The Commerce Department drew its connected vehicle rule around a weight: 10,001 pounds. Vehicles below that line may not use connectivity or automated driving software designed or supplied by parties under Chinese or Russian control. Cross that threshold and the federal rulebook goes silent.
BIS acknowledges the gap in the final rule it published in January 2025. Commercial vehicles are out of scope, the agency wrote, and will be handled by a separate rule it intends to propose. That promised rule has yet to surface in the Federal Register.
The list left out today runs to transit and school buses, ambulances, shuttle vans, box trucks and one-ton work pickups. A city bus sits above 33,001 pounds, more than three times the rule’s ceiling. Fleet economics add to the stakes: these vehicles run 12 to 15 years and are bought with public money, and their telematics go deeper than a car’s because operators pay for remote diagnostics, charging schedules and driver monitoring.
Norway offered a preview of what that connectivity can do. Ruter, the Oslo-area transport authority, tested an electric Yutong bus from China against a Dutch VDL inside a mountain facility. The Yutong, built in China, accepted over-the-air updates while its manufacturer retained a direct digital line into battery and power-control systems through a Romanian SIM, giving it the theoretical ability to stop the vehicle. A flaw in the maker’s customer platform was later patched.
Norway operates under UN Regulations 155 and 156, the toughest vehicle cyber rules anywhere. The manufacturer still held that channel. In the US, the rule meant to close it starts above the vehicles that carry the most passengers.
