Bosch Paid $36 Million Because Its Firmware Was Tested on the Wrong Chips

“Provided your products contain less than 25% U.S. content and the U.S. content used is not classified under one of the following ECCNs … there is no impact, and no licensing requirements apply.”

That’s an email a Bosch trade compliance employee in Germany sent to the management of Bosch Sensortec on August 25, 2020, eight days after the Commerce Department widened its rule on foreign-made products bound for Huawei [2, 7]. It was wrong. According to the case file the Bureau of Industry and Security published on June 17, the business kept relying on it for four years [2].

The bill came due June 17: a $36,184,680 civil penalty from BIS, and a Justice Department letter declining to prosecute [1, 3].

What BIS actually charged

Robert Bosch GmbH, the Stuttgart company with about 400,000 employees and roughly $90 billion in 2024 revenue, admitted to 109 violations of the Export Administration Regulations [2]. Two German subsidiaries did the shipping. Bosch Sensortec sold MEMS sensors, the motion and pressure parts that go into phones, wearables and cars, to Huawei on 103 occasions, worth about $70.4 million [2]. ETAS sold its CycurHSM firmware, which runs the hardware security module on a car’s electronic control unit, and updates to it on six occasions, worth about $1.9 million [2]. The conduct ran from September 16, 2020, to September 26, 2024 [2].

Both products are classified EAR99, the catch-all bucket for items that usually need no license at all [2]. That didn’t matter. Huawei went on the Entity List in May 2019, and on August 17, 2020, BIS extended its reach to foreign-made items when Huawei is a party to the deal and the item comes from a plant, or a major component of a plant, that is itself the direct product of certain U.S. technology or software [2, 7]. That’s the foreign direct product rule. It asks how a thing was made, not what’s inside it.

For the sensors, the chain ran through suppliers. Nine of the eleven sensor models used MEMS built in Germany on epitaxy machines from a non-U.S. supplier, and those machines were direct products of controlled U.S. technology [2]. The other two contained a chip a contract manufacturer made on similar equipment [2].

The firmware case is the stranger one. ETAS tested every CycurHSM release, including bug fixes and maintenance updates, on microcontrollers from a non-U.S. company, and those microcontrollers were direct products of controlled U.S. software or technology [2]. BIS treated those test chips as a “major component of a plant” producing the software [2]. Its definition of “production” lists testing and quality assurance alongside manufacture and assembly [2]. Bosch’s compliance staff had concluded the rule applied only to physical goods [2].

How a 2020 email lasted four years

The charging letter is mostly a list of moments when someone told Bosch it had this wrong.

In September 2020, a test and assembly contractor wrote to Sensortec that its equipment triggered the rule and that Sensortec should assume shipping anything it processed to Huawei may be prohibited [2]. That same month, Bosch’s U.S. compliance team sent a questionnaire asking what equipment each business used to make goods for Huawei. The Sensortec executive who had received the August email wrote back that the products weren’t affected and added: “We are in a dire allocation situation and I am looking for every minute I can spare the team” [2]. The questions never got answered.

In 2021 a plant signed the epitaxy supplier’s certification promising not to use its output for Huawei, after the executive forwarded the old email [2]. In May 2023 an employee flagged U.S. guidance that sensors made on certain equipment could be caught [2]. In June 2023 a prospective chip supplier cited the rule and pointed to BIS’s $300 million Seagate penalty; a compliance professional in Germany called that supplier’s position an “internal policy” [2]. Bosch had a block on Huawei orders, and compliance staff kept releasing them [2].

For most of that period, the U.S. export controls team at a company that size was mainly two people, and only one of them worked primarily on export controls [2].

Bosch called the violations “unintentional” and said it has strengthened its trade compliance program [5, 6]. DOJ agreed on the intent question, at least for charging purposes: its letter notes Bosch’s position that the mistakes didn’t rise to willfulness, which criminal liability under the Export Control Reform Act requires [4].

The money, and why DOJ walked away

The order has Bosch paying BIS $32,583,651 within 30 days, with another $3,601,029 suspended until Bosch pays that sum to DOJ [2]. DOJ set disgorgement at $11,430,098, Bosch’s pre-tax profit on the sales, and credits $7,829,069 of the BIS payment against it [4]. By my arithmetic, the two pieces come to the $36,184,680 headline figure [2, 4].

DOJ listed four reasons to decline: timely self-disclosure, cooperation, remediation (including 66 new people in Bosch’s trade compliance organization) and the size of the BIS penalty [4]. It called this the National Security Division’s first declination under the department-wide Corporate Enforcement Policy [3]. “This declination reflects the clear benefits for companies that promptly disclose potential violations and fully assist in our investigations,” said Assistant Attorney General John Eisenberg [3]. The letter protects the company, not individuals [4].

David Peters, who runs export enforcement at Commerce, put the other side plainly: Bosch “had several opportunities to avoid these violations” [1].

What it means if you build things

I wrote last week about Commerce using an export letter to pull two frontier models. That was a new tool used in private. This is the opposite: an old rule, applied in public, with the reasoning written down. I’ll take that trade.

But read the firmware paragraph twice. If your team ships embedded software, drivers or firmware from outside the United States, BIS’s view is that the boards and chips in your test lab can be part of the “plant” that produces it [2]. Your CI hardware is part of your export profile. Most teams don’t track where their dev kits came from, let alone what U.S. technology went into making them.

Three practical points:

• EAR99 is not a pass. It tells you the item isn’t on the Commerce Control List. It says nothing about Entity List parties or direct product rules [2].
• Content tests and production tests are different questions. The August 2020 email answered the de minimis question when the rule asked about production equipment [2]. If your screening checklist only asks “how much U.S. content?”, it has the same bug.
• Read supplier certifications. Bosch employees signed several of them and later said they didn’t know Huawei was the kind of entity the forms described [2]. Your suppliers often understand your exposure before you do.

My worry is the cost curve. Bosch’s fix was 66 hires [4]. A 40-person firmware shop selling into Asian auto supply chains can’t do that, and the foreign direct product rule doesn’t scale its demands to company size. The case does show that disclosing early is the cheaper path, which helps the small team that finds its own problem.

What I’m watching

• The payments. DOJ’s disgorgement condition runs 30 days from its June 15 letter, and the BIS payment runs 30 days from the order [2, 4]. If disgorgement isn’t timely paid, DOJ says it may reopen the investigation [4].
• Software guidance. BIS hasn’t published guidance on how test hardware makes software a direct product. Until it does, this settlement is the clearest statement of the agency’s position [2].
• Whether more disclosures resolve this way. This was the first such declination from the National Security Division [3]. The next few will show whether it’s a pattern.