House Bill Would Require Audits of Chinese-Linked Technology Deep in U.S. Auto Supply Chains

A bill introduced in the 119th Congress would require automakers and their suppliers to audit their supply chains for technology linked to Chinese or Russian entities, extending federal scrutiny well beyond the direct import bans already in place and into the layered network of software, chips, and sensors that underpin modern vehicles. The legislation, House Bill 10158, has not been approved and its prospects remain unclear, but industry sources suggest it is drawing serious attention from compliance and procurement teams across the sector.

The bill’s premise reflects a concern that has grown among U.S. regulators and security researchers: corporate ties to foreign adversaries in the automotive industry rarely materialize through a straightforward purchase of a Chinese-branded vehicle. Instead, according to sources familiar with the matter and publicly available regulatory filings, the exposure is typically buried several layers deep — in code written by subcontractors, in cellular modules sourced from Chinese vendors by Western Tier-1 suppliers, or in sensors manufactured at scale by Chinese firms that have come to dominate certain hardware categories.

The connectivity module question is perhaps the most immediate. Cellular IoT modules — the components that enable features such as over-the-air software updates, Wi-Fi hotspots, and remote start applications — are frequently sourced by large Western suppliers from Chinese manufacturers, including Quectel and Fibocom, which together are estimated to hold a substantial share of the global market. Because these modules manage the interface between a vehicle and cloud infrastructure, U.S. officials have raised concerns that firmware vulnerabilities could expose GPS data, cabin audio, or vehicle control systems to remote exploitation.

Software presents an equally difficult audit challenge. Automakers typically purchase integrated software stacks from third-party vendors rather than developing all code internally. Industry conversations suggest that deep within those stacks — in operating libraries or middleware — there may be code written by subcontractors based in China. Suppliers often decline to share raw source code on intellectual property grounds, making independent verification of that code’s provenance difficult for either automakers or regulators.

On the hardware side, the LiDAR sensor market — critical to autonomous driving features including lane-keeping and adaptive cruise control — is heavily concentrated among Chinese manufacturers. Hesai Technology, in particular, has been cited in industry and regulatory discussions as commanding the large majority of global automotive LiDAR supply, a position achieved in part through pricing that Western competitors have struggled to match. Security researchers have noted theoretical vulnerabilities in sensor systems that could affect obstacle detection, and regulators have separately flagged concerns about high-resolution mapping data generated by these sensors.

Existing federal rules enforced by the Bureau of Industry and Security already require automakers to declare the origin of automated driving and connectivity software, with a compliance milestone for Model Year 2027 vehicles tied to a March 2026 declaration deadline. Hardware restrictions are scheduled to extend further by 2030. The House bill under discussion would appear to build on that framework by formalizing supply chain audit requirements across multiple tiers of the vendor network, though the specific mechanisms have not been confirmed in detail.

The regulatory pressure has already prompted operational changes. Global suppliers are reported to be relocating software development operations out of China, and automakers are accelerating the qualification of non-Chinese cellular module suppliers as they work to satisfy both existing BIS rules and potential new requirements. For lenders and investors, the restructuring represents a material cost variable in vehicle manufacturing that has not yet been fully priced into the industry’s medium-term outlook.

The bill has not advanced out of the House, and its final form — including any specific audit standards, enforcement mechanisms, or timelines — has not been confirmed.