(a) Requirements—(1) VCS hardware: A VCS hardware importer must submit a Declaration of Conformity to BIS prior to importing VCS hardware, unless otherwise specified by this subpart. The Declaration of Conformity for VCS hardware shall include:

(i) The name and address of the VCS hardware importer, to include identifying information for an individual point of contact (including name, email address, and phone number);

(ii) If known, the FCC ID Number associated with the VCS hardware and, if applicable, of the subcomponents contained therein;

(iii) If known, the make and model of the connected vehicle(s) for which the VCS hardware is intended, or already integrated;

(iv) A certification that the VCS hardware described in the Declaration of Conformity was not designed, developed, manufactured, or supplied by persons owned by, controlled by, or subject to the jurisdiction or direction of the PRC or Russia;

(v) A certification that the declarant has conducted due diligence (with or without the use of third-party assessments) to inform the above certification, and the declarant or a delegated third party maintains documentation (either through an HBOM or otherwise) and third-party assessments (as applicable) in support of the above certification, which can be made available upon request by BIS;

(vi) Identification as to who maintains the documentation and third-party assessments (as applicable) as certified above;

(vii) A certification that the declarant has taken all possible measures, either contractually or otherwise, to ensure any necessary documentation and assessments from suppliers will be furnished to BIS upon request either by the declarant, or, in cases including confidential business information, directly by the supplier; and

(viii) If applicable, an indication as to whether the submission is an update to a prior Declaration of Conformity, and if so, the date of the last submission.

(2) Covered software: A connected vehicle manufacturer must submit a Declaration of Conformity to BIS prior to importing or selling in the United States completed connected vehicles that incorporate covered software, unless otherwise specified by this subpart. The Declaration of Conformity for covered software shall include:

(i) The name and address of the connected vehicle manufacturer, to include information identifying an individual point of contact (including name, email address, and phone number);

(ii) The make, model, trim, and Vehicle Identification Number (VIN) series applicable to the completed connected vehicles that incorporate the covered software;

(iii) A certification that the covered software described in the Declaration of Conformity was not designed, developed, manufactured, or supplied by persons owned by, controlled by, or subject to the jurisdiction or direction of the PRC or Russia;

(iv) A certification that the declarant has conducted due diligence (with or without the use of third-party assessments) to inform the above certification, and the declarant or a delegated third party maintains documentation (either through an SBOM or otherwise) and third-party assessments (as applicable) that are sufficient to identify, at minimum, the author name, timestamp, component name, and supplier name of all proprietary additions to the development of the covered software, which can be made available upon request by BIS;

(v) Identification as to who maintains the documentation and third-party assessments (as applicable) as certified above;

(vi) A certification that the declarant has taken all possible measures, either contractually or otherwise, to ensure any necessary documentation and assessments from suppliers will be furnished to BIS upon request either by the declarant, or, in cases including confidential business information, directly by the supplier; and

(vii) If applicable, an indication as to whether the submission is an update to a prior Declaration of Conformity and the date of the last submission.

(b) Certification. A certification is a written statement or attestation within a Declaration of Conformity in § 791.305(a) above to the U.S. Government, signed by a duly authorized designee, certifying under the penalties provided in 18 U.S.C. 1001,that.

(1) For purposes of this section, a duly authorized designee is:

(i) In the case of a partnership, any general partner thereof;

(ii) In the case of a corporation, the chief executive officer, or any officer with the authority to bind the corporation;

(iii) An employee with authority to make certifications on behalf of the company as designated by a person in (i) or (ii); and

(iv) In the case of an entity lacking partners and officers, any individual manager, or designated agent who has been explicitly authorized by the board of directors or equivalent to sign contracts and make legally binding agreements on behalf of the entity.

(c) Additional information. BIS may request additional information after receipt of a Declaration of Conformity.

(d) Reliance on third-party assessments. Declarants are permitted to utilize assessments produced by third parties to assist and prepare a Declaration of Conformity, in addition to ensuring ongoing compliance with this rule, as long as such entities conform to § 791.315 of this subpart.

(e) Material changes. The following events will require an update to a previously submitted Declaration of Conformity:

(1) The discovery, by the declarant, of an omission, inaccuracy, or error in the information provided to BIS in a prior Declaration of Conformity that could reasonably mislead as to the true source of VCS hardware or covered software in question.

(2) Covered software updates alone do not constitute a material change unless an additional condition above is true.

(f) Change in circumstance. If the connected vehicle manufacturer or VCS hardware importer determines that articles subject to a Declaration of Conformity are no longer eligible, it must, within 30 days, cease any prohibited conduct and submit a specific authorization application, pursuant to § 791.307(m).

(g) Deadline to submit Declarations of Conformity. Connected vehicle manufacturers and VCS hardware importers shall submit Declarations of Conformity prior to the first sale of the subject connected vehicle in the United States, prior to the import of VCS hardware as specified in this section, and following discovery of a material change that makes a prior Declaration of Conformity no longer accurate.

(1) Connected vehicle manufacturers shall submit a Declaration of Conformity at least 60 days prior to the first import or first sale of each model year of completed connected vehicle that incorporates covered software. Declarants may submit a single Declaration of Conformity for all connected vehicles that use the same covered software, grouped by make, model, and VIN series.

(2) VCS hardware importers shall submit a Declaration of Conformity at least 60 days prior to the first import of VCS hardware for each model year for units associated with a vehicle model year, or calendar year for units not associated with a vehicle model year. VCS hardware importers may submit a single Declaration of Conformity detailing all VCS hardware models that will be imported in the model year or calendar year.

(3) Connected vehicle manufacturers and VCS hardware importers must notify BIS of any material change to the information conveyed in a previously submitted Declaration of Conformity by submitting a revised Declaration of Conformity within 60 days following the discovery of such change. A declarant's obligation to inform BIS of material changes to the information ceases 10 years after submission of the original Declaration of Conformity for that model year or calendar year.

(h) Annual updates to Declarations of Conformity. If applicable, connected vehicle manufacturers and VCS hardware importers may, in lieu of submitting a new Declaration of Conformity, submit a confirmation that the prior Declaration of Conformity remains accurate and that associates the relevant new model year of vehicles (if known) in lieu of submitting a new Declaration of Conformity.

(1) Where there are no material changes to the covered software for a subsequent model year of completed connected vehicles, the connected vehicle manufacturer may submit a confirmation no later than one year after the previous submission, certifying that the prior information remains accurate, and that associates the new relevant model year of vehicles to an existing Declaration of Conformity.

(2) Where there are no material changes to the VCS hardware for a subsequent model year of completed connected vehicles (if known) or calendar year, the VCS hardware importer may submit a confirmation no later than one year after the previous submission, certifying that the prior information remains accurate, and that associates the new relevant model year of vehicles (if known) to an existing Declaration of Conformity.

(i) Submission instructions. The declarant shall follow the electronic filing instructions on BIS's website, https://www.bis.gov/OICTS.

(j) Verification. BIS, in its sole discretion, may choose to verify Declarations of Conformity that have been submitted by VCS hardware importers and connected vehicle manufacturers.

(k) Connected vehicle introduced by means of false information in the Declaration of Conformity. Any person who submits false information in a Declaration of Conformity, with knowledge that such information is false, and engages in one or more prohibited transactions, may incur penalties as defined in § 791.318.

(l) Exemptions. No Declaration of Conformity is required if the only foreign interest in a transaction arises from a foreign person's equity ownership of a U.S. person, whether through ownership of public shares or otherwise. This exemption has no effect on transactions where a foreign interest arises from a foreign entity's design, development, manufacture, or supply of VCS hardware or covered software for a U.S. person or where equity ownership allows a foreign person to exercise control over the U.S. person. Further, this exemption has no effect on the analysis of whether or not an entity is owned by, controlled by, or subject to the jurisdiction or direction of the PRC or Russia.