Skip to main content
USTelecom — The Broadband Association
Sample profile — content is illustrative. Verify every name, date, and status against official sources before use.
Back to Agency Atlas
BIS / OICTSHigh activityReview recommended · 2026-07-10

Department of Commerce — BIS / OICTS

Runs the ICTS regime under EO 13873: class-wide prohibitions on foreign-adversary technology transactions, currently covering connected vehicles, with drones (UAS) and cloud/data-center services in the pipeline. Also administers the Entity List and export controls through the Office of Information and Communications Technology and Services (OICTS).

One-minute briefing

Agency snapshot

BIS runs the ICTS regime under EO 13873. The connected-vehicle final rule became effective March 17, 2025: covered-software prohibitions bite at Model Year 2027, VCS hardware import prohibitions at Model Year 2030 (January 1, 2029 for non-model-year components), and the legacy-software carve-out expired March 17, 2026 — so PRC/Russia-linked software supplied or adversary-maintained after that date is now squarely covered. A UAS/drone ICTS rule (ANPRM January 3, 2025, comments closed March 4, 2025) is still pending as of July 2026, and BIS has signaled a cloud/data-center ICTS rule with no NPRM yet. A separate drone export-streamlining IFR took effect January 20, 2026. Re-confirm against bis.gov.

5
Active initiatives
2
Upcoming deadlines
4
Priority topics
Most important thing right now

Treat the connected-vehicle ICTS rule as the template for what is coming for UAS and cloud/data centers: build ICTS due-diligence and Declaration-of-Conformity processes now, and note the legacy-software carve-out expired March 17, 2026.

Mandate & jurisdiction

What this agency does

BIS controls which components and vendors are lawfully available to members, how far Entity List screening extends down the ownership chain, and — through ICTS — which classes of connected technology can be transacted at all.

ICTS class prohibitions

Issues class-wide prohibitions on foreign-adversary ICTS transactions under EO 13873 (connected vehicles now; UAS and cloud/data centers next).

Export controls

Administers the EAR governing export/re-export of controlled technology and components.

Entity List

Designates parties subject to license requirements; drives vendor and component screening.

Affiliates (50%) Rule

Extends restrictions to entities 50%+ owned by listed parties, broadening screening obligations.

Jurisdiction

  • ICTS supply-chain transaction prohibitions (EO 13873 / IEEPA)
  • Export Administration Regulations (EAR)
  • Entity List and the Affiliates (50%) Rule
  • Connected vehicles, UAS, and cloud/data-center ICTS rulemakings
Who should care

Procurement, trade compliance, and supply-chain risk teams.

Operational

Component availability, ICTS due diligence, and qualification of alternative suppliers.

Compliance

Entity List / 50%-rule screening; ICTS transaction diligence and Declarations of Conformity.

Procurement

Vendor eligibility and re-sourcing where suppliers are captured by ICTS or the Entity List.

Initiatives & deadlines

What they are working on now

UpcomingEffectiveConnected vehicles 2025-03-17

Connected Vehicles ICTS final rule

Effective March 17, 2025. Covered-software prohibitions bite at Model Year 2027; VCS (Vehicle Connectivity System) hardware import prohibitions at Model Year 2030 (January 1, 2029 for non-model-year components). The legacy-software carve-out expired March 17, 2026: software designed or supplied by PRC/Russia-linked entities after that date is now squarely covered, and pre-existing code loses the exemption if adversary-maintained after that date. Declarations of Conformity and supply-chain due-diligence obligations are now operative.

MonitorMonitoringConnected vehicles

Commercial vehicles ICTS rulemaking (planned)

Vehicles over 10,000 lbs were excluded from the connected-vehicle final rule; BIS has said it plans a separate rulemaking for the commercial-vehicle sector. Track for an NPRM.

UpcomingPendingUAS / drones 2025-01-03

UAS / drones ICTS rule

ANPRM issued January 3, 2025 (comments closed March 4, 2025); a proposed rule is still pending as of July 2026. It is expected to mirror the connected-vehicle structure and to cover ground stations, communications links, and associated components — not just airframes.

MonitorMonitoringICTS supply chain

Cloud and data-center ICTS rule (signaled)

BIS has signaled an ICTS rule focused on cloud-computing and data-center products and services. No NPRM has issued yet. Given member exposure, this is tracked as its own watch item.

ImmediateEffectiveExport controls and tariffs 2026-08-24

Entity List Affiliates (50%) Rule

BIS issued a rule (September 2025) extending Entity List / restricted-party controls to entities 50% or more owned, individually or in aggregate, by listed parties, significantly broadening screening obligations. Reimposition of the Affiliates Rule is scheduled for November 10, 2026 and is now tied to the September 24 Xi state visit as the decision point; no extension notice has issued and November 10 stands. Latest BIS actions: an August 24, 2026 administrative enforcement settlement with Container Manufacturing Ltd. (replacing the August 14 Plexon settlement as the most recent action) and an August 24 Federal Register rule removing two addresses associated with Arrow Electronics (Hong Kong) from the Entity List effective August 21, 2026, following the November 2025 removal of Arrow China Electronics Trading.

Upcoming dates

  • 2027-01-01Connected-vehicle covered-software prohibitions bite (Model Year 2027)
  • 2029-01-01VCS hardware prohibitions for non-model-year components
Key decision-makers

Leadership to know

We focus on the roles whose decisions reach members, and why each one matters — not biographical trivia. Names are intentionally withheld until verified against an official source.

Howard Lutnick
Secretary of Commerce

Why it mattersSets department trade and technology-security priorities.

Review recommended
Jeffrey Kessler
Under Secretary of Commerce for Industry and Security

Why it mattersDirects export controls, the Entity List, and ICTS actions; confirmed March 2025.

Review recommended
Working Group analysis

What we are watching

Confidence: DevelopingActive situation; details are still shifting.

What changed

  • Connected-vehicle legacy-software carve-out expired March 17, 2026; adversary-supplied/maintained software now squarely covered.
  • Drone export-streamlining IFR took effect January 20, 2026 under EO 14307 (context, not a substitute for the UAS ICTS rule).
  • Affiliates (50%) Rule (Sept 2025) broadened Entity List reach to majority-owned subsidiaries.

What we are watching

  • The pending UAS/drone ICTS proposed rule.
  • The signaled cloud/data-center ICTS rule.
  • A separate commercial-vehicle (>10,000 lbs) rulemaking.

Member exposure

  • ICTS due diligence and Declarations of Conformity for connected systems.
  • Deeper ownership diligence for all restricted-party screening.
  • Potential future capture of drones, ground stations, and cloud/data-center services.

Recommended preparation

  • Build ICTS due-diligence processes modeled on the connected-vehicle rule.
  • Upgrade screening to trace ownership chains under the 50% rule.
  • Inventory drone and cloud/data-center dependencies ahead of future ICTS rules.

Open questions

  • Will the UAS and cloud ICTS rules mirror the connected-vehicle phase-in structure?
Primary references

Sources & verification

Agency-level sources

This profile is a sample interface. Leadership names, dates, regulatory status, and figures must be confirmed against current official sources before any member distribution.