Stephen Wilmot reports on a current challenge for American carmakers.
How Chinese is your car? Automakers are racing to work it out.
Modern cars are packed with internet-connected widgets, many of them containing Chinese technology. Now, the car industry is scrambling to root out that tech ahead of a looming deadline, a test case for America’s ability to decouple from Chinese supply chains.
New U.S. rules will soon ban Chinese software in vehicle systems that connect to the cloud, part of an effort to prevent cameras, microphones and GPS tracking in cars from being exploited by foreign adversaries.
The move is “one of the most consequential and complex auto regulations in decades,” according to Hilary Cain, head of policy at trade group the Alliance for Automotive Innovation. “It requires a deep examination of supply chains and aggressive compliance timelines.”
Carmakers will need to attest to the U.S. government that, as of March 17, core elements of their products don’t contain code that was written in China or by a Chinese company. The rule also covers software for advanced autonomous driving and will be extended to connectivity hardware starting in 2029. Connected cars made by Chinese or China-controlled companies are also banned, wherever their software comes from.
The deadline is bringing fresh urgency to an industrywide effort to rely less on Chinese components. The shift was sparked by pandemic-era supply-chain disruptions and has stepped up amid rising geopolitical tensions. Tesla last year decided to stop using China-based suppliers for cars it makes in the U.S.
“There should be no critical semiconductor components coming from China—that’s easy to check,” said Håkan Samuelsson, chief executive officer of Volvo Cars. “More challenging is to be sure that no data that the car collects can ever be transmitted to China.”
Carmakers typically buy electronics from big suppliers, which sometimes source software from smaller suppliers or joint ventures in China. The supply chain isn’t motivated to give automakers the information they suddenly need.
“The suppliers don’t want to share source code,” said Brandon Barry, founder of Detroit-based Block Harbor Cybersecurity. “That’s their IP.”
