Governance, Risk and Compliance

supply chain · trade · safety · cyber

The rules that carry the most money in electrification are about where parts come from. Compliance is now a supply-chain job.

Governance sets the rules (board, policy, sourcing), risk management finds exposures (supply, cyber, policy), compliance proves it (audits, certification). Regulations tracked on this page by area: Supply chain 3, Trade 2, Product safety 2, Cybersecurity 2, Grid 1, Environment 1, Disclosure 1. THREE LAYERS Governance Sets the rules Board, policy, sourcing Risk Finds exposures Supply, cyber, policy Compliance Proves it Audits, certification REGULATIONS TRACKED ON THIS PAGE, BY AREA Supply chain 3 Trade 2 Product safety 2 Cybersecurity 2 Grid 1 Environment 1 Disclosure 1
Rules tracked
12
FEOC rules
Since 2025
Battery passport
Feb 2027
Connected vehicles
MY2027
Hub
Policy

Finding

In electrification, compliance has become a supply-chain question

For EV, battery and energy companies, the rules that now carry the most money are about where parts come from: the foreign-entity rules that decide 45X and 48E eligibility, forced-labor import detentions under UFLPA, tariffs on steel, aluminum and copper, the EU battery passport and carbon border charges, and the US ban on Chinese software and hardware in connected vehicles.

Governance sets sourcing policy and accountability, risk management maps exposure to those rules and to cyber and grid threats, and compliance proves it through audits, certification and traceability. The practical tools are the same across the three: bills of materials traced to mine and refinery, supplier ownership checks, and product certifications (UL, IEC, FMVSS, UN R155) that customers and insurers ask for. The supply-chain pages on this site, starting with the Electrification Bottleneck Atlas, show where those exposures sit.

Regulations

Regulations and standards by area

Status as of October 2026.

Electrification regulations and standards
AreaRule or standardJurisdictionTimingEffect
Supply chainFEOC / prohibited foreign entity rules (45X, 48E)USTax years after Jul 4, 2025Disqualifies credits for Chinese-owned or Chinese-assisted suppliers
Supply chainUyghur Forced Labor Prevention Act (UFLPA)USIn force since 2022Import detentions of polysilicon, batteries, aluminum
Supply chainEU Battery Regulation and battery passportEUPassport from Feb 2027Carbon footprint, recycled content, due diligence
TradeSection 301 and 232 tariffsUSSteel and aluminum 50%; copper semis 50%Raises cost of imported components
TradeEU Carbon Border Adjustment Mechanism (CBAM)EUDefinitive from Jan 2026Carbon cost on steel, aluminum, hydrogen imports
Product safetyUL 9540 / 9540A, UL 2580, IEC 62619GlobalOngoingBattery and BESS fire safety
Product safetyFMVSS 305a, UN ECE R100US / UNOngoingEV electrical safety
CybersecurityUN R155 / R156; NERC CIPUN / USOngoingVehicle cyber and software updates; grid assets
CybersecurityConnected vehicle rule (Chinese software and hardware)USSoftware MY2027; hardware MY2030Bars Chinese-linked connected vehicle systems
GridIEEE 1547, UL 1741 SB, FERC Order 2023USOngoingInterconnection of DER, storage and large loads
EnvironmentVehicle GHG standardsUSRepealed Feb 2026In litigation; criteria pollutant rules remain
DisclosureEU CSRD; California SB 253 / 261EU / CAPhased, scope narrowedClimate and supply chain reporting

Layers

Governance, risk and compliance in practice

GRC layers
LayerRoleIn electrification
GovernancePolicies, oversight, accountabilitySourcing policy, board oversight of supply-chain and cyber risk, ESG reporting
Risk managementIdentify and mitigate exposuresMineral and component concentration, FEOC exposure, cyber threats to chargers and fleets, policy reversals
ComplianceProve adherenceTraceability, certifications, audits, regulatory filings

Sources

Sources and scope

Scope
Governance, risk and compliance for electrification companies (merges the former governance, risk and compliance pages)
Sources
One Big Beautiful Bill Act (Public Law 119-21, July 4, 2025); UFLPA; EU Regulation 2023/1542; EU CBAM; Commerce BIS connected vehicle rule; EPA final rule (February 2026)
Updated
October 2026