Connected Vehicles Supporting Statement

SUPPORTING STATEMENT

U.S. Department of Commerce

Bureau of Industry and Security

Connected Vehicle Supply Chain Rule Compliance Requirements

OMB Control No. 0694-XXXX

A. Justification

1. Explain the circumstances that make the collection of information necessary.

E.O. 13873, “Securing the Information and Communications Technology and Services Supply Chain,” (May 15, 2019) delegated to the Secretary of Commerce broad authority to prohibit or impose mitigation measures on any information and communications technology and services (ICTS) Transaction with a foreign adversary nexus that is subject to United States jurisdiction and poses undue or unacceptable risks to the United States. This request for a new information collection is necessary due to a regulation focused on Connected Vehicles. More specifically, our regulation would, absent a General or Specific Authorization, (1) prohibit Vehicle Connectivity Systems (VCS) (“VCS Hardware,” as defined in the NPRM) Importers from knowingly importing into the United States certain hardware for VCS; (2) prohibit Connected Vehicle Manufacturers from knowingly importing into the United States, Completed Connected Vehicles incorporating certain software that supports the function of VCS or Automated Driving Systems (ADS) (“Covered Software,” as defined in the NPRM); (3) prohibit Connected Vehicle Manufacturers from knowingly selling within the United States Completed Connected Vehicles that incorporates Covered Software; and (4) prohibit Connected Vehicle Manufacturers who are owned by, controlled by, or subject to the jurisdiction or direction of the PRC or Russia from knowingly Selling in the United States Completed Connected Vehicles that incorporate VCS Hardware or Covered Software. Such prohibitions would apply where the VCS Hardware or Covered Software is designed, developed, manufactured, or supplied by persons owned by, controlled by, or subject to the jurisdiction or direction of the PRC or Russia.

The new information collection will take the form of Declarations of Conformity and Specific Authorizations. Declarations and Specific Authorizations will be used as tools to ensure compliance with our regulation and are integral to the success of this program. All VCS Hardware Importers or Connected Vehicle Manufacturers must submit a Declaration annually to attest¹ that they are not knowingly engaging in an otherwise Prohibited Transaction. If a VCS Hardware Importer or Connected Vehicle Manufacturer cannot make such an attestation, then they must submit a request for a Specific Authorization. When determining whether to grant a Specific Authorization, the Department will consider (1) whether the entity can attest that their otherwise Prohibited Transaction does not pose an undue or unacceptable risk to U.S. national security, and (2) if the entity agrees to a decision notice from the Department that will contain conditions that must be met by the parties for the transaction to be authorized.

2. Explain how, by whom, how frequently, and for what purpose the information will be used. If the information collected will be disseminated to the public or used to support information that will be disseminated to the public, then explain how the collection complies with all applicable Information Quality Guidelines.

The collected information will be used by the Department’s Office of Information and Communications Technology and Services (OICTS) to run a compliance program to ensure that Connected Vehicle Manufacturers and VCS Hardware Importers comply with the regulation. OICTS’s compliance team will review the Declaration of Conformity and Specific Authorization submissions on a rolling basis, as they are received. Declarations of Conformity certify that imports of VCS Hardware and imports or sales of Completed Connected Vehicles comply with the prohibitions on VCS Hardware and Covered Software in this proposed rule. A Specific Authorization would be submitted by an entity who wishes to engage in an otherwise Prohibited Transaction. The specific information to be collected in Declarations of Conformity or Specific Authorizations via the Department’s web portal can be found in the “Paperwork Reduction Act – Information Collection for Rulemaking” document accompanying this “Supporting Statement” in the PRA package. For Specific Authorizations, the Department may request additional information from the applicant in order to better come to a decision. In certain situations, this may take the form of an oral briefing, which the Department will schedule with the applicant and any other relevant parties.

The Department does not anticipate disseminating the collected information to the public except to the extent required by law.

3. Describe whether, and to what extent, the collection of information involves the use of automated, electronic, mechanical, or other technological techniques or other forms of information technology.

The Department plans to encourage Connected Vehicle Manufacturers and VCS Hardware Importers to submit documentation required by the proposed rule in electronic format via a web-based portal, the development of which is under discussion within the Department. The portal has not yet been created as intake will not begin until one year after the final rule is published.

4. Describe efforts to identify duplication.

The Commerce Department is the only government department that has authority over the review of foreign adversary ICTS, including in Connected Vehicles. The Department has worked closely with the interagency in this effort and no duplicate authorities have been identified.

5. If the collection of information involves small businesses or other small entities, describe the methods used to minimize burden.

Small entities that produce less than 1,000 Connected Vehicle or VCS Hardware units in a calendar year (i.e., small entities) qualify for a General Authorization that exempts them from the prohibitions outlined in the proposed rule. Small entities that qualify for General Authorizations are not required to notify the Department as General Authorizations take the form of self-certifications. However, the Department will require all Connected Vehicle Manufacturers and VCS Hardware Importers to maintain complete records related to any transaction for which a Declaration of Conformity, General Authorization, or Specific Authorization would be required by this rule for a period of ten years, consistent with IEEPA’s statute of limitations.

6. Describe the consequences to the Federal program or policy activities if the collection is not conducted or is conducted less frequently.

Without annual Declarations of Conformity, the Department would be unable to ensure that VCS Hardware or Covered Software entering the United States were absent of components designed, developed, manufactured or supplied by persons owned by, controlled by, or subject to the jurisdiction or direction of the PRC or Russia. Similarly, without Specific Authorizations, the Department would be unable to permit otherwise Prohibited Transactions that do not pose an undue or unacceptable risk to U.S. national security. Connected Vehicles under the influence of a foreign adversary could have potentially catastrophic effects on U.S. national security through both data collection and exfiltration, as well as disruption of critical infrastructure. Therefore, the Department feels that the collection of the requested information in Declarations of Conformity and Specific Authorizations is warranted.

7. Explain any special circumstances that require the collection to be conducted in a manner inconsistent with OMB guidelines.

There are no special circumstances that will result in the collection of information in a manner inconsistent with the guidelines of 5 C.F.R. § 1320.6.

8. Provide information of the PRA Federal Register Notice that solicited public comments on the information collection prior to this submission. Summarize the public comments received in response to that notice and describe the actions taken by the agency in response to those comments. Describe the efforts to consult with persons outside the agency to obtain their views on the availability of data, frequency of collection, the clarity of instructions and recordkeeping, disclosure, or reporting format (if any), and on the data elements to be recorded, disclosed, or reported.

Prior to issuing this proposed rule, the Department sought and received public comment on the concepts in this rule in an Advance Notice of Proposed Rulemaking (ANPRM) (89 FR 15066) (March 1, 2024). The Department received 57 comments to the ANPRM and addressed those comments in the proposed rule. The Department plans to provide a 30-day notice requesting public comment after the publication of the NPRM.

9. Explain any decisions to provide payments or gifts to respondents, other than remuneration of contractors or grantees.

This proposed rule will not involve any payment or gifts to respondents who submit documentation.

10. Describe any assurance of confidentiality provided to respondents and the basis for assurance in statute, regulation, or agency policy.

Although we did not develop any specific confidentiality provisions in this proposed rule, the Department is committed to protecting business proprietary and confidential information submitted. Some information collected under this rule would generally be considered to be confidential business information, as defined in 19 C.F.R. § 201.6, or proprietary information. As will be indicated in the regulation and in the submission portal, when submitting such information, entities should notify the Department and provide the statutory basis for the claim of confidentiality. Note too that some information or documentary materials collected under this rule, not otherwise publicly or commercially available, will not be released publicly except to the extent required by law. Based on existing statutes, including the criminal provisions of 18 U.S.C. § 1905, federal employees disclosing confidential or business proprietary information may face civil and criminal penalties for doing so.

11. Provide additional justification for any questions of a sensitive nature, such as sexual behavior and attitudes, religious beliefs, and other matters that are commonly considered private.

Not applicable.

12. Provide an estimate in hours of the burden of the collection of information.

The Department estimates that the initial burden hours placed on applicable entities would be 28,100 hours annually. BIS estimates an average of 281 declarations annually with an estimated 100 burden hours per declaration for a total of 28,100 burden hours annually. This estimate is also subject to variations among respondents due to application type. Declarations of Conformity will need to be submitted annually, while Specific Authorizations will only need to be updated on an as-needed basis.

13. Provide an estimate of the total annual cost burden to the respondents or record- keepers resulting from the collection (excluding the value of the burden hours in

Question 12 above).

There is no additional cost to the respondent.

14. Provide estimates of annualized cost to the Federal government.

The estimated annual cost to the U.S. Government for federal employee salaries is $850,000 [500 Declaration of Conformity/Specific Authorization notifications per year * two staff at a GS-13 salary ($85/hour * 2 = $170/hour) * average of 10 hours each to review each notification]. The $85 per staff member per hour cost estimate for this information collection is consistent with the GS-scale salary data for a GS-13 Step 1 (https://www.opm.gov/policy-data-oversight/pay-leave/salaries-wages/salary-tables/pdf/2024/DCB.pdf) multiplied by a factor of 1.5 to include the cost of benefits.

The total estimated annual cost to the U.S. Government is $1,081,486.50. The calculation is as follows:

ITEM	ESTIMATED COST
Federal Employee Salaries (2 full-time employees)	$850,000.00
Federal Government Overhead @ 20%	$170,000.00
Legal Support (GS-15 Step 1 salary (multiplied by 1.5 to include the cost of benefits) @ 25%)	$61,486.50
Total	$1,081,486.50

15. Explain the reasons for any program changes or adjustments.

The proposed rule, once finalized, will create a new program that has not previously been implemented. As a new program, there are no changes or adjustments to a pre-existing program being proposed.

16. For collections whose results will be published, outline the plans for tabulation and publication.

The Department does not intend to publish the collected information except to the extent required by law.

17. If seeking approval to not display the expiration date for OMB approval of the information collection, explain the reasons why display would be inappropriate.

The Department will display the OMB control number and expiration date on all forms.

18. Explain each exception to the certification statement.

There are no exceptions to the certification statement.

B. COLLECTIONS OF INFORMATION EMPLOYING STATISTICAL METHODS

Not applicable.

1 Declarations of Conformity will likely take the form of an unsworn statement or declaration under 28 U.S.C. § 1746.

4