Key Points

• On June 18, 2026, the BIS’s Office of Information and Communications Technology and Services issued GA #3, creating an Approved Supplier Registry under the Connected Vehicles Rule.
• Specifically, GA #3 authorizes connected vehicle manufacturers and VCS hardware importers to engage in otherwise prohibited transactions involving a listed supplier’s product, without being granted a specific authorization, if both the supplier and the relevant VCS hardware or covered software are listed together on the Approved Supplier Registry. VCS hardware importers and connected vehicle manufacturers that rely on GA #3 to engage in otherwise prohibited transaction must declare the supplier’s relevant VCS hardware or covered software in a declaration of conformity pursuant to the Connected Vehicles Rule.
• Prior to this general authorization, unless suppliers qualify as connected vehicle manufacturers or VCS hardware importers, they were ineligible to apply for a specific authorization under the Connected Vehicles Rule. GA #3 gives suppliers a direct pathway to seek BIS review and authorization through inclusion on the Approved Supplier Registry, rather than relying on a customer (e.g., connected vehicle manufacturer) to seek approval on their behalf.
• Connected vehicle manufacturers and VCS hardware importers will need to monitor any changes to the Approved Supplier Registry as part of their diligence process, since prohibitions are reimposed if BIS removes a supplier from the registry.

Background

The Connected Vehicles Rule imposes various prohibitions affecting certain connected vehicles and components related to vehicle connectivity systems (VCS) and automated driving systems (ADS) with a sufficient nexus to China or Russia. The rule specifically targets “VCS hardware” and “covered software,” both of which are defined terms in the regulations. Although connected vehicle manufacturers and VCS hardware importers may seek specific authorizations from the Bureau of Industry and Security (BIS) to engage in otherwise prohibited transactions, suppliers have not been able to apply directly for these specific authorizations; suppliers instead had to work through an original equipment manufacturer (OEM) or other eligible applicant to obtain authorization in relation to that specific customer. See our alert on the Connected Vehicles Rule here.

General Authorization No. 3 (GA #3) addresses that gap by allowing suppliers to seek BIS approval directly for covered products through the new registry. Along those lines, the Approved Supplier Registry allows a supplier and its products to be approved across eligible customers and their associated vehicles.

Application and Approval Process

Suppliers may apply for registry approval through BIS’s online Compliance Application and Reporting System (CARS). Instructions are available here and a screenshot of the application is available here. As a general matter, applicants must provide a justification and a detailed proposal sufficient for BIS to determine whether the covered product poses a national security risk, including a description of any existing or planned controls and measures to address potential risks.

The information requested in the application is similar to that in a specific authorization application. Notably, the application requests information on the supplier’s customers including, if known, the connected vehicle manufacturers and/or VCS hardware importers that will purchase the supplier’s products. An application may cover multiple covered products.

BIS will review applications on a case-by-case basis to determine whether the VCS hardware or covered software at issue, taking into account information (including mitigation measures) in the application, presents an undue or unacceptable national security risk. BIS may condition approval on a letter of assurance, mitigation agreement or other requirements.

Once approved, the supplier and associated product are added to the Approved Supplier Registry, which will be published at a later date. BIS may remove suppliers at its discretion due to national security considerations, among other reasons, such as a supplier’s failure to abide by any agreed upon conditions or mitigations.

Implications for Connected Vehicle Manufacturers and VCS Hardware Importers

Connected vehicle manufacturers and VCS hardware importers may rely on GA #3 only where both the relevant supplier and product are listed together on the registry. Companies relying on GA #3 are responsible for submitting declarations of conformity documenting their reliance on GA #3, as well as monitoring registry changes and maintaining compliance records for at least 10 years.

Connected vehicle manufacturers or VCS hardware importers may not rely on GA #3 to engage in otherwise prohibited transactions if BIS has deemed them ineligible for a general authorization, or they are owned by, controlled by, or subject to the jurisdiction or direction of China or Russia. These connected vehicle manufacturers or VCS hardware importers would still require a specific authorization to engage in prohibited transactions.