Official Volvo production image showing an electric SUV inside a manufacturing plant

Connected-Car Rules Explained: Why EV Buyers Need to Care About Software Origin

Volvo's U.S. authorization under connected-vehicle rules shows why EV buyers should start thinking about software origin, data governance, and long-term support alongside range and charging.

By Marcus Holloway

Range, charging speed, incentives, and price still decide most EV purchases. But Volvo’s latest U.S. regulatory win points to another question that is going to matter more over the next few years: who controls the software inside the car?

Volvo said May 26 that Volvo Car USA received a specific authorization under the U.S. Commerce Department’s ICTS Connected Vehicles Rule. That authorization allows Volvo to keep importing and selling connected cars in the United States after a case-by-case review of governance, technology, and data security.

The news is important because Volvo is a Swedish brand with deep U.S. roots, but it is majority owned by China’s Geely Holding. That puts the company directly in the policy zone Washington is now watching: connected vehicles with software, hardware, data systems, or ownership links that touch China or Russia.

For buyers, this does not mean every connected EV is suddenly risky. It does mean the modern car is no longer just a product with wheels, motors, batteries, and airbags. It is a rolling software platform with location data, cellular connectivity, over-the-air updates, driver-assistance sensors, phone integration, charging accounts, cloud services, and app controls.

That makes software origin a real ownership question, not just a government procurement issue.

Quick Verdict

EV buyers do not need to turn connected-car rules into a showroom panic. Most shoppers should still focus first on price, range, charging access, warranty coverage, service support, and whether the vehicle fits their life.

But software governance now belongs on the checklist. If a vehicle depends heavily on cloud features, app access, over-the-air updates, driver-assistance software, battery preconditioning, route planning, or plug-and-charge services, the company behind that software matters.

The practical buyer question is not “Is this car connected?” Almost every modern EV is. The better question is: will this automaker be allowed, able, and motivated to support the car’s connected features for the full ownership period?

What the Rule Actually Targets

The Bureau of Industry and Security says the connected-vehicles rule restricts the import or sale of certain connected vehicles and connected-vehicle technologies in the U.S. when they have enough nexus to China or Russia. BIS says the rule applies to vehicles under 10,001 pounds and was created around national-security concerns that companies tied to those countries could be compelled to share data or enable remote access.

The rule took effect March 17, 2025, but its major vehicle restrictions are phased in by model year.

How the U.S. connected-vehicles rule phases in restrictions relevant to EV buyers and automakers.
How the U.S. connected-vehicles rule phases in restrictions relevant to EV buyers and automakers.
TimingWhat changesWhy buyers should care
Model year 2027 Sales restrictions begin for connected vehicles from manufacturers owned by, controlled by, or subject to the jurisdiction or direction of China or Russia, and for vehicles using covered software Automakers with exposed software or ownership structures need a compliance path before affected models reach buyers
Model year 2030 Restrictions expand to imports of vehicle connectivity system hardware from covered companies, or January 1, 2029 for non-model-year components Hardware sourcing, suppliers, telematics modules, and connectivity systems become part of long-term product planning
Compliance path BIS allows declarations of conformity, general authorizations, specific authorizations, and advisory opinions A vehicle or brand may still be saleable if the company can prove acceptable governance, software control, and data-security handling

That last line is the piece Volvo just made visible. The rule is not simply a giant red stamp that says yes or no. It includes a process. Volvo says it went through that process with the Commerce Department and other U.S. officials, and received a specific authorization.

That matters for other automakers because the global auto industry is messy. Brands use cross-border suppliers, joint ventures, regional software teams, shared platforms, cloud providers, telematics vendors, battery-management systems, and driver-assistance stacks that may not line up neatly with the badge on the hood.

Why EVs Are Especially Exposed

Gas vehicles are connected too, but EVs lean harder on software.

Battery thermal management, charging-route planning, state-of-charge estimation, preconditioning, charging authentication, plug-and-charge handshakes, driver-assistance systems, app-based climate controls, remote diagnostics, subscription features, and over-the-air updates are all part of the EV ownership experience now. Some of that software is convenience. Some of it affects how well the car works.

If your EV has to precondition its battery before a fast-charge stop, route you around a broken charger, authorize payment at a charging station, receive a recall fix over the air, or manage driver-assistance sensors, the software stack is not decoration. It is part of the powertrain ecosystem.

That is why connected-vehicle policy lands right on top of the EV transition. The most competitive EVs are often the most software-defined. The more the vehicle depends on code, data, and cloud services, the more regulators care about who writes the code, who can update it, where the data goes, and who can influence the company behind it.

What Buyers Should Ask

This is not about turning a test drive into a cybersecurity audit. It is about adding a few practical questions to the same buyer logic you already use for range, charging, warranty, and service.

Ask how long the automaker supports software updates. Ask whether key features require a subscription. Ask whether app-based features still work if connectivity changes. Ask whether navigation, charging preconditioning, and route planning are built into the car or depend heavily on a phone app. Ask whether the brand has an established U.S. or Canadian service network if a software or telematics issue sidelines the vehicle.

For newer brands, ownership structure matters too. A company can have a great product and still face policy friction if its software, hardware, corporate control, or data systems trigger regulatory concern. That does not automatically make the car bad. It does mean resale value, feature continuity, parts support, and future eligibility could be less predictable.

For established brands, the question is more subtle. Volvo’s authorization shows that a complicated ownership structure does not necessarily block U.S. sales. It also shows that established automakers may need to prove more than manufacturing quality. They may need to prove governance and data separation.

Why This Is Not Just a U.S. Problem

The U.S. rule is the headline right now, but the underlying issue is global.

Canada, Europe, and other markets are all trying to balance EV affordability, domestic industrial strategy, data security, supply-chain resilience, and trade exposure. Chinese automakers have become extremely strong in batteries, EV platforms, connected software, driver-assistance features, and low-cost manufacturing. That makes their products hard to ignore and politically hard to absorb.

For Canada-first shoppers, the most immediate impact may be indirect. A model blocked or delayed in the U.S. can affect North American launch timing, parts supply, software support, dealer planning, and pricing. Automakers do not always build one clean product plan for Canada and a totally separate one for the U.S., especially when the same plants, suppliers, and software platforms serve both markets.

That is why buyers should watch connected-car rules even if they are not shopping in the U.S. North American EV availability is shaped by U.S. regulation whether Canadian shoppers like it or not.

Volvo’s authorization is useful because it makes a vague future problem feel real without turning it into hysteria.

The takeaway is not that Volvo buyers should worry. If anything, Volvo clearing the process is a stabilizing signal for its U.S. business. The bigger lesson is that software origin has joined battery chemistry, charging access, and incentive eligibility as part of the EV market’s hidden plumbing.

For buyers, the best move is simple: treat connected features as part of the vehicle’s durability story. A great EV is not just the one with the best range number on delivery day. It is the one whose software, charging tools, app access, service network, and regulatory footing still make sense five or eight years later.

That may sound less exciting than 800-volt charging or a big horsepower number. But as cars become more connected, the boring software questions will decide more of the ownership experience.

FAQ

What is the connected-vehicles rule?

It is a U.S. Commerce Department rule aimed at connected vehicles and related hardware or software with enough connection to China or Russia. It focuses on vehicle connectivity systems, covered software, ownership or control, and national-security risk.

Does this mean Chinese-built or Chinese-owned EVs are banned?

Not automatically. The rule is targeted at specific connected-vehicle transactions and includes compliance paths such as declarations, general authorizations, advisory opinions, and specific authorizations. Volvo’s U.S. authorization is one example of that process in action.

Why should ordinary EV buyers care?

Because EV ownership increasingly depends on software. Charging route planning, battery preconditioning, app controls, over-the-air updates, driver-assistance systems, and remote diagnostics can all affect the ownership experience after the sale.

Should this change what I buy?

It should not override the basics, but it should sharpen the questions. Before buying, consider the automaker’s software-update record, service network, connected-feature dependency, subscription model, data practices, and regulatory exposure.