In 2019, President Trump signed an executive order directed towards addressing national security concerns related to the global Information and Communications Technology and Services (ICTS) supply chain – i.e., the products and services that form the infrastructure for new and emerging technologies such as artificial intelligence, advanced computing, and advanced data collection. The concern in these areas is that because ICTS store and communicate vast amounts of sensitive information, facilitate the digital economy, and support critical infrastructure and vital emergency services, foreign adversaries could potentially exploit their role in the U.S. supply chain to interfere with U.S. ICTS technology or engage in other malign activities. On the final day of his first term, President Trump's administration adopted an initial version of the regulations authorizing U.S. governmental investigation, review, and potential prohibition of certain ICTS transactions (the ICTS Transaction Review Regulations). 

During the Biden administration, the U.S. Department of Commerce (Commerce), took further steps to implement President Trump's executive order by revising and amending the ICTS Transaction Review Regulations. President Biden himself also issued an additional executive order focused on this ICTS supply chain issue and Commerce began to implement this executive order as well. In late 2024 and early 2025, near the end of President Biden's term, his administration announced several important amendments and expansions of the ICTS Transaction Review Regulations. These changes (some proposed and others purportedly final) include: (1) amendments to the ICTS Transaction Review Regulations that expand U.S. government review of  ICTS-related transactions, and (2) new regulations prohibiting (on a phased-in schedule) the import or sale of certain ICTS software and hardware used or incorporated into connected vehicles that are linked to the People's Republic of China (PRC) or the Russian Federation (Russia) (the Connected Vehicle Regulations).

It remains to be seen whether some or all of these changes will survive the change in U.S. presidential administrations. A recent memorandum issued by the second Trump administration may lead to further modifications of these regulatory actions or, in the case of the Connected Vehicle Regulations, a postponement of their enactment. This announcement suggests that, while the change in administrations may lead to a different approach to the ICTS issue, ICTS-related risks to national security will continue to be a high priority bipartisan concern. As a result, companies whose operations and activities touch on the global ICTS supply chain should prepare to face increased restrictions, requirements, and scrutiny. Because of the importance of this issue to many of our clients, we provide in this Trade Flash a deeper dive into the most recent proposals and finalized changes to the ICTS rules and regulations. 

Background: U.S. Government Measures Focused on ICTS

The amendments to the ICTS Transaction Review Regulations and the new Covered Vehicle Regulations are the latest in a series of actions taken by the U.S. government to address national security risks arising from vulnerabilities in ICTS supply chains. These concerns were the focus of executive orders (E.O.s) issued during the first Trump administration and during the Biden administration. Specifically, E.O. 13873, which was issued by President Trump in 2019, gave the Secretary of Commerce broad authorization to implement regulations "to protect the security, integrity, and reliability" of ICTS "provided and used in the United States" and to prevent "foreign adversaries" – particularly the PRC and Russia – from creating and exploiting ICTS vulnerabilities. Subsequently, E.O. 14034, issued by the Biden administration in 2021, elaborated on the measures and risks noted in E.O. 13873, and, among other things, called on the Secretary of Commerce to address the risks posed by connected software applications and ongoing threats to sensitive personal data of U.S. persons. 

ICTS Transaction Review Regulations

The ICTS Transaction Review Regulations (15 C.F.R. Part 791) authorize Commerce to review, obtain information about (including through requiring witnesses to testify under oath at hearings and depositions, issuing subpoenas, and other investigatory measures), and to impose restrictions or prohibitions on certain ICTS transactions that pose an "undue or unacceptable risk" to ICTS supply chains, U.S. critical infrastructure, U.S. national security, or the security and safety of U.S. persons. While thus far, Commerce seems to have focused on ICTS transactions involving the PRC and Russia, ICTS transactions with links to Cuba, Iran, North Korea, and the "Maduro Regime" in Venezuela are also covered. 

The ICTS Transaction Review Regulations were first promulgated pursuant to E.O. 13873 on the final day of President Trump's first term, January 19, 2021, and were later amended on June 16, 2023 to, among other things, account for and address particular risks posed by connected software highlighted in E.O. 14034. These regulations were amended again on December 26, 2024, were set to become effective February 4, 2025, and appear to have been implemented (we explain some of the nuance on the implementation issue below). 

The December 2024 amendments include:  

• Revised definitions governing what constitutes a "Covered ICTS Transaction" that is subject to review by Commerce and who is considered a party to a transaction,
• Clarifications of the procedures governing the initiation of a review by Commerce, including the information to be provided to parties of a transaction being reviewed, and the factors considered by Commerce during a transaction review, and 
• A list of specific prohibited activities that would violate the terms of a "Final Determination" issued after a review of a Covered ICTS transaction, or that otherwise may lead to civil or criminal penalties.

As a result of the most recent amendments, Commerce can review transactions involving ICTS considered integral to information and communications hardware and software; data hosting, computing, or storage; connected software applications; critical infrastructure; and "critical and emerging technologies." The list of "critical and emerging technologies" that could trigger review now includes 11 categories, namely: (1) advanced network sensing and signature management; (2) advanced computing; (3) artificial intelligence; (4) clean energy generation and storage; (5) data privacy, data security, and cybersecurity technologies; (6) highly automated, autonomous, and uncrewed systems and robotics; (7) integrated communication and networking technologies; (8) positioning, navigation, and timing technologies; (9) quantum information and enabling technologies; (10) semiconductors and microelectronics; and (11) biotechnology.

Connected Vehicle Regulations 

The new Connected Vehicle Regulations (15 C.F.R. Part 791 Subpart D) were issued in a final rule on January 16, 2025, largely pursuant to E.O. 13873, and following a proposed rule published on September 26, 2024. Most significantly, the regulations prohibit the import and sale in the United States of certain hardware and software (and connected vehicles incorporating such hardware or software) that are linked to the PRC or Russia and that directly enable a connected vehicle's Automated Driving Systems (ADS) or Vehicle Connectivity Systems (VCS). In addition, many importers and some manufacturers will be required to submit annual declarations confirming that their vehicles comply with these prohibitions on ADS and VCS that are linked to the PRC or Russia. Given the broad definition of "connected vehicles," most passenger vehicles will fall within the scope of the regulations. Commerce has also signaled that, in the future, it may add to the list of technology prohibited under these regulations, which were set to become effective on March 17, 2025, but may now be subject to a pause and potential modification, as explained below. 

To minimize supply chain disruption, certain requirements and restrictions imposed under the Connected Vehicle Regulations are phased in to apply based on a vehicle's model year, allowing those affected time to adjust their sourcing. Specifically, the prohibitions will be effective beginning with a vehicle model year 2027 for covered software and model year 2030 for covered hardware. In the final rule setting out the regulations, Commerce indicated that it will consider issuing special authorizations to extend deadlines where an applicant can demonstrate its efforts to come into full compliance, and to authorize connected vehicles with links to the PRC or Russia where the applicant can sufficiently demonstrate that the risks from those links have been mitigated. Additionally, there are some exceptions and exclusions to the prohibitions, including for repair or warranty parts for covered hardware and for legacy code in covered software.

Once the prohibitions are implemented, many importers and manufacturers will be required to submit an annual declaration for every model year vehicle and must notify Commerce of any material changes to submitted declarations. 

Regulatory "Freeze" and Review Ordered by Trump Administration

While the amendments to the ICTS Review Regulations were scheduled to become effective on February 4, 2025, and the Connected Vehicles Regulations were set to become effective March 17, 2025, both of these regulatory actions were  subject to a more general Memorandum for the Heads of Executive Departments and Agencies issued by President Trump on January 20, 2025 (the Freeze and Review Memorandum), which requires agencies to "consider postponing for 60 days…the effective date for any rules that have been published…but have not taken effect, for the purpose of reviewing any questions of fact, law, and policy that the rules may raise." Despite falling within the scope of the Freeze and Review Memorandum, the amendments to the ICTS Review Regulations appear to have been implemented as announced. It is unclear if the ICTS Review Regulations may be further amended following a review undertaken pursuant to the Freeze and Review Memorandum, or separately, if the Connected Vehicles Regulations will be postponed or further modified prior to their scheduled implementation. 

Key Takeaways

• Bipartisan Focus on ICTS Transactions by the U.S. Government: Just as the Biden administration made significant changes to the ICTS Transaction Review Regulations that it inherited from the first Trump administration, the second Trump administration is likely to further modify the ICTS regulations. However, all indications are that ICTS transactions, particularly those involving the supply chain linked to the PRC, will remain a focus of bipartisan concern for the foreseeable future. The one tangible sign we have so far on this issue, the "America First Trade Policy" E.O. issued by President Trump on his first day in office in his second term, specifically directed Commerce to "review and recommend appropriate action" concerning the Connected Vehicle regulations and "consider whether controls on ICTS transactions should be expanded to account for additional connected products." The language suggests President Trump may further expand – rather than undo or limit – the amended ICTS Transaction Review Regulations, although the future of the Connected Vehicle Regulations remains less clear, and the tone of the E.O. is more ambivalent on this particular issue.
• Expansion of ICTS Review Could Lead to Expanded Enforcement: To date, enforcement of the ICTS rules has been limited, which is not surprising. In any new program, enforcement generally lags a bit behind the new regulations. However, in June 2024, Commerce prohibited the Russia-linked Kaspersky Lab Inc. from engaging in certain ICTS transactions with U.S. persons, effectively banning its software products from the U.S. market. This initial action suggests that enforcement could be coming on-line, and given the expansion of the new regulations, we expect a possible uptick in enforcement and scrutiny for ICTS transactions with links to U.S. "foreign adversaries." Companies engaged in affected industries in the United States or with U.S. counterparties should consider this potentially increased enforcement risk in evaluating contemplated ICTS transactions.
• Significant Impact on the Connected Vehicles Sector: Even with the phased-in implementation, importers and manufacturers of connected vehicles are likely to be the most significantly affected by the new regulations. In particular, the Connected Vehicle Regulations are poised to push certain brands of connected vehicles or related hardware or software out of the U.S. market unless special authorizations are issued or significant changes in organizational structures are made. The new exceptions for warranty/repair parts and legacy software may ease the pain of supply chain adjustments to a degree, but even then, significant changes will be required for affected importers and manufacturers in the long term. In addition, even if their supply chains are not ultimately prohibited, many importers and manufacturers will face greater compliance burdens related to the submission of the annual "Declarations of Conformity" to Commerce and other recordkeeping requirements. Ensuring such declarations are accurate will likely require companies to undertake supply chain due diligence and assessments to identify items restricted under the regulations, and to implement processes to maintain supply chain due diligence and monitoring. 

Miller & Chevalier's Economic Sanctions & Export Controls practice is continuing to monitor these developments and advise clients on their impact. For more information, please contact:

Timothy P. O'Toole, totoole@milchev.com, 202-626-5552

FeiFei (Andrea) Ren, fren@milchev.com, 202-626-5962

Caroline J. Watson, cwatson@milchev.com, 202-626-6083

Melissa Burgess, mburgess@milchev.com, 202-626-5914

Manuel Levitt, mlevitt@milchev.com, 202-626-5921

Annie Cho, acho@milchev.com, 202-626-1570

Rebecca Tweedie, rtweedie@milchev.com, 202-626-1487

The information contained in this communication is not intended as legal advice or as an opinion on specific facts. This information is not intended to create, and receipt of it does not constitute, a lawyer-client relationship. For more information, please contact one of the senders or your existing Miller & Chevalier lawyer contact. The invitation to contact the firm and its lawyers is not to be construed as a solicitation for legal work. Any new lawyer-client relationship will be confirmed in writing.

This, and related communications, are protected by copyright laws and treaties. You may make a single copy for personal use. You may make copies for others, but not for commercial purposes. If you give a copy to anyone else, it must be in its original, unmodified form, and must include all attributions of authorship, copyright notices, and republication notices. Except as described above, it is unlawful to copy, republish, redistribute, and/or alter this presentation without prior written consent of the copyright holder.