In their September 21 letter on Chinese automobiles and connected technology, Representative Debbie Dingell and 26 colleagues urged President Trump to examine ownership and control behind licensing, joint ventures and supply agreements. Their letter changes no legal requirement. It brings renewed political scrutiny to technology contracts whose regulatory treatment already depends on the software's history.
The inquiry concerns software directly enabling connectivity or automated driving in covered vehicles. Before approving its use in a U.S. vehicle program, the manufacturer needs the component's supply and maintenance history.
An old code date does not settle a new supply
The BIS definition of covered software in 15 CFR 791.301 excludes qualifying software subcomponents designed, developed, manufactured or supplied before March 17, 2026. The exclusion is conditional. Subsequent maintenance, augmentation or alteration by a foreign-adversary-linked entity can remove it.
BIS addresses a separate problem in its Connected Vehicles FAQ on legacy software and intellectual-property purchases. If a foreign person supplies previously legacy software after March 17, 2026, the agency says that software becomes covered. Its answer to a manufacturer proposing to purchase old software's intellectual-property rights repeats that treatment.
Suppose code developed in 2024 is supplied by a foreign person in September 2026 for a model-year-2027 vehicle. Its earlier development date does not eliminate the September supply event. The date of an IP assignment alone would not establish what was supplied or when.
Covered software is not automatically prohibited software. BIS identifies a declaration route where no prohibition applies. That requires checking who designed, developed, manufactured and supplied the code. A supplier outside China or Russia does not, by itself, establish that the software lacks the prohibited nexus.
Maintenance belongs in the purchase decision
The regulation makes the maintainer's relationship to a foreign adversary material. An old software component loses the exclusion if such an entity maintains, augments or otherwise alters it after the cutoff. This is distinct from the FAQ's broader reference to supply by any foreign person. A foreign supplier is not necessarily a foreign-adversary-linked entity.
In the BIS Connected Vehicles final rule, 90 FR 5360, at pages 5377-5378, BIS described the legacy provision as allowing time to move both IP rights and responsibility for development and maintenance into the regulated entity's organization.
If the buyer still depends on the seller to repair a fault or modify the relevant component, that dependence belongs in the licensing review. A contract promising domestic control needs an engineering account of who can perform the work. That inquiry should precede a vehicle-program commitment that assumes the exclusion will remain available.
Changing the maintenance team today cannot establish that no disqualifying work or supply occurred earlier. The review must cover the period since March 17, not merely the proposed operating arrangement after closing.
What the supply history changes
The matrix assumes software within the rule's functional scope and vehicle transactions beyond the transition relief. Later supply or maintenance means after March 17, 2026. The China or Russia nexus means an entity owned by, controlled by, or subject to the jurisdiction or direction of either country. The independent manufacturer restriction still requires review.
Software review matrix, September 21, 2026
| Facts established for the subcomponent | Software treatment | Approval-file consequence |
|---|
| Qualifying pre-cutoff code, with no later foreign supply or disqualifying maintenance | Legacy exclusion remains available | Preserve the dated basis for exclusion |
| Later foreign-person supply, with no prohibited nexus in design, development, manufacture or supply | Covered software, declaration route if applicable | Establish provenance and support the declaration |
| Later supply by an entity with the prohibited China or Russia nexus | Covered software subject to the software prohibition | Establish an applicable authorization before the otherwise-prohibited vehicle import or sale |
| Later maintenance, augmentation or alteration by an entity with the prohibited China or Russia nexus | Legacy exclusion lost, covered-software prohibition applies to the vehicle transaction | Identify the affected component and establish an applicable authorization for that vehicle transaction |
These distinctions follow the BIS FAQ and 15 CFR 791.303, prohibited covered-software transactions. Section 791.303 addresses knowing imports and U.S. sales of completed connected vehicles incorporating covered software with the specified nexus. A code-acquisition agreement and the subsequent vehicle transaction are not interchangeable legal events.
The exclusion does not clear the whole vehicle
The definition reaches certain software with a foreign interest, executed by primary processing units of items directly enabling vehicle connectivity systems or automated driving systems. Firmware and qualifying open-source software have their own exclusions. The rule does not treat every Chinese-developed program or vehicle component alike, and its connected-vehicle definition excludes vehicles above 10,000 pounds gross vehicle weight rating.
Vehicle timing is also separate from software age. Under 15 CFR 791.308, connected-vehicle exemptions, the software and manufacturer exemptions cover vehicles manufactured before model year 2027. Model year 2027 is not a universal January 1, 2027 deadline. BIS says qualifying legacy code can remain excluded in any model year.
Finally, 15 CFR 791.304, manufacturer-level restrictions independently restricts U.S. sales by manufacturers meeting the China or Russia ownership, control, jurisdiction or direction test, where completed connected vehicles incorporate VCS hardware or covered software. A favorable conclusion about one software component does not dispose of that test.
Resolve the supply history before approving the program
The compliance lead should connect the licensing file to engineering's component history, delivery records and maintenance arrangements. Where a declaration is required, 15 CFR 791.305, declarations of conformity calls for retained documentation sufficient to identify the author, timestamp, component and supplier of all proprietary additions. The same section does not treat every software update as a material change requiring an updated declaration.
The final rule expressly invites an advisory-opinion request about purchases from prohibited suppliers where the revised definition does not itself exclude the transaction. BIS Connected Vehicles guidance on advisory opinions under 15 CFR 791.310 provides that interpretive route. Permission for an otherwise prohibited transaction is a separate authorization question, examined in Traverse's analysis of unpublished BIS authorization terms.
Where the supply date or the seller's future maintenance role remains unresolved, the compliance lead should withhold a legacy-exclusion conclusion from the licensing approval. Reopen that conclusion if the delivery terms, maintainer or applicable BIS guidance changes before the planned vehicle imports or sales.