTA platform have a replacement path under warranty after 2027, and that independent shops get documentation for repairs. For used imports, verify U.S. eSIM activation and data-recorder serviceability.
At home, enable PIN-to-Drive and 2FA, trim data-sharing toggles, and keep Bluetooth/Wi-Fi non-discoverable. The cars that drive well and show a clean compliance trail will age better and protect resale once the 2030 hardware line hits.
