A 2027 Connected-Vehicle Declaration Came Back: Which Field Broke?

Signals to watch

• A CARS declaration receives an information request, but the message does not identify the VCS or ADS function and covered item
• A supplier is described by shipment country while design, development, manufacture, supply and ownership or control remain unresolved
• A model-year 2027 software question is answered with the model-year 2030 VCS hardware date

Answer first: do not repair a returned connected-vehicle declaration by rewriting the supplier name in isolation. Rebuild the filing in this order: regulated party, vehicle, VCS or ADS function, covered hardware or software, supplier and control chain, model year, then declaration or authorisation route. If any link is missing, the engagement is evidence recovery—not a promise that the filing will pass.

Definition: under the Bureau of Industry and Security (BIS) connected-vehicles rule, the regulated parties are Vehicle Connectivity System (VCS) hardware importers and connected vehicle manufacturers. VCS covers systems that enable a vehicle to communicate over radio frequency; ADS means automated driving system. The rule restricts specified VCS hardware and covered software with a sufficient connection to China or Russia and uses Declarations of Conformity, General Authorizations, Specific Authorizations and advisory opinions for different compliance questions.

A connected-vehicle compliance consultancy engagement lead might see this composite fragment in authorised automotive supply-chain, component-compliance and import-operations Telegram groups:

“CARS sent the 2027 declaration back. Head unit ships from Mexico, supplier says it’s not China. Need it fixed before release.”

A later reply adds: “firmware team is in Shenzhen, hardware entity is EU.” Nothing identifies the vehicle weight, the exact communication function, the covered item, the legal importer, the connected vehicle manufacturer, the ownership chain, the model or VIN series, or the words in the CARS response. This is not a real customer or an official decision. It is a realistic example of why one urgent sentence can hide three different assignments.

Seeing it one day late matters because the official Declarations of Conformity page says a connected vehicle manufacturer generally files at least 60 days before the first import or first US sale of each model year of a completed vehicle incorporating covered software. A VCS hardware importer generally files at least 60 days before the first import for each vehicle model year, or calendar year for units without a model year. A lost day compresses supplier evidence, legal review and the decision on whether a declaration is even the right route.

What the message makes visible

The fragment exposes only four usable fields.

First, someone used CARS, the Compliance Application and Reporting System. That suggests a filing workflow, but it does not reveal the filer or regulated party. BIS says only regulated parties can submit these declarations, Specific Authorization applications and advisory-opinion requests. Counsel and consultants can submit for a qualifying client through the Trusted Entities feature; a foreign supplier should not be mistaken for the declarant merely because it supplied the evidence.

Second, “2027” appears. It might be a vehicle model year, an internal programme name or a deadline shorthand. Preserve the exact field before treating it as model year.

Third, a head unit and firmware are mentioned. A commercial label is not the legal function test. The reviewer still needs to identify whether the item directly enables VCS, contains associated firmware, or includes software supporting VCS or ADS at the vehicle level.

Fourth, Mexico, China and the European Union appear in different sentences. Those places may describe shipment, engineering, incorporation or a parent company. None alone answers who designed, developed, manufactured or supplied the item, or who owns, controls or directs the relevant person.

The missing fields that can change the filing route

The first missing field is the regulated-party identity. Is the client importing VCS hardware, manufacturing the completed connected vehicle, doing both, or merely supplying a component? The filing owner changes which transaction and covered items belong in the declaration.

The second is the vehicle boundary. The current BIS connected-vehicles overview describes the rule as applying to vehicles under 10,001 pounds. The exact make, model, model year and VIN series are needed before evidence from one platform is reused for another.

The third is the covered-item definition. Ask for part number, hardware revision, firmware and software version, supplier, actual VCS or ADS function, integration point and which completed vehicle receives it. “Head unit” may bundle a display, modem, Bluetooth, cellular functions and firmware from several suppliers. The declaration has to follow the covered function and source, not the purchase-order nickname.

The fourth is the supplier and control chain. A country-of-shipment certificate cannot resolve design, development, manufacture, supply, ownership, control or jurisdiction. Request the contracting entity, manufacturing entity, software developer, relevant parents and intermediaries, plus the documents supporting each relationship. The goal is not to infer a prohibited nexus from a city name; it is to show which official rule term each fact supports.

The fifth is the actual CARS record: submission ID, declarant, filing purpose, covered items, model year or calendar year, dates, attestation, attachments and the complete BIS follow-up. “Sent back” might mean a request for additional information, an error discovered by the filer or a conclusion that an item is no longer eligible. Those conditions do not share one repair.

Three dates that are easy to swap

The BIS final-rule announcement and the official final-rule text establish a phased calendar:

• the final rule became effective on 17 March 2025;
• software-related prohibitions begin with model year 2027;
• VCS hardware-related prohibitions begin with model year 2030, or 1 January 2029 for hardware units without a model year; and
• the related prohibition on sales by connected vehicle manufacturers with a sufficient China or Russia nexus begins with model year 2027.

Therefore “the hardware date is 2030” does not answer a 2027 covered-software problem. Conversely, finding firmware in a hardware item does not justify assigning every hardware question to 2027 without testing what transaction and covered item the filing addresses.

Declaration, authorisation and correction are not synonyms

A Declaration of Conformity is the route for an eligible transaction in which the regulated party certifies compliance after due diligence. BIS states that third-party assessments may support a declaration, but the declarant must identify their use. Supplier-held material can remain with the supplier under specified arrangements, yet the declarant still needs a supportable diligence chain.

A Specific Authorization addresses an otherwise prohibited transaction. The engagement lead should not sell “declaration repair” if the known facts point to that route. A General Authorization covers defined lower-risk transaction types; an advisory opinion asks BIS how the rule applies to a prospective transaction. These are separate records, not optional labels on the same submission.

If a prior declaration contains an omission, inaccuracy or error that could mislead BIS about the true source of covered hardware or software, current BIS instructions say the filer must submit the corrected declaration in full within 60 days after discovering the material change. If the items are no longer eligible, BIS says prohibited conduct must cease within 30 days; resuming requires a granted Specific Authorization where applicable. The exact notice and facts must be read before either response is proposed.

What a bounded first engagement produces

For the composite fragment, a useful first output would state what is visible, what is missing and which interpretation is unsafe. It would name the regulated party; connect one vehicle and model year to exact covered items; identify the entities responsible for hardware, firmware and software; document ownership and control; recover the CARS record; and state whether the next question is correction, Specific Authorization or an advisory opinion.

That work is different from an export-control classification. The BIS export-classification evidence chain can help with ECCN and source-record discipline, while the NIST SSDF supplier evidence map can support software-supplier evidence. Neither substitutes for 15 CFR Part 791 or the connected-vehicle transaction record.

The product can retain, merge, deduplicate and prioritise relevant fragments from Telegram groups a user deliberately connects and is authorised to access, preserving original message, source, time, summary and review reason. Saving a new matching target in the current production version only saves its configuration; it does not automatically run or create candidates. It cannot access CARS, inspect supplier files, determine a prohibited nexus, submit a declaration, obtain an authorisation or contact the writer. The current plan and product boundary show where human review begins.

Key facts

• The connected-vehicles rule became effective on 17 March 2025 and is codified in 15 CFR Part 791.
• The current rule applies to vehicles under 10,001 pounds.
• Software-related prohibitions begin with model year 2027.
• VCS hardware-related prohibitions begin with model year 2030, or 1 January 2029 for units without a model year.
• Regulated parties are VCS hardware importers and connected vehicle manufacturers; supplier and consultant roles do not replace that identity.
• Declarations, General Authorizations, Specific Authorizations and advisory opinions answer different transaction questions.
• Model, component, supplier-control and CARS-record facts remain unknown until authorised evidence is reviewed.

FAQ

What begins with model year 2027 under the connected-vehicles rule?

The software-related prohibitions begin with model year 2027. The rule also applies the related prohibition on sales by connected vehicle manufacturers with a sufficient China or Russia nexus from model year 2027.

Does the model-year 2030 date apply to covered software?

No. BIS identifies model year 2030 for the VCS hardware-related prohibition, with 1 January 2029 applying to hardware units not associated with a vehicle model year. Covered software follows the model-year 2027 date.

Is a Declaration of Conformity the same as a Specific Authorization?

No. A declaration certifies a regulated party’s compliance for an eligible transaction. A Specific Authorization is the route for permission to engage in a transaction that would otherwise be prohibited; it must be granted before that transaction proceeds.

Who owns the connected-vehicle filing?

The regulated party is the VCS hardware importer or connected vehicle manufacturer. Counsel or a consultant may submit through CARS on a qualifying client’s behalf using the Trusted Entities feature, but that does not turn the consultant or foreign supplier into the regulated party.

Reviewed by the editorial team on 21 August 2026 against the BIS connected-vehicles programme pages, Declarations of Conformity instructions, 15 CFR Part 791 and the final rule. This article does not determine scope or provide legal advice.

Frequently asked questions

What begins with model year 2027 under the connected-vehicles rule?

The software-related prohibitions begin with model year 2027. The rule also applies the related prohibition on sales by connected vehicle manufacturers with a sufficient China or Russia nexus from model year 2027.

Does the model-year 2030 date apply to covered software?

No. BIS identifies model year 2030 for the VCS hardware-related prohibition, with 1 January 2029 applying to hardware units not associated with a vehicle model year. Covered software follows the model-year 2027 date.

Is a Declaration of Conformity the same as a Specific Authorization?

No. A declaration certifies a regulated party’s compliance for an eligible transaction. A Specific Authorization is the route for permission to engage in a transaction that would otherwise be prohibited; it must be granted before that transaction proceeds.

Who owns the connected-vehicle filing?

The regulated party is the VCS hardware importer or connected vehicle manufacturer. Counsel or a consultant may submit through CARS on a qualifying client’s behalf using the Trusted Entities feature, but that does not turn the consultant or foreign supplier into the regulated party.

Sources and further reading

• BIS: Connected Vehicles program and compliance requirements↗
• BIS: Connected Vehicles Declarations of Conformity↗
• BIS: Commerce finalizes connected-vehicle supply-chain rule↗
• Federal Register public-inspection copy: Connected Vehicles final rule↗
• 15 CFR Part 791: Securing the ICTS supply chain — Connected Vehicles↗

RESEARCH & DEFINITIONS

How a Signal worth attention is found

See how Top Prospect finds and organizes Signals worth checking, keeps the original Telegram context, removes duplicates, and helps you decide what to review first. You decide whether to follow up and what to do next.

Open the methodology and core definitions →