The Road to Compliance: First Steps OEMs and Suppliers Should Take Today

The Connected Vehicle Rule (CVR) has set the automotive and IoT supply chain on notice. Products containing software or hardware tied to foreign adversaries must be identified, evaluated, and addressed or removed from the U.S. market.

As we’ve explored in the previous blogs, this isn’t a theoretical policy. The CVR introduces a real and urgent operational requirement for every OEM, supplier, and technology provider working on connected vehicle systems.

So the question now becomes: What should your organization actually do next?

In this final post in our series, we shift from analysis to action, highlighting the concrete, achievable steps companies should begin taking now to prepare for CVR compliance before enforcement begins.

Step 1: Identify Which Products Are In Scope

Start by taking stock of your connected vehicle platforms, both current and planned. Focus on systems that include:

• Telematics units
• Over-the-air (OTA) update frameworks
• Autonomous driving capabilities
• Vehicle-to-everything (V2X) communications
• Embedded communications modules, ECUs, and control units

If the system communicates outside the vehicle or receives updates remotely, it may fall under CVR scrutiny.

Map your product lines and determine where these technologies are used and, critically, where they’re sourced, developed, and maintained.

This step is foundational. Without visibility into what’s in scope, every other compliance effort will be blind.

Step 2: Start Generating SBOMs and HBOMs … Now

Once your platforms are mapped, shift your focus to the components inside them. The most efficient way to evaluate risk is through a software bill of materials (SBOM) and a hardware bill of materials (HBOM).

But this can’t be a one-time, manual exercise. You’ll need:

• SBOMs that include transitive dependencies, binary packages, and open-source components, not just top-level code.
• HBOMs that trace critical hardware parts back to their country of origin and supplier ownership structure.
• The ability to correlate BOM data across products, suppliers, and teams, especially if your components are reused or white-labeled.

If you’re relying solely on supplier-provided SBOMs, you’ll also need to verify that those documents are accurate and complete. In our experience, too many SBOMs omit critical firmware or embedded third-party packages, leaving hidden exposure.

Automated tooling, especially those that can analyze firmware binaries, can accelerate this step dramatically.

Step 3: Evaluate Exposure Based on Ownership and Control

Once BOMs are in hand, begin the deeper work of evaluating risk based on control and influence.

This is where CVR compliance gets tricky. It’s not just about where code was written or who manufactured the hardware. It’s about who owns, controls, or can influence those vendors and whether they are linked, directly or indirectly, to foreign adversaries like China or Russia.

Ask questions like:

• Who owns the supplier behind this driver, SDK, or chipset?
• Where is the code developed, and under which jurisdiction?
• Is this company subject to foreign government oversight or cybersecurity laws?
• Are there licensing or support agreements with PRC or Russian entities?

This kind of analysis can’t be fully automated. It often requires procurement, legal, security, and product teams to collaborate on supplier research and decision-making. But it’s central to making defensible compliance calls under the CVR.

Step 4: Engage Suppliers And Document Everything

If you uncover gaps in your visibility, such as incomplete SBOMs or unclear supplier lineage, begin outreach now. Supplier transparency can take time, especially when legal departments or overseas offices are involved.

Send formal requests for:

• SBOMs and HBOMs
• Documentation of code provenance and ownership
• Disclosures of licensing agreements, development locations, or subcontracting arrangements

And as you conduct this work, track and document every step. Create a compliance log that captures:

• What you asked for
• Who you asked
• What they returned
• How you assessed the information
• What actions you took in response

This documentation will be the first line of defense if the Department of Commerce or a customer ever questions your due diligence.

Step 5: Prepare Declarations of Conformity for Compliant Components

Not every component will fall under CVR restrictions. For those that don’t, begin preparing your Declarations of Conformity (DoCs) now. Each year, manufacturers and importers must certify that they’ve performed due diligence to confirm that covered hardware and software are free from ownership, control, or influence by foreign adversaries.

Your DoCs should be backed by evidence — SBOMs, HBOMs, supplier attestations, and ownership analyses — and retained for ten years.

This step isn’t just a formality. It’s how you prove that your diligence and documentation meet the Rule’s expectations, even for components that comply. Preparing DoCs early will also streamline future filings and help you establish a repeatable, defensible compliance process.

Step 6: Build a Transition Plan for Non-Compliant Components

If you identify technologies that fall under CVR restrictions, either due to foreign ownership, origin, or functionality, you’ll need to develop a mitigation plan.

Options may include:

• Replacing components with verified alternatives
• Isolating or sandboxing risky modules to limit functionality
• Seeking a legacy carveout (if possible)
• Submitting a request for a Specific Authorization request

Whatever the path, don’t delay in implementation. Lead times for validated suppliers, regulatory review, and engineering changes can extend well into 2026. Delaying now could mean missing compliance windows later.

Step 6: Operationalize Compliance as a Program

Compliance with the CVR isn’t a one-time project. It’s an ongoing program that must be repeatable, auditable, and scalable across your portfolio. To make that happen:

• Establish a central compliance owner or team
• Create internal policies and workflows for evaluating new components
• Integrate SBOM/HBOM analysis into procurement and build pipelines
• Train stakeholders, from engineering to legal, on CVR exposure and documentation standards

Companies that treat CVR as a governance challenge, not just a technical one, will be best positioned to scale their response and demonstrate maturity to regulators.

How Finite State Helps You Get Started Today

Finite State partners with OEMs and suppliers to accelerate CVR readiness through:

• Automated SBOM and HBOM generation from source code, binaries, and firmware
• Supply chain risk analysis, including component provenance and ownership mapping
• Vulnerability correlation and prioritization, even in legacy or black-box systems
• Compliance documentation tools to track assessments, decisions, and supplier interactions

Whether you’re starting your first BOM inventory or already working on mitigation strategies, our platform and advisory services help you reduce manual lift, uncover hidden exposure, and build a compliance program that scales.

The Road Is Clear. The Time Is Now.

The CVR sets a clear expectation: know what’s in your connected products, and prove that those components don’t introduce adversarial risk. For most organizations, the work to meet that bar is already underway or should be. Deadlines are fast approaching; what matters now is moving forward - quickly and decisively.

The companies that begin building transparency, process, and documentation today will be the ones that cross the compliance finish line with confidence and turn CVR readiness into a long-term advantage.

Start that journey now: talk to our experts or book a demo to see how Finite State can accelerate your path to compliance.