Connected Vehicle Supply Chain Rule Compliance Requirements

OMB Control No. 0694-0145

Expiration Date: 01/31/2028

SUBJECT: PAPERWORK REDUCTION ACT – INFORMATION COLLECTION FOR RULEMAKING

INTRODUCTION

The new information collection for this rule will primarily take the form of Declarations of Conformity, specific authorizations applications, and advisory opinion requests. After the rule is published, the Office of Information and Communications Technology and Services within the Bureau of Industry and Security (BIS) will initially intake Declarations of Conformity, specific authorization applications, and advisory opinion requests via PDF forms that will be transmitted to BIS over e-mail. The PDF forms will be created and accessible on the BIS website after the Final Rule is published. BIS is also currently working to create a web-based portal and will transfer intake to this portal once it has been created. BIS will include the following fields in the PDF forms and subsequent web-based portal for information collection related to Declarations of Conformity, specific authorizations applications, and advisory opinion requests.

PAPERWORK REDUCTION ACT STATEMENT

This information collection meets the requirements of 44 U.S.C. § 3507, as amended by section 2 of the Paperwork Reduction Act of 1995. You do not need to answer these questions unless a valid Office of Management and Budget (OMB) control number is displayed. The OMB control number assigned to this collection is 0694-0145. Send the completed form via the instructions at bis.gov/connected-vehicles.

The public reporting burden for this collection of information is estimated to average 4 hours per response, including the time for reviewing instructions, and completing and reviewing the collection of information. You may send comments regarding the burden hour estimate or any other aspect of this collection to: [email protected].

DECLARATIONS OF CONFORMITY

1. VCS Hardware

   • Section 1: Party Information

     1. Please provide the name and address of the VCS hardware importer (“Declarant”) to which this Declaration applies.

        • Legal Entity Name

        • Street Address

        • City

        • State/Territory

        • Country

        • ZIP or Postal Code

     2. Please provide the following identifying information for an individual point of contact.

        • Legal Name

        • E-mail Address

        • Phone Number

   • Section 2: Transaction Information

     1. If known, please provide the FCC ID Number associated with the VCS hardware and, if applicable, of the subcomponents contained therein.

     2. If known, please provide the make and model of the connected vehicle(s) for which the VCS hardware is intended, or already integrated.

        • Make

        • Model

     3. Do you certify that the VCS hardware described in the declaration of conformity was not designed, developed, manufactured, or supplied by persons owned by, controlled by, or subject to the jurisdiction or direction of the PRC or Russia?

        • Yes

        • No

     4. Do you certify that the Declarant has conducted due diligence (with or without the use of third-party assessments) to inform the above certification, and the Declarant or a delegated third party maintains documentation (either through a Hardware Bill of Materials (HBOM) or otherwise) and third-party assessments (as applicable) in support of the above certification, which can be made available upon request by BIS?

        • Yes

        • No

     5. Please provide the following identifying information of who maintains the documentation and third-party assessments (as applicable) as certified above.

        • Legal Name

        • E-mail Address

        • Phone Number

     6. Do you certify that the Declarant has taken all possible measures, either contractually or otherwise, to ensure any necessary documentation and assessments from suppliers will be furnished to BIS upon request either by the Declarant, or, in cases including confidential business information, directly by the supplier?

        • Yes

        • No

     7. Is this submission an update to a prior Declaration of Conformity?

        • Yes

        • No

        • Date of Last Submission (if applicable)

2. Covered Software

   • Section 1: Party Information

     1. Please provide the name and address of the connected vehicle manufacturer (“Declarant”) to which this Declaration applies.

        • Legal Entity Name

        • Street Address

        • City

        • State/Territory

        • Country

        • ZIP or Postal Code

     2. Please provide the following identifying information for an individual point of contact.

        • Legal Name

        • E-mail Address

        • Phone Number

   • Section 2: Transaction Information

     1. Please provide the make, model, trim, and Vehicle Identification Number (VIN) series applicable to the completed connected vehicles that incorporate the covered software.

        • Make

        • Model

        • Trim

        • VIN Series

     2. Do you certify that the covered software described in the declaration of conformity was not designed, developed, manufactured, or supplied by persons owned by, controlled by, or subject to the jurisdiction or direction of the PRC or Russia?

        • Yes

        • No

     3. Do you certify that the Declarant has conducted due diligence (with or without the use of third-party assessments) to inform the above certification, and the Declarant or a delegated third party maintains documentation (either through a Software Bill of Materials (SBOM) or otherwise) and third-party assessments (as applicable) that are sufficient to identify, at minimum, the author name, timestamp, component name, and supplier name of all proprietary additions to the development of the covered software, which can be made available upon request by BIS?

        • Yes

        • No

     4. Please provide the following identifying information of who maintains the documentation and third-party assessments (as applicable) as certified above.

        • Legal Name

        • E-mail Address

        • Phone Number

     5. Do you certify that the Declarant has taken all possible measures, either contractually or otherwise, to ensure any necessary documentation and assessments from suppliers will be furnished to BIS upon request either by the Declarant, or, in cases including confidential business information, directly by the supplier?

        • Yes

        • No

     6. Is this submission an update to a prior Declaration of Conformity?

        • Yes

        • No

        • Date of Last Submission (if applicable)

SPECIFIC AUTHORIZATION APPLICATION

1. Specific Authorization Application for VCS Hardware Importers or Connected Vehicle Manufacturers to Engage in an Otherwise Prohibited Transaction

• Section 1: Party Information

1. Please provide the identity of the parties engaged in the transaction.

• Legal Entity Name

• Street Address

• City

• State/Territory

• Country

• ZIP or Postal Code

1. Please provide any relevant corporate identifiers.

2. Please provide information sufficient to identify the ultimate beneficial ownership of the transacting parties.

3. Please provide the following identifying information for an individual point of contact.

   • Legal Name

   • E-mail Address

   • Phone Number

• Section 2: Transaction Information

  1. Please provide an overview of the VCS hardware or covered software that is designed, developed, manufactured, or supplied by a person owned by, controlled by, or subject to the jurisdiction or direction of the PRC or Russia, including persons responsible for assembling and packaging VCS hardware or covered software.

  2. If known, please provide the make, model, and trim of the connected vehicle(s) in which the VCS hardware or covered software will be integrated.

     • Make

     • Model

     • Trim

  3. Please provide the intended function of the VCS hardware or covered software.

  4. Please attach documentation to support the information contained in the application, such as any ISO/SAE 21434 Threat Analysis and Risk Assessments (if available).

  5. Please provide an assessment of the applicant’s ability to limit PRC or Russian government access to, or influence over the design, development, manufacture or supply of the VCS hardware or covered software.

  6. Please list any security standards used by the applicant with respect to the VCS hardware or covered software.

  7. If applicable, please describe any other actions and proposals such as technical controls (e.g., software validation) or operational controls (e.g., physical and logical access monitoring procedures) the applicant intends to take to mitigate undue or unacceptable risk.

ADVISORY OPINION REQUEST

1. Advisory Opinion Request for VCS Hardware Importers or Connected Vehicle Manufacturers

• Section 1: Party Information

1. Please provide the following identifying information of the submitter.

• Legal Name

• Title

• E-mail Address

• Phone Number

• Street Address

• City

• State/Territory

• Country

• ZIP or Postal Code

1. Please provide all available information identifying the parties to the prospective transaction.

   • Legal Entity Name

   • Street Address

   • City

   • State/Territory

   • Country

   • ZIP or Postal Code

• Section 2: Transaction Information

  1. Please provide information regarding the VCS hardware and/or covered software and attach any descriptive literature, brochures, technical specifications, or papers that provide sufficient technical detail to enable BIS to verify whether the prospective transaction would constitute a prohibited transaction as defined in this subpart.

  2. For connected vehicle manufacturers: the make, model, and trim level, or other identifying information of the completed connected vehicle. 

     • Make

     • Model

     • Trim

     • Other Identifying Information (if applicable)

  3. For VCS hardware importers: the identification of the system; and, if known, the make, model, and trim of the group of completed connected vehicles for which the equipment is intended.

     • Identification of the System

     • Make (if known)

     • Model (if known)

     • Trim (if known)

  4. Please provide any other information that the submitter believes to be material to the prospective transaction (as applicable).

7