Connected Vehicle Supply Chain Rule Compliance Requirements

UNITED STATES DEPARTMENT OF COMMERCE

Bureau of Industry and Security

Information and Communications Technology and Services

Washington, D.C. 20230

Subject: Paperwork Reduction Act – Information Collection for Rulemaking

INTRODUCTION

The Office of Information and Communications Technology and Services within the Department of Commerce (the Department) plans to create a portal to intake applications for Declarations of Conformity and Specific Authorizations related to our Connected Vehicles rulemaking. The portal has not yet been created as intake will not begin until one year after the final rule is published. The Department plans to include the following fields for collecting information related to Declarations of Conformity and Specific Authorizations. The specific wording of these questions will be updated to align with the final rule text.

DECLARATIONS OF CONFORMITY

There are three Declarations of Conformity that can be submitted, depending on the type of declarant. All three Declaration types will be available via the portal.

1. Declaration for Vehicle Connectivity System (VCS) Hardware Importers

   • Section 1: Party Information

     1. Please provide the name and address of the VCS Hardware Importer to which this Declaration applies.

        1. Legal Entity Name

        2. Street Address

        3. City

        4. State/Territory

        5. ZIP or Postal Code

   • Section 2: VCS Hardware Transaction(s)

     1. Do you, as the declarant, certify that you have not knowingly engaged in a Prohibited VCS Hardware Transaction?

        1. Yes

        2. No

     2. Please provide the FCC ID Number of the VCS Hardware and, if applicable, of the subcomponents contained therein.

     3. Please list the third-party external endpoints to which the VCS Hardware connects, including the country where each endpoint is located and/or the identity and location of the service provider.

     4. If known, please provide the make, model, and trim of the Completed Connected Vehicles for which the VCS Hardware is intended.

     5. Please upload a Hardware Bill of Materials (HBOM) for the VCS Hardware that is the subject of this Declaration of Conformity.

     6. Please provide any other documentation of the VCS Hardware Importer’s due diligence efforts, to include independent or hired third-party research, to ensure the VCS Hardware listed in the HBOM is not designed, developed, manufactured, or supplied by persons owned by, controlled by, or subject to the jurisdiction or direction of the People’s Republic of China (PRC) or the Russian Federation (Russia).

     7. Is this submission an update to a previously filed Declaration of Conformity? If so, please provide the date of the last submission.

        1. Yes

        2. No

        3. Date of Last Submission (if applicable)

     8. Please provide any additional material information the VCS Hardware Importer would like to submit in support of this Declaration of Conformity (optional).

   • Section 3: Point of Contact Information

     1. Please provide the following point of contact information.

        1. Legal Name (First, Middle, Last)

        2. Email Address

        3. Phone Number

2. Declaration for Connected Vehicle Manufacturers Importing Completed Connected Vehicles

   • Section 1: Party Information

     1. Please provide the name and address of the Connected Vehicle Manufacturer to which this Declaration applies.

        1. Legal Entity Name

        2. Street Address

        3. City

        4. State/Territory

        5. ZIP or Postal Code

   • Section 2: Completed Connected Vehicle Transaction(s)

     1. Do you, as the declarant, certify that you have not knowingly engaged in a Prohibited Covered Software Transaction?

        1. Yes

        2. No

     2. Please provide the following information applicable to the Completed Connected Vehicles.

        1. Make

        2. Model

        3. Trim

        4. Vehicle Identification Number (VIN) Series

     3. Please upload a Software Bill of Materials (SBOM) for the Covered Software that is subject to this Declaration of Conformity. (Note: At a minimum, the SBOM must include author’s name, timestamp, supplier name, component name, version string, component hash, package URL, unique identifier, and dependency relationships to other software components.)

     4. Please provide any other documentation of the Connected Vehicle Manufacturer’s due diligence efforts, to include independent or hired third-party research, to ensure that the Covered Software listed in the SBOM is not designed, developed, manufactured, or supplied by persons owned by, controlled by, or subject to the jurisdiction or direction of the People’s Republic of China (PRC) or the Russian Federation (Russia).

     5. Is this submission an update to a previously filed Declaration of Conformity? If so, please provide the date of the last submission.

        1. Yes

        2. No

        3. Date of Last Submission (if applicable)

     6. Please provide any additional material information the Connected Vehicle Manufacturer would like to submit in support of this Declaration of Conformity (optional).

   • Section 3: Point of Contact Information

     1. Please provide the following point of contact information.

        1. Legal Name (First, Middle, Last)

        2. Email Address

        3. Phone Number

3. Declaration for Connected Vehicle Manufacturers Selling Completed Connected Vehicles

   • Section 1: Party Information

     1. Please provide the name and address of the Connected Vehicle Manufacturer to which this Declaration applies.

        1. Legal Entity Name

        2. Street Address

        3. City

        4. State/Territory

        5. ZIP or Postal Code

   • Section 2: Completed Connected Vehicle Transaction(s)

     1. Do you, as the declarant, certify that there is a Foreign Interest in the Covered Software that is incorporated in the Completed Connected Vehicles that will be sold in the United States?

     2. Do you, as the declarant, certify that you have not knowingly engaged in a Prohibited Covered Software Transaction?

        1. Yes

        2. No

     3. Please provide the following information applicable to the Completed Connected Vehicles.

        1. Make

        2. Model

        3. Trim

        4. Vehicle Identification Number (VIN) Series

     4. Please upload a Software Bill of Materials (SBOM) for the Covered Software that is subject to this Declaration of Conformity. (Note: At a minimum, the SBOM must include author’s name, timestamp, supplier name, component name, version string, component hash, package URL, unique identifier, and dependency relationships to other software components.)

     5. Please provide any other documentation of the Connected Vehicle Manufacturer’s due diligence efforts, to include independent or hired third-party research, to ensure the Covered Software listed in the SBOM is not designed, developed, manufactured, or supplied by persons owned by, controlled by, or subject to the jurisdiction or direction of the People’s Republic of China (PRC) or the Russian Federation (Russia).

     6. Is this submission an update to a previously filed Declaration of Conformity? If so, please provide the date of the last submission.

        1. Yes

        2. No

        3. Date of Last Submission (if applicable)

     7. Please provide any additional material information the Connected Vehicle Manufacturer would like to submit in support of this Declaration of Conformity (optional).

   • Section 3: Point of Contact Information

     1. Please provide the following point of contact information.

        1. Legal Name (First, Middle, Last)

        2. Email Address

        3. Phone Number

SPECIFIC AUTHORIZATIONS

There is one application type for a Specific Authorization, which will be available in the portal.

1. Specific Authorization for VCS Hardware Importers or Connected Vehicle Manufacturers to Engage in Otherwise Prohibited Transactions

   • Section 1: Party Information

1. Please provide the identity of the parties engaged in the transaction.

1. Legal Entity Name

2. Street Address

3. City

4. State/Territory

5. ZIP or Postal Code

6. Relevant Corporate Identifiers (if applicable)

1. Please provide information sufficient to identify the ultimate beneficial ownership of the transacting parties.

• Section 2: Transaction Information

  1. Please provide an overview of the VCS Hardware or Covered Software that is designed, developed, manufactured, or supplied by a person owned by, controlled by, or subject to the jurisdiction or direction of the People’s Republic of China (PRC) or the Russian Federation (Russia).

  2. If known, please provide the make, model, and trim of the Completed Connected Vehicle in which the VCS Hardware or Covered Software will be integrated.

  3. Please describe the intended function of the VCS Hardware of Covered Software.

  4. Please upload documentation to support the information contained in the application, including SAE 21434 Threat Analysis and Risk Assessments, to include an assessment on the applicant’s ability to limit PRC or Russian government access to, or influence over the design, development, manufacture or supply of the VCS Hardware or Covered Software; security standards used by the applicant with respect to the VCS Hardware or Covered Software; other actions and proposals such as technical controls (i.e., software validation) or operational controls (i.e., physical and logical access monitoring procedures), the applicant intends to take to mitigate undue or unacceptable risk. (Note: The Department may request additional information after this initial application for a Specific Authorization. Failure to provide requested additional information could result in an automatic denial of the Specific Authorization).

• Section 3: Point of Contact Information

  1. Please provide the following point of contact information.

     1. Legal Name (First, Middle, Last)

     2. Email Address

     3. Phone Number

7