U.S. Crackdown On Foreign Vehicle Software Stops At 10,001 Lbs — Buses Are Exempt

The most consequential number in America’s effort to keep Chinese and Russian software out of vehicles is not a model year or a dollar figure. It is a curb weight: 10,001 pounds. Under the Commerce Department’s connected-vehicle rule, vehicles below that line are effectively excluded from certain foreign-made connectivity and automated-driving software restrictions — while many commercial vehicles that carry the public for a living sit well above it.

What Ruter Found Inside A Mountain

Ruter, the public transport authority for Oslo and Akershus, drove two electric buses into an isolated test facility carved into a mountain to examine remote access and update pathways. The two vehicles were a new Chinese-made Yutong and a three-year-old Dutch VDL.

The VDL showed no autonomous over-the-air (OTA) update channel and therefore no persistent remote path to exploit. The Yutong, however, did: Ruter found OTA update capability and reported that the manufacturer retained direct digital access to the bus’s battery and power-control systems via a Romanian SIM. In Ruter’s assessment, that access could, in theory, be used to stop the bus. Testers also discovered a vulnerability in the platform used by Yutong customers; it was later patched.

“This comprehensive and unique test enables us to implement the proper protection in the buses,” said Ruter CEO Bernt Reitan Jenssen.

What The U.S. Rule Actually Covers

The Bureau of Industry and Security (BIS) published its final connected-vehicle rule on January 16, 2025; it took effect on March 17, 2025. The rule bars the import or sale of connected vehicles containing connectivity or automated-driving software designed, developed, or supplied by entities under the jurisdiction of China or Russia. The bans apply to covered software beginning with model year 2027 and to covered hardware beginning with model year 2030.

Crucially, BIS’s compliance guide defines a “connected vehicle” as “a vehicle that is below 10,001 pounds and is driven or drawn by mechanical power and manufactured primarily for use on public streets, roads, and highways.” That weight-based definition excludes most commercial and heavy-duty vehicles — including city buses, many delivery trucks, ambulances and motorhomes — from the current rule.

Why The Weight Cutoff Matters

This cutoff is not a minor technicality. Many of the vehicles exempted by weight are:

• Public-facing and high-capacity (transit and school buses),
• Kept in service for a decade or more, and
• Equipped with extensive telematics because fleets explicitly buy remote diagnostics, charge scheduling, driver monitoring and similar services.

Put another way: the vehicles most likely to carry many people and to run long careers on the road are often the ones the rule leaves untouched.

European Standards And The “Front Door” Problem

Norway is subject to the EU type-approval system and to UN Regulation 155 (R155) and Regulation 156 (R156), which became mandatory for new types in July 2022 and for all new vehicles in July 2024. R155 requires manufacturers to run a cybersecurity management system that monitors and responds to threats throughout a vehicle’s life; R156 governs software update processes. Together, they assume a persistent manufacturer-fleet link and oblige manufacturers to manage that link responsibly.

Ruter’s test did not reveal a hidden backdoor so much as a deliberately provisioned front door — a manufacturer update and telemetry channel that regulation presumes will exist and be managed. That raises the practical question Washington has paid too little attention to: who sits on the other side of that channel, and which courts can compel them to explain or remediate a failure?

Real-World Failures And The Jurisdiction Problem

Remote control features are not unique to foreign makers. U.S. automakers advertise similar capabilities: General Motors’ OnStar includes Remote Ignition Block and Stolen Vehicle Slowdown, for example. The difference is not capability but jurisdiction, auditability and who can be held accountable in court.

Remote commands have already caused large-scale harm in the U.S. for non-espionage reasons: in August 2023 the Consumer Financial Protection Bureau sued auto-loan servicer USASF Servicing, alleging it improperly disabled borrowers’ vehicles thousands of times because of billing or servicing errors. That episode shows how remote shutdowns can be abused or misapplied even where the controlling company is subject to U.S. law.

Practical Fixes Are Available Today

Ruter’s response is instructive: rather than relying solely on import bans, they plan to tighten procurement clauses, build a firewall around local vehicle controls, and introduce staged updates and signal delays so incoming changes can be inspected before they reach critical systems. Those are contract and operational measures any fleet buyer can require today — they do not depend on new federal legislation.

Policy Choice: Weight Or Connectivity?

Sorting vehicles by curb weight instead of by their connectivity or control architecture gets the policy backward. A remote shutdown command does not check a vehicle’s weight — only the rule does. If the goal is to reduce national-security and public-safety exposure from remote access, regulators should consider defining coverage by connectivity, remote-control capability and legal reach rather than by an arbitrary curb-weight threshold.

Bottom line: The technology that can stop a bus exists and is widely sold as a feature. The governing question for policymakers is whether rules will target the vehicles that actually carry people and rely on persistent remote links — and whether owners and operators will accept the scrutiny needed to secure those links.