U.S. automakers are racing to strip Chinese-written code from internet-connected vehicles as sweeping national-security regulations take effect. Beginning March 17, carmakers must certify that core connected systems do not contain software developed in China or by Chinese companies. The rule targets cloud-connected features, including telematics, cameras, microphones, GPS systems, and advanced driver-assistance software.

Industry leaders describe the regulation as one of the most complex compliance challenges in decades. Carmakers must audit deeply layered supply chains where software often originates from subcontractors or joint ventures. While critical semiconductor sourcing can be traced, embedded code is more opaque. Some exemptions may be granted, and Chinese code transferred to non-Chinese ownership before the deadline remains permissible, triggering restructuring across the supplier base.

The implications for U.S.-based manufacturers are significant. Many vehicles rely on Chinese-developed middleware, connectivity modules, and cloud integration layers. Hardware substitution is difficult but manageable; software replacement is far more complex. Automotive code is typically bespoke, tightly integrated into vehicle architectures, and costly to rewrite or validate. Compliance timelines leave little margin for error, forcing companies to scramble for solutions before the March deadline.