Off-highway machines could fall foul of Connected Vehicle Rule

(Photo: AdobeStock)

The US Connected Vehicle Rule is a national security regulation aimed at preventing foreign governments – primarily China and Russia – from gaining access to data collected by modern vehicles.

Under this regulation, which came into effect in March 2025, the import and/or sale of connected vehicles that contain certain software linked to or subject to control by the governments of the above countries will be banned from the 2027 model year.

This covers such elements as vehicle connectivity systems, including wifi, Bluetooth, satellite communications and similar technologies. It also impacts full or partial autonomous/self-driving systems.

The first brand to be impacted by the Connected Vehicle Rule is Polestar, the electric passenger vehicle company owned by China-based OEM Geely. From the 2027 model year, cars produced by Polestar will no longer be sold in the United States.

Interestingly, Volvo is also owned by Geely, but has not been subject to a similar market ban. This indicates that the US government is not looking specifically at company ownership, but at how the connectivity software and hardware is developed and managed by an individual brand.

It should be noted that many of the above features under scrutiny in Polestar vehicles are not shared with Volvo and instead have a closer link to other brands produced by Geely in China.

It’s not just relatively new brands that could be impacted by this regulation. Ford, GM, VW and Mercedes-Benz all source systems (or some system elements) from China. This could prompt these and other OEMs to plan sourcing from other regions to avoid any potential infringement of the new regulations.

Machine issues

The impact of the Connected Vehicle Rule will extend beyond passenger cars. It is expected that off-highway equipment which offers similar levels of connectivity could soon come under similar scrutiny.

Features which could fall foul of the regulations appear on many modern machines and include: GPS positioning, cellular/satellite communications, remote diagnostics/telematics systems, over-the-air software update systems, cameras/sensors, fleet management systems and also autonomous operation controls.

As such, this could have a far-reaching impact, affecting machines used in construction, agriculture, mining, port facilities and warehouses, to name just a few.

The issue isn’t simply interception of data or taking control of one or multiple machines. Instead, the concern appears to be that equipment in use at military or critical infrastructure projects could reveal what is taking place at those locations.

It’s unlikely that there would be a blanket ban on machines produced by a given OEM. Rather, machines deemed to have a level of vulnerability could face restrictions on sites where there is a national interest.

Such issues bring the otherwise secondary concern of cybersecurity front and center. In light of the Connected Vehicle Rule, machine OEMs could be obliged to take a closer look at not only where their onboard software/hardware systems are sourced, but also where and how the collected data is being stored and shared in preparation for possible reviews.

After all, an ounce of prevention is worth more than a pound of cure.