Commerce Establishes Approved Supplier Registry Under Connected Vehicles Rule

The Bureau of Industry and Security formalized a significant regulatory shift on June 18, 2026, by issuing General Authorization No. 3 under the Connected Vehicles Rule. This authorization creates an Approved Supplier Registry that fundamentally restructures how suppliers participate in the automotive supply chain for connected and autonomous vehicle components. Previously, suppliers could not apply directly for authorizations to engage in transactions involving vehicle connectivity systems (VCS) hardware or covered software with China or Russia nexus; instead, they relied on downstream customers such as original equipment manufacturers to seek approval on their behalf.

GA #3 eliminates this indirect pathway by granting suppliers direct access to BIS review and authorization. Suppliers can now submit applications through CARS detailing their products, customers, and mitigation measures to address potential national security risks. The BIS will evaluate applications on a case-by-case basis, determining whether specific VCS hardware or covered software presents an undue or unacceptable national security risk. Applications may cover multiple covered products and must include detailed proposals sufficient for BIS assessment, including descriptions of existing or planned controls. Once approved, both the supplier and associated products are added to the published Approved Supplier Registry, creating a transparent reference point for downstream compliance.

For connected vehicle manufacturers and VCS hardware importers, GA #3 enables transaction authorization without individual specific approvals—but only when both the supplier and relevant product appear together on the registry. Companies utilizing this pathway must declare their reliance through conformity declarations and maintain compliance records for at least ten years. Critically, organizations must continuously monitor the registry, as BIS retains discretionary authority to remove suppliers due to national security considerations or failure to comply with agreed-upon conditions. Companies owned by, controlled by, or subject to Chinese or Russian jurisdiction remain statutorily ineligible for GA #3 benefits and must pursue traditional specific authorizations.

The regulatory framework applies narrowly to connected vehicles and components with sufficient nexus to China or Russia, specifically targeting VCS hardware and covered software as defined in the Connected Vehicles Rule. BIS may condition approval on letters of assurance, mitigation agreements, or other requirements tailored to individual suppliers. This streamlined approval mechanism represents a balanced approach: it reduces administrative friction for compliant suppliers while preserving enhanced national security oversight through continued BIS discretion and mandatory ongoing monitoring obligations for downstream manufacturers and importers.