The article argues that the Polestar/Volvo split — same parent, same city, same engineers, but different connectivity software origins — proves the rule is not about ownership, tariffs, or country of assembly, but about where the bits that talk to the internet are authored. This makes it a template for future software supply-chain enforcement that any company shipping connected hardware or telemetry into the US must reckon with.
By submitting this story to Hacker News and surfacing it to a technical audience, mraniki amplifies the framing that the rule's enforcement mechanism — drawing lines through a bill of materials rather than corporate ownership — is the salient and alarming detail for developers and engineers.
The piece highlights the absurdity that Polestar and Volvo share a Gothenburg headquarters, a majority owner in Geely, and overlapping engineering staff, yet one is blocked from the US market while the other is not. The author frames this as evidence that the regulation's line-drawing — based on where VCS/ADS software is authored — yields outcomes that look arbitrary from the outside even if internally consistent.
The Commerce Department's Bureau of Industry and Security finalized the Connected Vehicle Rule in January 2025, and the first concrete casualty is now visible: Polestar, headquartered in Gothenburg, Sweden, has effectively been blocked from selling its 2026 model year vehicles in the United States, while Volvo — also headquartered in Gothenburg, also majority-owned by Geely — continues unimpeded.
The rule prohibits the import or sale of connected vehicles containing 'Vehicle Connectivity System' (VCS) or 'Automated Driving System' (ADS) hardware or software with a 'sufficient nexus' to the People's Republic of China or Russia. 'Sufficient nexus' is the operative phrase, and it is doing an enormous amount of work. It captures not only Chinese-domiciled companies but any company 'owned by, controlled by, or subject to the jurisdiction or direction of' a covered country. Polestar's majority shareholder is Geely Holding, a Chinese conglomerate. So is Volvo Cars' (Geely owns ~78%). The difference, per The Drive's reporting, comes down to where each company's VCS components are designed and where the software that touches the modem, telematics control unit, and OTA pipeline is authored.
Polestar's Polestar 3 and Polestar 4 share platforms — and, critically, software stacks — with SEA (Sustainable Experience Architecture) vehicles built in China. Volvo's EX90 and ES90 are built on SPA2, an architecture whose connectivity stack is authored in Sweden. Same parent company, same city, same engineers in many cases — but a different bill of materials for the bits that talk to the internet, and one company gets to sell cars while the other does not.
If you've been building anything that ships firmware or telemetry into the US, this rule is the template for what's coming. The Commerce Department did not write a tariff. It did not write an import ban tied to country of assembly. It wrote a software supply-chain rule, and the enforcement mechanism is a self-certification regime where the OEM has to attest, under penalty of perjury, that no covered software or VCS hardware is present in the vehicle.
For a senior engineer, the interesting part is the granularity. The rule defines covered software as anything 'executed by the VCS hardware' — which in a modern car means the cellular modem firmware, the Bluetooth/Wi-Fi stack, the telematics control unit's RTOS, the over-the-air update agent, and increasingly the infotainment OS to the extent it touches connectivity. This is the first major US regulation that treats a software bill of materials as the legally binding unit of analysis, not the country of incorporation or final assembly.
Compare the two stacks publicly. Volvo's connectivity platform is built around Ericsson-supplied modems, an in-house TCU stack authored in Sweden and Poland, and Google Automotive Services on Android Automotive (which Polestar also uses for infotainment — but infotainment isn't VCS under the rule, a distinction worth memorizing). Polestar 4's TCU and ADAS stack were co-developed with Geely's central R&D in Ningbo. Same Android Automotive on top. Completely different fates.
The industry reaction has been muted in public and frantic in private. Polestar's US dealer network — 27 'Polestar Spaces' built out over four years — is now sitting on inventory it cannot replenish, and the company has gone silent on its 2026 US strategy beyond a vague 'evaluating options' statement. Ford, GM, and Rivian have all confirmed they are auditing their TCU suppliers; at least two Tier 1 suppliers (which the reporting does not name) have started moving connectivity engineering teams out of China-affiliated entities, even when the engineers themselves stay put. The 'sufficient nexus' language is broad enough that org-chart restructuring may not be enough.
If you ship code that runs on hardware that crosses a US border and talks to a network — and that is an increasingly long list, from EVs to industrial sensors to medical devices to consumer drones — the practical implications are concrete.
First, know your transitive supply chain at the binary level. The rule's self-certification regime puts the burden on the OEM, but the OEM will push it down to every supplier. If you maintain a board-support package, a modem driver, or an OTA agent, expect a questionnaire about (a) where the code was authored, (b) where it was compiled, (c) whether any of its dependencies trace to a covered jurisdiction, and (d) who has commit access. SBOM tooling — CycloneDX, SPDX, in-toto attestations — stops being a compliance nice-to-have and becomes the audit artifact.
Second, infotainment ≠ VCS, and that line will be litigated. The rule explicitly excludes the head unit and entertainment functions from VCS coverage, which is why Android Automotive (Polestar and Volvo both ship it) isn't the problem. The problem is the TCU. But the rule's definition of VCS includes 'any system that enables the transmission of data to or from the vehicle,' and modern infotainment increasingly does exactly that for things like streaming, voice assistants, and app stores. Expect Commerce guidance over the next 12 months to either tighten or relax this boundary, and plan for both.
Third, the precedent applies far beyond cars. BIS has been clear that the Connected Vehicle Rule is a 'pilot' for a broader Information and Communications Technology and Services (ICTS) regulatory regime that will eventually cover drones, industrial control systems, smart-grid equipment, and IoT. If you ship a connected widget, the Polestar case is your roadmap for how this will look in your sector.
The uncomfortable truth this story exposes is that 'where is your code from' is now a regulated question, and the answer determines market access. Polestar didn't get killed by a tariff or a tech ban or a culture-war headline; it got killed by a software bill of materials that traced back to the wrong git remote. The defensive move for anyone shipping connected hardware into the US is not to argue with the rule but to instrument your supply chain — author location, build provenance, dependency origin — at the same fidelity you instrument your production systems. Geely will eventually rewire Polestar's TCU stack to be Sweden-authored end-to-end, and the cars will return. The companies that don't have a sibling brand to hide behind will need to do that rewiring before the first enforcement letter arrives, not after.
Top 10 dev stories every morning at 8am UTC. AI-curated. Retro terminal HTML email.