Connected Vehicle Security Act of 2026

This Act may be cited as the “Connected Vehicle Security Act of 2026”.

Congress makes the following findings:

(1) The United States automotive industry is critical to the national economy, supporting millions of jobs, supply chains, and advanced manufacturing. The introduction of vehicles and components controlled by foreign adversaries threatens United States economic security, industrial competitiveness, and technological leadership.

(2) The People’s Republic of China has rapidly expanded its automotive manufacturing capacity and is increasingly targeting export markets. Despite having the largest market in the world, the People's Republic of China exports nearly 8,000,000 vehicles annually, approximately twice the volume exported by any other country, demonstrating the scale at which vehicles and components controlled by a foreign adversary may enter global markets, including the United States.

(3) Connected vehicles incorporate advanced information and communications technologies that collect, process, and transmit vast amounts of sensitive data, including geolocation, operational, and personal information, and are capable of being remotely accessed and controlled.

(4) In Executive Order 13873 (50 U.S.C. 1701 note; relating to securing the information and communications technology and services supply chain), the President declared a national emergency with respect to the threat posed by foreign adversaries creating and exploiting vulnerabilities in information and communications technology and services.

(5) The access, control, or influence of vehicle connectivity systems or automated driving systems by foreign adversaries creates substantial economic and national security risks to the United States, including risks of surveillance, espionage, cyber intrusion, and disruption of critical infrastructure. Such risks fall within the scope of the national emergency described in Executive Order 13873 and pose an unacceptable threat to the security and resilience of the United States.

In this Act:

(1) Automated driving system.— The term automated driving system means hardware and software that, collectively, are capable of performing the entire dynamic driving task for a connected vehicle on a sustained basis, regardless of whether it is limited to a specific operational design domain.

(2) Connected vehicle.—

(A) In general.— Except as provided by subparagraph (B), the term connected vehicle means a vehicle driven or drawn by mechanical power and manufactured primarily for use on public streets, roads, and highways, that—

(i) integrates onboard networked hardware with automotive software systems to communicate via dedicated short-range communication, cellular telecommunications connectivity, satellite communication, or other wireless spectrum connectivity with any other network or device; or

(ii) is designed, manufactured, or originally equipped to communicate via such methods, regardless of whether such capability is enabled, disabled, or removed at the time of importation, manufacture, sale, resale, or introduction of the vehicle into interstate commerce in the United States.

(B) Exclusion.— The term connected vehicle does not include a vehicle operated only on a rail line.

(3) Connected vehicle hardware.— The term connected vehicle hardware means—

(A) a vehicle connectivity system; and

(B) vehicle connectivity system hardware.

(4) Country of origin.— The term country of origin, with respect to an item, means the country—

(A) in which the item is manufactured; or

(B) the government of which owns or controls, or has jurisdiction or direction over—

(i) the entity manufacturing the item; or

(ii) the entity supplying the item.

(5) Covered country.— The term covered country means—

(A) the Democratic People's Republic of North Korea;

(B) the People's Republic of China;

(C) the Russian Federation; and

(D) the Islamic Republic of Iran.

(6) Covered software.— The term covered software—

(A) means the software-based components installed in or on a connected vehicle, or designed to be installed in or on a connected vehicle, including application, middleware, and system software, executed by the primary processing unit or units of an item that directly enables the function of a vehicle connectivity system or automated driving system at the vehicle level; and

(B) includes any machine-learning model or other artificial intelligence component that directly enables decision-making or control of an automated driving system at the vehicle level.

(7) Electric vehicle.— The term electric vehicle has the meaning given that term in section 3 of the Electric and Hybrid Vehicle Research, Development, and Demonstration Act of 1976 (15 U.S.C. 2502).

(8) Importation.— The term importation has the meaning given the term import in section 1001 of the Controlled Substances Import and Export Act (21 U.S.C. 951).

(9) Resale.—

(A) In general.— The term resale, with respect to an item, means the transfer of ownership of the item by an individual or entity that acquired the item for the purpose of transfer in the ordinary course of business, and not for the use of or consumption by the individual or entity.

(B) Exclusion.— The term resale does not include the transfer of a connected vehicle that was previously titled or registered to, and used by, a consumer or end-user or was acquired for bona fide use, lease, or operation by the individual or entity transferred the vehicle.

(10) Safety equipment.— The term safety equipment, with respect to a vehicle, means air bags, air bag inflators, and seatbelt systems.

(11) Secretary.— The term Secretary means the Secretary of Commerce, acting through the Under Secretary of Commerce for Industry and Security.

(12) Transaction.— The term transaction—

(A) means any acquisition, importation, transfer, installation, dealing in, or use of any item subject to a prohibition under section 4(a), including ongoing activities, such as managed services, data transmission, software updates, repairs, or the platforming or data hosting of applications for consumer download; and

(B) includes—

(i) any other transaction, the structure of which is designed or intended to evade or circumvent this Act; and

(ii) a class of transactions.

(13) Vehicle connectivity system.— The term vehicle connectivity system means a vehicle connectivity system hardware or covered software item installed in or on a connected vehicle, or designed to be installed in or on a connected vehicle, that directly enables the function of transmission, receipt, conversion, or processing of radio frequency communications at a frequency over 450 megahertz.

(14) Vehicle connectivity system hardware.— The term vehicle connectivity system hardware—

(A) means software-enabled or programmable components that—

(i) are installed in or on a connected vehicle or designed to be installed in or on a connected vehicle;

(ii) are directly connected to a vehicle connectivity system; and

(iii) directly enable the function of a vehicle connectivity system or are part of an item that directly enables the function of a vehicle connectivity system; and

(B) includes—

(i) microcontrollers, microcomputers or modules, systems on a chip, networking or telematics units, cellular modem/modules, Wi-Fi microcontrollers or modules, Bluetooth microcontrollers or modules, satellite communication systems, other wireless communication microcontrollers or modules, external antennas, digital signal processors, and field-programmable gate arrays;

(ii) electronic systems integrated into a battery that directly enable or control the monitoring, management, security, or external communication of battery performance or operation, including any transmitter or interface component that performs such functions; and

(iii) safety equipment.

(a) Prohibitions.—

(1) Connected vehicles.— On and after January 1, 2027, the importation, manufacture, sale, resale, or introduction into interstate commerce in the United States of a connected vehicle is prohibited if—

(A) the country of origin of the connected vehicle is a covered country or the connected vehicle is designed within a covered country, without regard to whether—

(i) at the time of importation, sale, resale, or introduction, the vehicle is equipped with any covered software or connected vehicle hardware subject to a prohibition under paragraph (2) or (3); or

(ii) any such covered software or connected vehicle hardware—

(I) is removed from the vehicle before importation, sale, resale, or introduction; or

(II) will be installed after importation, sale, resale, or introduction; or

(B) the manufacturer of the connected vehicle is a joint venture, subsidiary, or other entity in which more than 15 percent of the equity interest, voting interest, board representation, or other indicia of control, whether directly or indirectly, is owned or controlled by an entity, or combination of entities, organized under the laws of, or with its principal place of business in, a covered country.

(2) Covered software.— On and after January 1, 2027, the integration of covered software into a connected vehicle that is imported, manufactured, sold, resold, or introduced into interstate commerce into the United States is prohibited if—

(A) the country of origin of the covered software is a covered country; or

(B) the developer of the software—

(i) is organized under the laws of, or has its principal place of business in, a covered country; or

(ii) is a joint venture, subsidiary, or other entity in which more than 25 percent of the equity interest, voting interest, board representation, or other indicia of control, whether directly or indirectly, is owned or controlled by an entity, or combination of entities, described in clause (i).

(3) Connected vehicle hardware.—

(A) In general.— On and after January 1, 2030, the importation, manufacture, sale, resale, or introduction into interstate commerce in the United States of any connected vehicle hardware is prohibited if—

(i) the country of origin of the hardware is a covered country; or

(ii) the manufacturer of the hardware—

(I) is organized under the laws of, or has its principal place of business in, a covered country; or

(II) is a joint venture, subsidiary, or other entity in which more than 25 percent of the equity interest, voting interest, board representation, or other indicia of control, whether directly or indirectly, is owned or controlled by an entity, or combination of entities, described in subclause (I).

(B) Repair and warranty.— The prohibition under subparagraph (A) shall not apply to connected vehicle hardware that is imported, manufactured, sold, resold, or introduced into interstate commerce in the United States for the purpose of repair or under warranty for a connected vehicle with a model year before model year 2030.

(4) Additional items.— Subject to an applicable ruling or advisory opinion issued under subsection (d), a prohibition under paragraph (1), (2), or (3) applies with respect to a connected vehicle, covered software, or connected vehicle hardware, as the case may be, that is renamed, rebranded, restructured, or altered to circumvent the prohibition.

(5) Exception.— The prohibitions under paragraphs (1), (2), and (3) shall not apply to the importation, manufacture, sale, resale, or introduction into interstate commerce in the United States of a connected vehicle, covered software, or connected vehicle hardware, as the case may be, for the sole purpose of testing and evaluation by an entity that—

(A) is organized under the laws of a State in the United States;

(B) does not have its principal place of business in a covered country; and

(C) is not 25 percent or more, whether directly or indirectly, owned or controlled by an entity, or combination of entities, organized under the laws of, or with its principal place of business in, a covered country.

(b) Related transactions.—

(1) In general.— The Secretary shall prescribe regulations, pursuant to section 553 of title 5, United States Code, to prohibit any specific transaction relating to connected vehicles, including the importation, sale, distribution, integration, or use of a connected vehicle, covered software, connected vehicle hardware, or any other item subject to a prohibition under subsection (a), that the Secretary determines poses an undue or unacceptable threat to the economic or national security of the United States.

(2) Notice.— If the Secretary prohibits a transaction under paragraph (1), the Secretary shall deliver, by certified United States mail, to the parties to the transaction a notice of the prohibition that includes an identification, by name, of the specific item that the Secretary determines poses an undue or unacceptable threat to the economic or national security of the United States.

(c) Authorizations.—

(1) Issuance.—

(A) In general.— The Secretary, in consultation with the Secretary of Defense, the Secretary of Transportation, the Secretary of State, and the Secretary of Energy, may issue a general or specific authorization for the importation, manufacture, sale, resale, or introduction into interstate commerce in the United States of an item that would otherwise be subject to the prohibitions under subsection (a) if—

(i) the Secretary determines, based on clear and convincing evidence and a written risk assessment, that the importation, manufacture, sale, resale, or introduction of the item does not pose, and is not reasonably likely to pose—

(I) an undue risk of data exfiltration from, or remote manipulation or operation of, a connected vehicle;

(II) a risk to critical infrastructure or the integrity of the industrial base of the United States; or

(III) any other risk to the national security of the United States;

(ii) not less than 60 days before the authorization takes effect, the Secretary submits to Congress a detailed written notification, including the determination under clause (i) and underlying analysis, including the written risk assessment; and

(iii) during the 60-day period described in clause (ii), there is not enacted into law a joint resolution of disapproval with respect to the authorization of the item.

(B) Continued validity and modification and revocation of authorizations.—

(i) Continued validity of existing authorizations.— Except as provided by clauses (ii) and (iii), any general or specific authorization issued under subparagraph (A) or subpart D of part 791 of title 15, Code of Federal Regulations, before January 1, 2030, shall remain in effect until January 1, 2032, unless modified, suspended or revoked under clause (ii).

(ii) Modification or revocation of general or specific authorizations.— The Secretary may, at any time, modify, suspend, or revoke a general or specific authorization described in clause (i) if the Secretary—

(I) determines that the authorization no longer satisfies the requirements of subparagraph (A)(i); and

(II) provides the public with an opportunity to comment before modifying, suspending, or revoking the authorization.

(2) Publication of list of authorized items.—

(A) In general.— The Secretary shall publish, pursuant to section 553 of title 5, United States Code, and maintain a list of the items the importation, manufacture, sale, resale, or introduction into interstate commerce in the United States of which is authorized under paragraph (1). The initial such list shall be published not later than January 1, 2027.

(B) Inclusions.—

(i) In general.— To the extent possible, the Secretary shall include, in the list required by subparagraph (A), the manufacturer and product name for each item on the list.

(ii) Other identifying characteristics.— When it is not possible to include, in the list required by subparagraph (A), the manufacturer and product name for an item, the Secretary shall provide technical criteria sufficient to enable the automotive industry and importers to determine without undue difficulty whether the importation, manufacture, sale, resale, or introduction into interstate commerce in the United States of an item is authorized under paragraph (1). In carrying out this clause, the Secretary shall protect intellectual property to the extent practicable.

(iii) Risk assessment.— To the extent possible, the Secretary shall include, in the list required by subparagraph (A), a detailed explanation about why each item on the list does not pose an undue risk described in subparagraph (A) or (B) of paragraph (1).

(3) Requests for authorization.— Not later than January 1, 2027, the Secretary shall establish a procedure pursuant to which an importer, manufacturer, supplier, or seller or reseller may seek the authorization under paragraph (1) of the importation, manufacture, sale, resale, or introduction into interstate commerce in the United States of an item described in subsection (a) that would otherwise be subject to the prohibitions under that subsection.

(d) Rulings and advisory opinions.—

(1) In general.— Not later than January 1, 2027, the Secretary shall establish a procedure pursuant to which an importer, manufacturer, or seller or reseller may seek a binding ruling or advisory opinion with respect to whether—

(A) the importation, manufacture, sale, resale, or introduction into interstate commerce in the United States of an item is or is not prohibited under this section; or

(B) a connected vehicle, covered software, or connected vehicle hardware has been renamed, rebranded, restructured, or altered to circumvent the prohibitions under subsection (a).

(2) Timing.— The Secretary shall issue a ruling or advisory opinion under paragraph (1) with respect to an item not later than 45 days after receiving an application supported by a reasonably clear description of the item.

(3) Publication.—

(A) In general.— The Secretary shall—

(i) publish a list of the items for which the Secretary has issued rulings and advisory opinions under paragraph (1); and

(ii) update that list not less frequently than annually.

(B) Prohibition on publication of identifying information.— The Secretary shall not publish the name of, or other information that might reasonably identify, the party that requested the ruling or advisory opinion.

(4) Continued validity of existing rulings and opinions.— Except as provided by paragraph (5), a ruling or advisory opinion issued under this subsection or subpart D of part 791 of title 15, Code of Federal Regulations, before January 1, 2027, shall remain in effect.

(5) Modification or revocation.— The Secretary may modify, suspend, or revoke any binding ruling or advisory opinion issued under paragraph (1) or subpart D of part 791 of title 15, Code of Federal Regulations, with respect to an item at any time if the Secretary determines that the circumstances that led to the ruling or opinion have changed.

(e) Declaration of conformity.— The Secretary shall establish a process under which a person that imports, manufactures, sells, resells, or introduces into interstate commerce in the United States a connected vehicle or connected vehicle hardware is required to submit a declaration, to be known as a “declaration of conformity”, to the Secretary before importing, manufacturing, selling, reselling, or introducing the vehicle or hardware that certifies that the vehicle or hardware is not subject to a prohibition under subsection (a).

(f) Civil penalties.—

(1) In general.— The Secretary shall assess a civil penalty for each transaction that is a violation of a prohibition under subsection (a) in an amount that is not less than the greater of—

(A) $1,500,000; or

(B) five times the value of the transaction.

(2) Continuing violations.— In the case of a violation that occurs on more than one day, each day on which the violation continues shall be treated as a separate violation.

(g) Classified information.— The Secretary may rely on classified information in carrying out this section, which may be submitted to a reviewing court ex parte and in camera.

(h) Petitions for review.— The filing in a court of a petition for review shall not stay the effectiveness of any action under this section unless ordered by the court.

(a) Use of existing advisory bodies.—

(1) In general.— In carrying out this Act, the Secretary may consult, as appropriate, with existing advisory committees of the Department of Transportation and other relevant Federal agencies, including the Advisory Committee on Automation in Transportation, on matters relating to connected vehicles and associated national security risks.

(2) Scope of consultation.— Consultation under paragraph (1) may include consideration of—

(A) risks relating to data security, cybersecurity, and supply chain integrity associated with connected vehicles;

(B) the effectiveness of authorities and regulations issued under this Act;

(C) emerging technologies and threat vectors relevant to connected vehicle ecosystems; and

(D) recommendations made to the Secretary with respect to regulatory, enforcement, and policy measures to mitigate risks described in subparagraph (A).

(b) Interagency coordination.— In carrying out this Act, the Secretary may consult and coordinate, as appropriate, with the Federal Communications Commission and other relevant Federal agencies to ensure alignment with respect to the scope, timeline, and implementation of any prohibitions or restrictions issued under this Act, including to avoid duplicative, inconsistent, or conflicting regulatory requirements.

Not later than one year after the date of the enactment of this Act, and annually thereafter, the Secretary shall submit to Congress a report—

(1) describing activities carried out to enforce the prohibitions under section 4, including enforcement actions taken and resources utilized;

(2) providing a detailed accounting of items covered by such prohibitions during the 1-year period preceding submission of the report;

(3) explaining any exclusions, exemptions, or determinations made by the Secretary, including the rationale and criteria applied;

(4) assessing the effectiveness of such prohibitions in decreasing the threats to the economic and national security of the United States posed by connected vehicles;

(5) including metrics on enforcement, compliance rates, violations identified, penalties assessed, and any identified gaps or challenges; and

(6) making recommendations with respect to further decreasing such threats.

(a) Severability.— If any provision of this Act, or the application of such provision to any person or circumstance, is held to be invalid, the remainder of this Act, and the application of the remaining provisions to any person or circumstance, shall not be affected.

(b) Restoration of prior regulations.— If a court of competent jurisdiction enters a final judgment holding invalid or unenforceable a provision of this Act and supersedes regulations prescribed to carry out section 4, the Secretary may, notwithstanding any other provision of this Act, reissue or reinstate, in whole or in part, any similar regulations that were in effect on the day before the date of the enactment of this Act.

(a) Rule of construction.— Nothing in this Act shall be construed to prohibit, limit, or otherwise affect the authority of the Secretary of Commerce to implement or administer subpart D of part 791 of title 15, Code of Federal Regulations, as added by the final rule of the Bureau of Industry and Security entitled “Securing the Information and Communications Technology and Services Supply Chain: Connected Vehicles” (90 Fed. Reg. 5360).

(b) Delayed implementation for software and hardware not covered by regulations.— In the case of covered software and connected vehicle hardware that is subject to a prohibition under paragraph (2) or (3) of section 4(a) and is not subject to subpart D of part 791 of title 15, Code of Federal Regulations, as in effect on the day before the date of the enactment of this Act, the Secretary shall implement the prohibition under section 4(a) after January 1, 2030, and before January 1, 2032.

(c) Treatment of prior exclusions.—

(1) In general.— Subject to paragraph (2), any exclusion or exception to a prohibition under subpart D of part 791 of title 15, Code of Federal Regulations, as in effect on the day before the date of the enactment of this Act, shall remain valid and shall apply to the prohibitions under section 4(a).

(2) Rulemaking.— Beginning January 1, 2030, the Secretary shall conduct a rulemaking, pursuant to section 553 of title 5, United States Code, to determine whether exclusions or exceptions described in paragraph (1) should be continued, modified, or terminated for the purposes of this Act.