Bills · S. 4429 · Text
Reported to Senate
Confirmed from the official record
Our copy of the file on govinfo.gov, saved October 14, 2026. Fingerprint (SHA-256): 171d459965a917d6.
[Congressional Bills 119th Congress]
[From the U.S. Government Publishing Office]
[S. 4429 Reported in Senate (RS)]
<DOC>
Calendar No. 671
119th CONGRESS
2d Session
S. 4429
[Report No. 119-146]
To prohibit the importation, manufacture, sale, resale, or introduction
into interstate commerce in the United States of connected vehicles and
related software and hardware associated with foreign adversaries.
_______________________________________________________________________
IN THE SENATE OF THE UNITED STATES
April 29, 2026
Mr. Moreno (for himself, Ms. Slotkin, Mr. Cotton, Mr. Schmitt, Mr.
Tuberville, Mr. Ricketts, Mr. Hawley, Mrs. Capito, Mrs. Fischer, Ms.
Baldwin, Ms. Lummis, Mr. Cramer, Mr. Budd, Mr. Curtis, Mr. Sheehy, Mr.
Sullivan, Mrs. Blackburn, Mr. Banks, Mr. Moran, Mr. Justice, Ms.
Collins, Mr. Schumer, Mr. McCormick, Ms. Ernst, Mr. Cornyn, Mrs. Moody,
Mr. Husted, Mr. Scott of Florida, Mr. Gallego, Mr. Marshall, Mrs.
Shaheen, Mr. Hickenlooper, Mr. Peters, Mr. Kelly, Mrs. Hyde-Smith, Mr.
Padilla, Ms. Rosen, Mr. Barrasso, Ms. Hassan, Mr. Heinrich, Mr.
Armstrong, Mr. Merkley, Mr. Coons, Mr. Blumenthal, Mr. Schiff, Ms.
Warren, Ms. Klobuchar, Mr. Boozman, Mr. Lankford, Ms. Cortez Masto, Ms.
Smith, and Mr. Daines) introduced the following bill; which was read
twice and referred to the Committee on Commerce, Science, and
Transportation
September 22, 2026
Reported by Mr. Cruz, with an amendment
[Strike out all after the enacting clause and insert the part printed
in italic]
_______________________________________________________________________
A BILL
To prohibit the importation, manufacture, sale, resale, or introduction
into interstate commerce in the United States of connected vehicles and
related software and hardware associated with foreign adversaries.
Be it enacted by the Senate and House of Representatives of the
United States of America in Congress assembled,
<DELETED>SECTION 1. SHORT TITLE.</DELETED>
<DELETED> This Act may be cited as the ``Connected Vehicle Security
Act of 2026''.</DELETED>
<DELETED>SEC. 2. FINDINGS.</DELETED>
<DELETED> Congress makes the following findings:</DELETED>
<DELETED> (1) The United States automotive industry is
critical to the national economy, supporting millions of jobs,
supply chains, and advanced manufacturing. The introduction of
vehicles and components controlled by foreign adversaries
threatens United States economic security, industrial
competitiveness, and technological leadership.</DELETED>
<DELETED> (2) The People's Republic of China has rapidly
expanded its automotive manufacturing capacity and is
increasingly targeting export markets. Despite having the
largest market in the world, the People's Republic of China
exports nearly 8,000,000 vehicles annually, approximately twice
the volume exported by any other country, demonstrating the
scale at which vehicles and components controlled by a foreign
adversary may enter global markets, including the United
States.</DELETED>
<DELETED> (3) Connected vehicles incorporate advanced
information and communications technologies that collect,
process, and transmit vast amounts of sensitive data, including
geolocation, operational, and personal information, and are
capable of being remotely accessed and controlled.</DELETED>
<DELETED> (4) In Executive Order 13873 (50 U.S.C. 1701 note;
relating to securing the information and communications
technology and services supply chain), the President declared a
national emergency with respect to the threat posed by foreign
adversaries creating and exploiting vulnerabilities in
information and communications technology and
services.</DELETED>
<DELETED> (5) The access, control, or influence of vehicle
connectivity systems or automated driving systems by foreign
adversaries creates substantial economic and national security
risks to the United States, including risks of surveillance,
espionage, cyber intrusion, and disruption of critical
infrastructure. Such risks fall within the scope of the
national emergency described in Executive Order 13873 and pose
an unacceptable threat to the security and resilience of the
United States.</DELETED>
<DELETED>SEC. 3. DEFINITIONS.</DELETED>
<DELETED> In this Act:</DELETED>
<DELETED> (1) Automated driving system.--The term
``automated driving system'' means hardware and software that,
collectively, are capable of performing the entire dynamic
driving task for a connected vehicle on a sustained basis,
regardless of whether it is limited to a specific operational
design domain.</DELETED>
<DELETED> (2) Connected vehicle.--</DELETED>
<DELETED> (A) In general.--Except as provided by
subparagraph (B), the term ``connected vehicle'' means
a vehicle driven or drawn by mechanical power and
manufactured primarily for use on public streets,
roads, and highways, that--</DELETED>
<DELETED> (i) integrates onboard networked
hardware with automotive software systems to
communicate via dedicated short-range
communication, cellular telecommunications
connectivity, satellite communication, or other
wireless spectrum connectivity with any other
network or device; or</DELETED>
<DELETED> (ii) is designed, manufactured, or
originally equipped to communicate via such
methods, regardless of whether such capability
is enabled, disabled, or removed at the time of
importation, manufacture, sale, resale, or
introduction of the vehicle into interstate
commerce in the United States.</DELETED>
<DELETED> (B) Exclusion.--The term ``connected
vehicle'' does not include a vehicle operated only on a
rail line.</DELETED>
<DELETED> (3) Connected vehicle hardware.--The term
``connected vehicle hardware'' means--</DELETED>
<DELETED> (A) a vehicle connectivity system;
and</DELETED>
<DELETED> (B) vehicle connectivity system
hardware.</DELETED>
<DELETED> (4) Country of origin.--The term ``country of
origin'', with respect to an item, means the country--
</DELETED>
<DELETED> (A) in which the item is manufactured;
or</DELETED>
<DELETED> (B) the government of which owns or
controls, or has jurisdiction or direction over--
</DELETED>
<DELETED> (i) the entity manufacturing the
item; or</DELETED>
<DELETED> (ii) the entity supplying the
item.</DELETED>
<DELETED> (5) Covered country.--The term ``covered country''
means--</DELETED>
<DELETED> (A) the Democratic People's Republic of
North Korea;</DELETED>
<DELETED> (B) the People's Republic of
China;</DELETED>
<DELETED> (C) the Russian Federation; and</DELETED>
<DELETED> (D) the Islamic Republic of
Iran.</DELETED>
<DELETED> (6) Covered software.--The term ``covered
software''--</DELETED>
<DELETED> (A) means the software-based components
installed in or on a connected vehicle, or designed to
be installed in or on a connected vehicle, including
application, middleware, and system software, executed
by the primary processing unit or units of an item that
directly enables the function of a vehicle connectivity
system or automated driving system at the vehicle
level; and</DELETED>
<DELETED> (B) includes any machine-learning model or
other artificial intelligence component that directly
enables decision-making or control of an automated
driving system at the vehicle level.</DELETED>
<DELETED> (7) Electric vehicle.--The term ``electric
vehicle'' has the meaning given that term in section 3 of the
Electric and Hybrid Vehicle Research, Development, and
Demonstration Act of 1976 (15 U.S.C. 2502).</DELETED>
<DELETED> (8) Importation.--The term ``importation'' has the
meaning given the term ``import'' in section 1001 of the
Controlled Substances Import and Export Act (21 U.S.C.
951).</DELETED>
<DELETED> (9) Resale.--</DELETED>
<DELETED> (A) In general.--The term ``resale'', with
respect to an item, means the transfer of ownership of
the item by an individual or entity that acquired the
item for the purpose of transfer in the ordinary course
of business, and not for the use of or consumption by
the individual or entity.</DELETED>
<DELETED> (B) Exclusion.--The term ``resale'' does
not include the transfer of a connected vehicle that
was previously titled or registered to, and used by, a
consumer or end-user or was acquired for bona fide use,
lease, or operation by the individual or entity
transferred the vehicle.</DELETED>
<DELETED> (10) Safety equipment.--The term ``safety
equipment'', with respect to a vehicle, means air bags, air bag
inflators, and seatbelt systems.</DELETED>
<DELETED> (11) Secretary.--The term ``Secretary'' means the
Secretary of Commerce, acting through the Under Secretary of
Commerce for Industry and Security.</DELETED>
<DELETED> (12) Transaction.--The term ``transaction''--
</DELETED>
<DELETED> (A) means any acquisition, importation,
transfer, installation, dealing in, or use of any item
subject to a prohibition under section 4(a), including
ongoing activities, such as managed services, data
transmission, software updates, repairs, or the
platforming or data hosting of applications for
consumer download; and</DELETED>
<DELETED> (B) includes--</DELETED>
<DELETED> (i) any other transaction, the
structure of which is designed or intended to
evade or circumvent this Act; and</DELETED>
<DELETED> (ii) a class of
transactions.</DELETED>
<DELETED> (13) Vehicle connectivity system.--The term
``vehicle connectivity system'' means a vehicle connectivity
system hardware or covered software item installed in or on a
connected vehicle, or designed to be installed in or on a
connected vehicle, that directly enables the function of
transmission, receipt, conversion, or processing of radio
frequency communications at a frequency over 450
megahertz.</DELETED>
<DELETED> (14) Vehicle connectivity system hardware.--The
term ``vehicle connectivity system hardware''--</DELETED>
<DELETED> (A) means software-enabled or programmable
components that--</DELETED>
<DELETED> (i) are installed in or on a
connected vehicle or designed to be installed
in or on a connected vehicle;</DELETED>
<DELETED> (ii) are directly connected to a
vehicle connectivity system; and</DELETED>
<DELETED> (iii) directly enable the function
of a vehicle connectivity system or are part of
an item that directly enables the function of a
vehicle connectivity system; and</DELETED>
<DELETED> (B) includes--</DELETED>
<DELETED> (i) microcontrollers,
microcomputers or modules, systems on a chip,
networking or telematics units, cellular modem/
modules, Wi-Fi microcontrollers or modules,
Bluetooth microcontrollers or modules,
satellite communication systems, other wireless
communication microcontrollers or modules,
external antennas, digital signal processors,
and field-programmable gate arrays;</DELETED>
<DELETED> (ii) electronic systems integrated
into a battery that directly enable or control
the monitoring, management, security, or
external communication of battery performance
or operation, including any transmitter or
interface component that performs such
functions; and</DELETED>
<DELETED> (iii) safety equipment.</DELETED>
<DELETED>SEC. 4. PROHIBITION ON CONNECTED VEHICLES AND OTHER
TRANSACTIONS THAT THREATEN ECONOMIC OR NATIONAL
SECURITY.</DELETED>
<DELETED> (a) Prohibitions.--</DELETED>
<DELETED> (1) Connected vehicles.--On and after January 1,
2027, the importation, manufacture, sale, resale, or
introduction into interstate commerce in the United States of a
connected vehicle is prohibited if--</DELETED>
<DELETED> (A) the country of origin of the connected
vehicle is a covered country or the connected vehicle
is designed within a covered country, without regard to
whether--</DELETED>
<DELETED> (i) at the time of importation,
sale, resale, or introduction, the vehicle is
equipped with any covered software or connected
vehicle hardware subject to a prohibition under
paragraph (2) or (3); or</DELETED>
<DELETED> (ii) any such covered software or
connected vehicle hardware--</DELETED>
<DELETED> (I) is removed from the
vehicle before importation, sale,
resale, or introduction; or</DELETED>
<DELETED> (II) will be installed
after importation, sale, resale, or
introduction; or</DELETED>
<DELETED> (B) the manufacturer of the connected
vehicle is a joint venture, subsidiary, or other entity
in which more than 15 percent of the equity interest,
voting interest, board representation, or other indicia
of control, whether directly or indirectly, is owned or
controlled by an entity, or combination of entities,
organized under the laws of, or with its principal
place of business in, a covered country.</DELETED>
<DELETED> (2) Covered software.--On and after January 1,
2027, the integration of covered software into a connected
vehicle that is imported, manufactured, sold, resold, or
introduced into interstate commerce into the United States is
prohibited if--</DELETED>
<DELETED> (A) the country of origin of the covered
software is a covered country; or</DELETED>
<DELETED> (B) the developer of the software--
</DELETED>
<DELETED> (i) is organized under the laws
of, or has its principal place of business in,
a covered country; or</DELETED>
<DELETED> (ii) is a joint venture,
subsidiary, or other entity in which more than
25 percent of the equity interest, voting
interest, board representation, or other
indicia of control, whether directly or
indirectly, is owned or controlled by an
entity, or combination of entities, described
in clause (i).</DELETED>
<DELETED> (3) Connected vehicle hardware.--</DELETED>
<DELETED> (A) In general.--On and after January 1,
2030, the importation, manufacture, sale, resale, or
introduction into interstate commerce in the United
States of any connected vehicle hardware is prohibited
if--</DELETED>
<DELETED> (i) the country of origin of the
hardware is a covered country; or</DELETED>
<DELETED> (ii) the manufacturer of the
hardware--</DELETED>
<DELETED> (I) is organized under the
laws of, or has its principal place of
business in, a covered country;
or</DELETED>
<DELETED> (II) is a joint venture,
subsidiary, or other entity in which
more than 25 percent of the equity
interest, voting interest, board
representation, or other indicia of
control, whether directly or
indirectly, is owned or controlled by
an entity, or combination of entities,
described in subclause (I).</DELETED>
<DELETED> (B) Repair and warranty.--The prohibition
under subparagraph (A) shall not apply to connected
vehicle hardware that is imported, manufactured, sold,
resold, or introduced into interstate commerce in the
United States for the purpose of repair or under
warranty for a connected vehicle with a model year
before model year 2030.</DELETED>
<DELETED> (4) Additional items.--Subject to an applicable
ruling or advisory opinion issued under subsection (d), a
prohibition under paragraph (1), (2), or (3) applies with
respect to a connected vehicle, covered software, or connected
vehicle hardware, as the case may be, that is renamed,
rebranded, restructured, or altered to circumvent the
prohibition.</DELETED>
<DELETED> (5) Exception.--The prohibitions under paragraphs
(1), (2), and (3) shall not apply to the importation,
manufacture, sale, resale, or introduction into interstate
commerce in the United States of a connected vehicle, covered
software, or connected vehicle hardware, as the case may be,
for the sole purpose of testing and evaluation by an entity
that--</DELETED>
<DELETED> (A) is organized under the laws of a State
in the United States;</DELETED>
<DELETED> (B) does not have its principal place of
business in a covered country; and</DELETED>
<DELETED> (C) is not 25 percent or more, whether
directly or indirectly, owned or controlled by an
entity, or combination of entities, organized under the
laws of, or with its principal place of business in, a
covered country.</DELETED>
<DELETED> (b) Related Transactions.--</DELETED>
<DELETED> (1) In general.--The Secretary shall prescribe
regulations, pursuant to section 553 of title 5, United States
Code, to prohibit any specific transaction relating to
connected vehicles, including the importation, sale,
distribution, integration, or use of a connected vehicle,
covered software, connected vehicle hardware, or any other item
subject to a prohibition under subsection (a), that the
Secretary determines poses an undue or unacceptable threat to
the economic or national security of the United
States.</DELETED>
<DELETED> (2) Notice.--If the Secretary prohibits a
transaction under paragraph (1), the Secretary shall deliver,
by certified United States mail, to the parties to the
transaction a notice of the prohibition that includes an
identification, by name, of the specific item that the
Secretary determines poses an undue or unacceptable threat to
the economic or national security of the United
States.</DELETED>
<DELETED> (c) Authorizations.--</DELETED>
<DELETED> (1) Issuance.--</DELETED>
<DELETED> (A) In general.--The Secretary, in
consultation with the Secretary of Defense, the
Secretary of Transportation, the Secretary of State,
and the Secretary of Energy, may issue a general or
specific authorization for the importation,
manufacture, sale, resale, or introduction into
interstate commerce in the United States of an item
that would otherwise be subject to the prohibitions
under subsection (a) if--</DELETED>
<DELETED> (i) the Secretary determines,
based on clear and convincing evidence and a
written risk assessment, that the importation,
manufacture, sale, resale, or introduction of
the item does not pose, and is not reasonably
likely to pose--</DELETED>
<DELETED> (I) an undue risk of data
exfiltration from, or remote
manipulation or operation of, a
connected vehicle;</DELETED>
<DELETED> (II) a risk to critical
infrastructure or the integrity of the
industrial base of the United States;
or</DELETED>
<DELETED> (III) any other risk to
the national security of the United
States;</DELETED>
<DELETED> (ii) not less than 60 days before
the authorization takes effect, the Secretary
submits to Congress a detailed written
notification, including the determination under
clause (i) and underlying analysis, including
the written risk assessment; and</DELETED>
<DELETED> (iii) during the 60-day period
described in clause (ii), there is not enacted
into law a joint resolution of disapproval with
respect to the authorization of the
item.</DELETED>
<DELETED> (B) Continued validity and modification
and revocation of authorizations.--</DELETED>
<DELETED> (i) Continued validity of existing
authorizations.--Except as provided by clauses
(ii) and (iii), any general or specific
authorization issued under subparagraph (A) or
subpart D of part 791 of title 15, Code of
Federal Regulations, before January 1, 2030,
shall remain in effect until January 1, 2032,
unless modified, suspended or revoked under
clause (ii).</DELETED>
<DELETED> (ii) Modification or revocation of
general or specific authorizations.--The
Secretary may, at any time, modify, suspend, or
revoke a general or specific authorization
described in clause (i) if the Secretary--
</DELETED>
<DELETED> (I) determines that the
authorization no longer satisfies the
requirements of subparagraph (A)(i);
and</DELETED>
<DELETED> (II) provides the public
with an opportunity to comment before
modifying, suspending, or revoking the
authorization.</DELETED>
<DELETED> (2) Publication of list of authorized items.--
</DELETED>
<DELETED> (A) In general.--The Secretary shall
publish, pursuant to section 553 of title 5, United
States Code, and maintain a list of the items the
importation, manufacture, sale, resale, or introduction
into interstate commerce in the United States of which
is authorized under paragraph (1). The initial such
list shall be published not later than January 1,
2027.</DELETED>
<DELETED> (B) Inclusions.--</DELETED>
<DELETED> (i) In general.--To the extent
possible, the Secretary shall include, in the
list required by subparagraph (A), the
manufacturer and product name for each item on
the list.</DELETED>
<DELETED> (ii) Other identifying
characteristics.--When it is not possible to
include, in the list required by subparagraph
(A), the manufacturer and product name for an
item, the Secretary shall provide technical
criteria sufficient to enable the automotive
industry and importers to determine without
undue difficulty whether the importation,
manufacture, sale, resale, or introduction into
interstate commerce in the United States of an
item is authorized under paragraph (1). In
carrying out this clause, the Secretary shall
protect intellectual property to the extent
practicable.</DELETED>
<DELETED> (iii) Risk assessment.--To the
extent possible, the Secretary shall include,
in the list required by subparagraph (A), a
detailed explanation about why each item on the
list does not pose an undue risk described in
subparagraph (A) or (B) of paragraph
(1).</DELETED>
<DELETED> (3) Requests for authorization.--Not later than
January 1, 2027, the Secretary shall establish a procedure
pursuant to which an importer, manufacturer, supplier, or
seller or reseller may seek the authorization under paragraph
(1) of the importation, manufacture, sale, resale, or
introduction into interstate commerce in the United States of
an item described in subsection (a) that would otherwise be
subject to the prohibitions under that subsection.</DELETED>
<DELETED> (d) Rulings and Advisory Opinions.--</DELETED>
<DELETED> (1) In general.--Not later than January 1, 2027,
the Secretary shall establish a procedure pursuant to which an
importer, manufacturer, or seller or reseller may seek a
binding ruling or advisory opinion with respect to whether--
</DELETED>
<DELETED> (A) the importation, manufacture, sale,
resale, or introduction into interstate commerce in the
United States of an item is or is not prohibited under
this section; or</DELETED>
<DELETED> (B) a connected vehicle, covered software,
or connected vehicle hardware has been renamed,
rebranded, restructured, or altered to circumvent the
prohibitions under subsection (a).</DELETED>
<DELETED> (2) Timing.--The Secretary shall issue a ruling or
advisory opinion under paragraph (1) with respect to an item
not later than 45 days after receiving an application supported
by a reasonably clear description of the item.</DELETED>
<DELETED> (3) Publication.--</DELETED>
<DELETED> (A) In general.--The Secretary shall--
</DELETED>
<DELETED> (i) publish a list of the items
for which the Secretary has issued rulings and
advisory opinions under paragraph (1);
and</DELETED>
<DELETED> (ii) update that list not less
frequently than annually.</DELETED>
<DELETED> (B) Prohibition on publication of
identifying information.--The Secretary shall not
publish the name of, or other information that might
reasonably identify, the party that requested the
ruling or advisory opinion.</DELETED>
<DELETED> (4) Continued validity of existing rulings and
opinions.--Except as provided by paragraph (5), a ruling or
advisory opinion issued under this subsection or subpart D of
part 791 of title 15, Code of Federal Regulations, before
January 1, 2027, shall remain in effect.</DELETED>
<DELETED> (5) Modification or revocation.--The Secretary may
modify, suspend, or revoke any binding ruling or advisory
opinion issued under paragraph (1) or subpart D of part 791 of
title 15, Code of Federal Regulations, with respect to an item
at any time if the Secretary determines that the circumstances
that led to the ruling or opinion have changed.</DELETED>
<DELETED> (e) Declaration of Conformity.--The Secretary shall
establish a process under which a person that imports, manufactures,
sells, resells, or introduces into interstate commerce in the United
States a connected vehicle or connected vehicle hardware is required to
submit a declaration, to be known as a ``declaration of conformity'',
to the Secretary before importing, manufacturing, selling, reselling,
or introducing the vehicle or hardware that certifies that the vehicle
or hardware is not subject to a prohibition under subsection
(a).</DELETED>
<DELETED> (f) Civil Penalties.--</DELETED>
<DELETED> (1) In general.--The Secretary shall assess a
civil penalty for each transaction that is a violation of a
prohibition under subsection (a) in an amount that is not less
than the greater of--</DELETED>
<DELETED> (A) $1,500,000; or</DELETED>
<DELETED> (B) five times the value of the
transaction.</DELETED>
<DELETED> (2) Continuing violations.--In the case of a
violation that occurs on more than one day, each day on which
the violation continues shall be treated as a separate
violation.</DELETED>
<DELETED> (g) Classified Information.--The Secretary may rely on
classified information in carrying out this section, which may be
submitted to a reviewing court ex parte and in camera.</DELETED>
<DELETED> (h) Petitions for Review.--The filing in a court of a
petition for review shall not stay the effectiveness of any action
under this section unless ordered by the court.</DELETED>
<DELETED>SEC. 5. USE OF EXISTING ADVISORY BODIES; INTERAGENCY
COORDINATION.</DELETED>
<DELETED> (a) Use of Existing Advisory Bodies.--</DELETED>
<DELETED> (1) In general.--In carrying out this Act, the
Secretary may consult, as appropriate, with existing advisory
committees of the Department of Transportation and other
relevant Federal agencies, including the Advisory Committee on
Automation in Transportation, on matters relating to connected
vehicles and associated national security risks.</DELETED>
<DELETED> (2) Scope of consultation.--Consultation under
paragraph (1) may include consideration of--</DELETED>
<DELETED> (A) risks relating to data security,
cybersecurity, and supply chain integrity associated
with connected vehicles;</DELETED>
<DELETED> (B) the effectiveness of authorities and
regulations issued under this Act;</DELETED>
<DELETED> (C) emerging technologies and threat
vectors relevant to connected vehicle ecosystems;
and</DELETED>
<DELETED> (D) recommendations made to the Secretary
with respect to regulatory, enforcement, and policy
measures to mitigate risks described in subparagraph
(A).</DELETED>
<DELETED> (b) Interagency Coordination.--In carrying out this Act,
the Secretary may consult and coordinate, as appropriate, with the
Federal Communications Commission and other relevant Federal agencies
to ensure alignment with respect to the scope, timeline, and
implementation of any prohibitions or restrictions issued under this
Act, including to avoid duplicative, inconsistent, or conflicting
regulatory requirements.</DELETED>
<DELETED>SEC. 6. REPORTS.</DELETED>
<DELETED> Not later than one year after the date of the enactment of
this Act, and annually thereafter, the Secretary shall submit to
Congress a report--</DELETED>
<DELETED> (1) describing activities carried out to enforce
the prohibitions under section 4, including enforcement actions
taken and resources utilized;</DELETED>
<DELETED> (2) providing a detailed accounting of items
covered by such prohibitions during the 1-year period preceding
submission of the report;</DELETED>
<DELETED> (3) explaining any exclusions, exemptions, or
determinations made by the Secretary, including the rationale
and criteria applied;</DELETED>
<DELETED> (4) assessing the effectiveness of such
prohibitions in decreasing the threats to the economic and
national security of the United States posed by connected
vehicles;</DELETED>
<DELETED> (5) including metrics on enforcement, compliance
rates, violations identified, penalties assessed, and any
identified gaps or challenges; and</DELETED>
<DELETED> (6) making recommendations with respect to further
decreasing such threats.</DELETED>
<DELETED>SEC. 7. SEVERABILITY; REGULATORY CONTINUITY.</DELETED>
<DELETED> (a) Severability.--If any provision of this Act, or the
application of such provision to any person or circumstance, is held to
be invalid, the remainder of this Act, and the application of the
remaining provisions to any person or circumstance, shall not be
affected.</DELETED>
<DELETED> (b) Restoration of Prior Regulations.--If a court of
competent jurisdiction enters a final judgment holding invalid or
unenforceable a provision of this Act and supersedes regulations
prescribed to carry out section 4, the Secretary may, notwithstanding
any other provision of this Act, reissue or reinstate, in whole or in
part, any similar regulations that were in effect on the day before the
date of the enactment of this Act.</DELETED>
<DELETED>SEC. 8. INTERACTION WITH REGULATIONS.</DELETED>
<DELETED> (a) Rule of Construction.--Nothing in this Act shall be
construed to prohibit, limit, or otherwise affect the authority of the
Secretary of Commerce to implement or administer subpart D of part 791
of title 15, Code of Federal Regulations, as added by the final rule of
the Bureau of Industry and Security entitled ``Securing the Information
and Communications Technology and Services Supply Chain: Connected
Vehicles'' (90 Fed. Reg. 5360).</DELETED>
<DELETED> (b) Delayed Implementation for Software and Hardware Not
Covered by Regulations.--In the case of covered software and connected
vehicle hardware that is subject to a prohibition under paragraph (2)
or (3) of section 4(a) and is not subject to subpart D of part 791 of
title 15, Code of Federal Regulations, as in effect on the day before
the date of the enactment of this Act, the Secretary shall implement
the prohibition under section 4(a) after January 1, 2030, and before
January 1, 2032.</DELETED>
<DELETED> (c) Treatment of Prior Exclusions.--</DELETED>
<DELETED> (1) In general.--Subject to paragraph (2), any
exclusion or exception to a prohibition under subpart D of part
791 of title 15, Code of Federal Regulations, as in effect on
the day before the date of the enactment of this Act, shall
remain valid and shall apply to the prohibitions under section
4(a).</DELETED>
<DELETED> (2) Rulemaking.--Beginning January 1, 2030, the
Secretary shall conduct a rulemaking, pursuant to section 553
of title 5, United States Code, to determine whether exclusions
or exceptions described in paragraph (1) should be continued,
modified, or terminated for the purposes of this Act.</DELETED>
SECTION 1. SHORT TITLE.
This Act may be cited as the ``Connected Vehicle Security Act of
2026''.
SEC. 2. FINDINGS.
Congress makes the following findings:
(1) The United States automotive industry is critical to
the national economy, supporting millions of jobs, supply
chains, and advanced manufacturing. The introduction of
vehicles and components controlled by foreign adversaries
threatens the industrial competitiveness and technological
leadership of the United States.
(2) The People's Republic of China has rapidly expanded its
automotive manufacturing capacity and is increasingly targeting
export markets. Despite having the largest market in the world,
the People's Republic of China exports nearly 8,000,000
vehicles annually, approximately twice the volume exported by
any other country, demonstrating the scale at which vehicles
and components controlled by a foreign adversary may enter
global markets, including the United States.
(3) Connected vehicles incorporate advanced information and
communications technologies that collect, process, and transmit
vast amounts of sensitive data, including geolocation,
operational, and personal information, and are capable of being
remotely accessed and controlled.
(4) In Executive Order 13873 (50 U.S.C. 1701 note; relating
to securing the information and communications technology and
services supply chain), the President declared a national
emergency with respect to the threat posed by foreign
adversaries creating and exploiting vulnerabilities in
information and communications technology and services.
(5) The access, control, or influence of vehicle
connectivity systems or automated driving systems by foreign
adversaries creates substantial economic and national security
risks to the United States, including risks of surveillance,
espionage, cyber intrusion, and disruption of critical
infrastructure. Such risks fall within the scope of the
national emergency described in Executive Order 13873 and pose
an unacceptable threat to the security and resilience of the
United States.
SEC. 3. DEFINITIONS.
In this Act:
(1) Automated driving system.--The term ``automated driving
system'' means hardware and software that, collectively, are
capable of performing the entire dynamic driving task for a
connected vehicle on a sustained basis, regardless of whether
the system is limited to a specific operational design domain.
(2) Connected vehicle.--
(A) In general.--Except as provided by subparagraph
(B) or (C), the term ``connected vehicle'' means a
vehicle driven or drawn by mechanical power, regardless
of propulsion technology, and manufactured primarily
for use on public streets, roads, and highways, that
has a gross vehicle weight rating of 4,536 kilograms
(10,000 pounds) or less and--
(i) integrates onboard networked hardware
with automotive software systems to
communicate, at a radio frequency over 450
megahertz, via dedicated short-range
communication, cellular telecommunications
connectivity, satellite communication, or other
wireless spectrum connectivity with any other
network or device; or
(ii) is designed, manufactured, or equipped
to communicate as described in clause (i),
regardless of whether the capability to
communicate as described in clause (i) has been
removed before the time of importation,
manufacture, sale, resale, or introduction of
the vehicle into interstate commerce in the
United States.
(B) Exclusion.--The term ``connected vehicle'' does
not include a vehicle operated only on a rail line.
(C) Application to section 9.--In section 9, the
term ``connected vehicle'' applies without regard to
the limitation on the gross vehicle weight rating under
subparagraph (A).
(3) Covered country.--The term ``covered country'' means--
(A) the Democratic People's Republic of North
Korea;
(B) the People's Republic of China;
(C) the Russian Federation; and
(D) the Islamic Republic of Iran.
(4) Covered software.--
(A) In general.--Except as otherwise provided in
this paragraph, the term ``covered software'' means a
software-based component, including any application,
middleware, system software, and any machine-learning
model or other artificial intelligence component, that
is installed in or on a connected vehicle, or designed
to be installed in or on a connected vehicle, and that
is executed by the primary processing unit or units of
an item that directly enables, at the vehicle level,
the function of a vehicle connectivity system or
automated driving system, including decision-making or
control of an automated driving system.
(B) Exclusion.--The term ``covered software'' does
not include--
(i) open-source software, unless that open-
source software has been modified for
proprietary purposes and not redistributed or
shared; or
(ii) software subcomponents that were
designed, developed, manufactured, or supplied
prior to March 17, 2026, as long as those
software subcomponents are not maintained,
augmented, or otherwise altered by a foreign
entity of concern after March 17, 2026.
(5) Electric vehicle battery.--The term ``electric vehicle
battery'' means a rechargeable battery designed to store and
supply electrical energy for the propulsion of a hybrid or
electric vehicle.
(6) Foreign entity of concern.--The term ``foreign entity
of concern'' means--
(A) any individual, wherever located, who--
(i) acts as an agent, representative, or
employee, or acts in any other capacity at the
order, request, or under the direction or
control, of a covered country or of a person
whose activities are directly or indirectly
supervised, directed, controlled, financed, or
subsidized in whole or in majority part by a
covered country; or
(ii) is a citizen or resident of a covered
country or a country controlled by a covered
country, and is not a United States citizen or
alien lawfully admitted for permanent residence
in the United States; or
(B) an entity--
(i) with a principal place of business in,
headquartered in, incorporated in, or otherwise
organized under the laws of a covered country
or a country controlled by a covered country;
(ii) that is a subsidiary or affiliate of
an entity described in clause (i); or
(iii) wherever organized or doing business,
that is owned or controlled by a covered
country, or that is subject to other
circumstances, such as through participation in
a partnership or joint venture or other formal
or informal relationship, in which an
individual described in subparagraph (A) or an
entity described in clause (i), or a
combination of such individuals or entities,
possesses the power, direct or indirect,
whether or not exercised, through--
(I) ownership of a majority or a
dominant minority of the total
outstanding voting or financial
interest in the entity, board
representation, proxy voting, a special
share, contractual arrangements, formal
or informal arrangements to act in
concert, or other means, to determine,
direct, or decide important matters
affecting the entity;
(II) with respect to an entity that
manufactures, develops, designs, or
supplies a connected vehicle, ownership
or control of more than 15 percent of
the total outstanding equity interest,
voting interest, board representation,
or other indicia of control;
(III) with respect to an entity
that manufactures, develops, designs,
or supplies covered software, ownership
or control of more than 25 percent of
the total outstanding equity interest,
voting interest, board representation,
or other indicia of control; or
(IV) with respect to an entity that
manufactures or supplies vehicle
connectivity system hardware, ownership
or control of more than 25 percent of
the total outstanding equity interest,
voting interest, board representation,
or other indicia of control.
(7) Importation.--The term ``importation'' has the meaning
given the term ``import'' in section 1001 of the Controlled
Substances Import and Export Act (21 U.S.C. 951).
(8) Resale.--
(A) In general.--The term ``resale'', with respect
to a vehicle, software, or hardware, means the
transferring of ownership of the vehicle, software, or
hardware by an individual or entity that acquired the
vehicle, software, or hardware for the purpose of
transfer in the ordinary course of business, and not
for the use of or consumption by the individual or
entity.
(B) Exclusion.--The term ``resale'' does not
include the transfer of a connected vehicle that was
previously titled or registered to, and used by, a
consumer or end-user or was acquired for bona fide use,
lease, or operation by the individual or entity that
was transferred the vehicle or by a dealer (as defined
in section 30102(a)(2) of title 49, United States
Code).
(9) Secretary.--The term ``Secretary'' means the Secretary
of Commerce, acting through the Under Secretary of Commerce for
Industry and Security.
(10) Transaction.--The term ``transaction''--
(A) means any acquisition, importation, transfer,
installation, dealing in, or use of any vehicle,
software, or hardware subject to a prohibition under
subsection (a) or (b) of section 4, including ongoing
activities, such as managed services, data
transmission, software updates, repairs, or provision
of platform services or data hosting of applications
for consumer download; and
(B) includes--
(i) any other transaction, arrangement,
practice, or course of conduct, the structure
or purpose of which is designed or intended to
evade or circumvent this Act; and
(ii) a class of transactions.
(11) Vehicle connectivity system.--The term ``vehicle
connectivity system'' means vehicle connectivity system
hardware or a covered software item installed in or on a
connected vehicle, or designed to be installed in or on a
connected vehicle, that directly enables the function of
transmission, receipt, conversion, or processing of radio
frequency communications at a frequency over 450 megahertz.
(12) Vehicle connectivity system hardware.--
(A) In general.--The term ``vehicle connectivity
system hardware''--
(i) means software-enabled or programmable
components that--
(I) are installed in or on a
connected vehicle or designed to be
installed in or on a connected vehicle;
(II) are directly connected to a
vehicle connectivity system; and
(III) directly enable the
connectivity functions of a vehicle
connectivity system or are part of an
item that directly enables the function
of a vehicle connectivity system;
(ii) includes microcontrollers,
microcomputers or modules, systems on a chip,
networking or telematics units, cellular modems
or modules, Wi-Fi microcontrollers or modules,
Bluetooth microcontrollers or modules,
satellite communication systems, other wireless
communication microcontrollers or modules,
external antennas, digital signal processors,
and field-programmable gate arrays; and
(iii) includes electronic systems
integrated into an electric vehicle battery
that directly enable or control the monitoring,
management, security, or external communication
of battery performance or operation, including
any transmitter or interface component that
performs such functions.
(B) Exclusion.--The term ``vehicle connectivity
system hardware'' does not include component parts that
do not contribute to the connectivity function of
vehicle connectivity system hardware, which may include
items such as brackets, fasteners, plastics, passive
electronics, diodes, field effect transistors, and
bipolar junction transistors.
SEC. 4. PROHIBITION ON CONNECTED VEHICLES AND OTHER TRANSACTIONS THAT
THREATEN NATIONAL SECURITY.
(a) Prohibitions.--
(1) Connected vehicles.--On and after January 1, 2027, the
importation, manufacture, sale, resale, or introduction into
interstate commerce in the United States of a connected vehicle
is prohibited if--
(A) the connected vehicle is primarily designed,
primarily developed, or manufactured in, or supplied
from, a covered country, without regard to whether--
(i) at the time of importation, sale,
resale, or introduction, the vehicle is
equipped with any covered software or vehicle
connectivity system hardware subject to a
prohibition under paragraph (2) or (3); or
(ii) any such software or hardware--
(I) is removed from the vehicle
before importation, sale, resale, or
introduction; or
(II) will be installed after
importation, sale, resale, or
introduction; or
(B) the manufacturer, developer, designer, or
supplier of the connected vehicle is a foreign entity
of concern.
(2) Covered software.--The integration of covered software
into a connected vehicle that is imported, manufactured, sold,
resold, or introduced into interstate commerce in the United
States is prohibited if--
(A) the connected vehicle into which the covered
software is integrated was manufactured for model year
2027 or later; and
(B)(i) the covered software is designed, developed,
or manufactured in, or supplied from, a covered
country; or
(ii) the manufacturer, developer, designer, or
supplier of the software is a foreign entity of
concern.
(3) Vehicle connectivity system hardware.--
(A) In general.--On and after January 1, 2030, the
integration of any vehicle connectivity system hardware
into a connected vehicle that is imported,
manufactured, sold, resold, or introduced into
interstate commerce in the United States is prohibited
if--
(i) the hardware is manufactured in, or
supplied from, a covered country; or
(ii) the manufacturer or supplier of the
hardware is a foreign entity of concern.
(B) Repair and warranty.--The prohibition under
subparagraph (A) shall not apply to vehicle
connectivity system hardware that is--
(i) integrated into a vehicle that is
manufactured for a model year before model year
2030; or
(ii) imported, manufactured, sold, resold,
or introduced into interstate commerce in the
United States for the purpose of repair, or
under warranty, for a connected vehicle of a
model year before model year 2030.
(4) Additional items.--A prohibition under paragraph (1),
(2), or (3) applies with respect to a connected vehicle,
covered software, or vehicle connectivity system hardware, as
the case may be, that is renamed, rebranded, restructured, or
altered to circumvent the prohibition.
(5) Exception.--The prohibitions under paragraphs (1), (2),
and (3) shall not apply to the importation, manufacture, sale,
resale, or introduction into interstate commerce in the United
States of a connected vehicle, covered software, or vehicle
connectivity system hardware, as the case may be, for the sole
purpose of testing and evaluation if--
(A) in the case of a connected vehicle, the vehicle
is not intended to be driven on public roads; or
(B) in the case of a connected vehicle, covered
software, or vehicle connectivity system hardware, the
testing or evaluation is by--
(i) an entity that--
(I) is organized under the laws of
a State in the United States;
(II) does not have its principal
place of business in a covered country;
and
(III) is not a foreign entity of
concern; or
(ii) a Federal agency.
(6) Treatment of individuals.--For purposes of this
subsection, a connected vehicle, covered software, or vehicle
connectivity system hardware shall not be considered to be
designed, developed, manufactured in, or supplied by a foreign
entity of concern based solely on the country of citizenship of
one or more individuals who are employed by, contracted by, or
otherwise similarly engaged in design, development,
manufacturing, or supply activities through an entity that is
not a foreign entity of concern.
(b) Related Transactions.--
(1) In general.--The Secretary shall prescribe regulations,
pursuant to section 553 of title 5, United States Code, to
prohibit any specific transaction relating to connected
vehicles, including the importation into the United States,
sale, distribution, integration, or use of a connected vehicle,
covered software, or vehicle connectivity system hardware, that
the Secretary determines poses an undue or unacceptable threat
to the national security of the United States.
(2) Notice.--If the Secretary prohibits a transaction under
paragraph (1), the Secretary shall deliver, by certified United
States mail, to the parties to the transaction a notice of the
prohibition that includes an identification, by name, of the
specific vehicle, software, or hardware that the Secretary
determines poses an undue or unacceptable threat to the
national security of the United States.
(c) Authorizations.--
(1) Issuance.--
(A) In general.--The Secretary may issue a general
or specific authorization for the importation,
manufacture, sale, resale, or introduction into
interstate commerce in the United States of a connected
vehicle, covered software, or vehicle connectivity
system hardware that would otherwise be subject to a
prohibition under subsection (a) if--
(i) the Secretary determines that the
importation, manufacture, sale, resale, or
introduction of the vehicle, software, or
hardware does not pose, and is not reasonably
likely to pose--
(I) an undue risk of data
exfiltration from, or remote
manipulation or operation of, a
connected vehicle;
(II) a risk to critical
infrastructure of the United States; or
(III) any other risk to the
national security of the United States;
(ii) upon issuing an authorization under
this subparagraph, the Secretary submits to
Congress a detailed written notification that--
(I) includes the determination
under clause (i) and the underlying
analysis, including a written risk
assessment, that supports that
determination; and
(II) redacts confidential business
information and other sensitive
proprietary information; and
(iii) in the case of an authorization
issued on or after January 1, 2030, there is
not enacted into law a joint resolution of
disapproval with respect to the authorization.
(B) Limited authority for certain entities.--The
Secretary may not issue a general or specific
authorization under subparagraph (A) to import,
manufacture, sell, resell, or introduce into interstate
commerce in the United States a connected vehicle
otherwise subject to the prohibition under subsection
(a)(1) to an entity with a principal place of business
in, headquartered in, incorporated in, or otherwise
organized under the laws of a covered country or that
is a subsidiary or affiliate of such an entity, unless
the entity--
(i) is selling passenger vehicles in the
United States as of the date of the enactment
of this Act; and
(ii) has been manufacturing passenger
vehicles in the United States for not less than
5 years before such date of enactment.
(C) Continued validity and modification and
revocation of authorizations.--
(i) Continued validity of authorizations
under regulations.--Except as provided by
clause (iii), any general or specific
authorization issued under subpart D of part
791 of title 15, Code of Federal Regulations,
before the date of the enactment of this Act
shall remain in effect until the earlier of--
(I) the date specified in the terms
of the authorization; or
(II) January 1, 2030.
(ii) Expiration of authorizations issued
before january 1, 2030.--Except as provided by
clause (iii), any general or specific
authorization issued under subparagraph (A)
after the date of the enactment of this Act and
before January 1, 2030, shall remain in effect
until the earlier of--
(I) the date specified in the terms
of the authorization; or
(II) January 1, 2030.
(iii) Modification or revocation of general
or specific authorizations.--The Secretary may,
at any time, modify, suspend, or revoke a
general or specific authorization described in
clause (i) or issued under subparagraph (A) if
the Secretary determines that the authorization
no longer satisfies the requirements of
subparagraph (A)(i).
(iv) Publication required.--Not later than
January 1, 2027, the Secretary shall publish a
list of all general or specific authorizations
issued under subpart D of part 791 of title 15,
Code of Federal Regulations, before the date of
the enactment of this Act.
(2) Publication of authorizations.--
(A) In general.--The Secretary shall publish and
maintain a list of all general and specific
authorizations issued under paragraph (1)(A) after the
date of the enactment of this Act.
(B) Initial list.--The initial list required by
subparagraph (A) shall be published not later than
January 1, 2027.
(C) Inclusions.--
(i) In general.--To the extent possible,
the Secretary shall include in the list
required by subparagraph (A) the manufacturer
and product name for the connected vehicles,
covered software, and vehicle connectivity
system hardware on the list.
(ii) Risk assessment.--To the extent
possible, the Secretary shall include in the
list required by subparagraph (A) a detailed
explanation about why the connected vehicles,
covered software, and vehicle connectivity
system hardware on the list do not pose any of
the risks described in paragraph (1)(A)(i).
(3) Identification of trusted suppliers.--
(A) In general.--The Secretary shall create and
maintain a list of trusted entities that supply
connected vehicles, covered software, vehicle
connectivity systems, and vehicle connectivity system
hardware.
(B) Determination.--The Secretary may determine an
entity is a trusted supplier for purposes of
subparagraph (A) if the entity does not pose an undue
or unacceptable national security risk.
(4) Protection of confidential business information.--The
Secretary shall establish a robust process to redact
confidential business information and other sensitive
information from publication in the lists required by
paragraphs (1)(C)(iv) and (2).
(5) Procedures for authorization.--Not later than January
1, 2027, the Secretary shall establish a procedure pursuant to
which--
(A) an importer, manufacturer, supplier, or seller
or reseller may seek the authorization under paragraph
(1) of the importation, manufacture, sale, resale, or
introduction into interstate commerce in the United
States of connected vehicles, covered software, or
vehicle connectivity system hardware that would
otherwise be subject to a prohibition under subsection
(a); and
(B) the Secretary may issue such an authorization
on the Secretary's own initiative.
(d) Advisory Opinions.--
(1) In general.--Not later than January 1, 2027, the
Secretary shall establish a procedure pursuant to which an
importer, manufacturer, or seller or reseller may seek an
advisory opinion with respect to whether--
(A) the importation, manufacture, sale, resale, or
introduction into interstate commerce in the United
States of a connected vehicle, covered software, or
vehicle connectivity system hardware is or is not
prohibited under this section; or
(B) a connected vehicle, covered software, or
vehicle connectivity system hardware has been renamed,
rebranded, restructured, or altered to circumvent the
prohibitions under subsection (a).
(2) Timing.--
(A) In general.--The Secretary shall issue an
advisory opinion under paragraph (1) with respect to a
connected vehicle, covered software, or vehicle
connectivity system hardware not later than 45 days
after receiving an application for such an advisory
opinion that is supported by a reasonably clear
description of the vehicle, software, or hardware, as
the case may be.
(B) Failure to issue.--If the Secretary fails to
issue an advisory opinion within the 45-day period
described in subparagraph (A), the Secretary shall
notify the relevant committees of Congress (including,
at a minimum, the Committee on Energy and Commerce of
the House of Representatives and the Committee on
Commerce, Science, and Transportation of the Senate) of
that failure not later than 7 days after the 45-day
period has elapsed.
(C) Exclusion.--This paragraph shall not apply in
any case in which an applicant under subparagraph (A)
has not made good faith efforts to provide prompt
responses to inquiries or requests for additional
information or materials from the Secretary that are
necessary for the consideration of the application.
(3) Publication.--
(A) In general.--The Secretary shall--
(i) publish a list of all connected
vehicles, covered software, and vehicle
connectivity system hardware for which the
Secretary has issued advisory opinions under
paragraph (1); and
(ii) update that list not less frequently
than annually.
(B) Prohibition on publication of identifying
information.--The Secretary shall not publish the name
of, or other information that might reasonably
identify, the party that requested the advisory opinion
under paragraph (1).
(4) Continued validity of existing advisory opinions.--
Except as provided by paragraph (5), an advisory opinion issued
under this subsection or subpart D of part 791 of title 15,
Code of Federal Regulations, before January 1, 2027, shall
remain in effect.
(5) Modification or revocation.--The Secretary may modify,
suspend, or revoke any advisory opinion issued under paragraph
(1) or subpart D of part 791 of title 15, Code of Federal
Regulations, at any time if the Secretary determines that the
circumstances that led to the opinion have changed.
(e) Declaration of Conformity.--The Secretary shall establish a
process requiring a person, before importing, manufacturing, selling,
reselling, or introducing into interstate commerce in the United States
a connected vehicle, covered software, or vehicle connectivity system
hardware, to submit to the Secretary a declaration, to be known as a
``declaration of conformity'', that certifies that the vehicle,
hardware, or incorporated covered software is not subject to a
prohibition under subsection (a).
(f) Safe Harbor.--The Secretary shall prescribe regulations
establishing a safe harbor period of one year during which a person may
cure a violation of subsection (a). During that period, civil penalties
shall not accrue with respect to the violation if the person--
(1) promptly upon discovery discloses the violation to the
Bureau of Industry and Security and diligently undertakes all
legally available remedial measures;
(2) cooperates with the Bureau and provides all reasonably
available information it is legally permitted to provide that
the Secretary may require to verify the violation and the cure;
(3) completes the cure within the period prescribed by the
Secretary, including by submitting any corrected declaration of
conformity or obtaining any authorization, ruling, or advisory
opinion required by this section; and
(4) did not engage in willful misconduct, knowing
violation, fraud, material misrepresentation, or conduct
intended to evade or circumvent this section.
(g) Civil Penalties.--
(1) In general.--Except as provided by paragraph (3), the
Secretary shall assess a civil penalty for each transaction
that is a violation of a prohibition under subsection (a) in an
amount that is not less than the greater of--
(A) $1,500,000; or
(B) five times the value of the transaction.
(2) Continuing violations.--In the case of a violation that
occurs on more than one day, each day on which the violation
continues shall be treated as a separate violation.
(3) Exception.--A civil penalty shall not apply under
paragraph (1) in a case in which an individual transports a
vehicle into the United States in violation of a prohibition
under subsection (a) if--
(A) the vehicle is owned, leased, rented, or
otherwise in the possession of the individual for
personal use; and
(B) the individual does not know that the vehicle,
or covered software or vehicle connectivity system
hardware integrated into the vehicle, is subject to the
prohibition.
(h) Classified Information.--The Secretary may rely on classified
information in carrying out this section, which may be submitted to a
reviewing court ex parte and in camera.
(i) Petitions for Review.--The filing in a court of a petition for
review shall not stay the effectiveness of any action under this
section unless ordered by the court.
SEC. 5. USE OF EXISTING ADVISORY BODIES; INTERAGENCY COORDINATION.
(a) Use of Existing Advisory Bodies.--
(1) In general.--In carrying out this Act, the Secretary
may consult, as appropriate, with existing advisory committees
of the Department of Transportation and other relevant Federal
agencies on matters relating to connected vehicles and
associated national security risks.
(2) Scope of consultation.--Consultation under paragraph
(1) may include consideration of--
(A) risks relating to data security, cybersecurity,
and supply chain integrity associated with connected
vehicles;
(B) the effectiveness of authorities and
regulations issued under this Act;
(C) emerging technologies and threat vectors
relevant to connected vehicle ecosystems; and
(D) recommendations made to the Secretary with
respect to regulatory, enforcement, and policy measures
to mitigate risks described in subparagraph (A).
(b) Interagency Coordination.--In carrying out this Act, the
Secretary may consult and coordinate, as appropriate, with the Federal
Communications Commission and other relevant Federal agencies to ensure
alignment with respect to the scope, timeline, and implementation of
any prohibitions or restrictions issued under this Act, including to
avoid duplicative, inconsistent, or conflicting regulatory
requirements.
SEC. 6. REPORTS.
Not later than one year after the date of the enactment of this
Act, and annually thereafter, the Secretary shall submit to Congress a
report, which may contain a classified annex--
(1) describing activities carried out to enforce the
prohibitions under section 4, including enforcement actions
taken and resources utilized;
(2) providing a detailed accounting of connected vehicles,
covered software, and vehicle connectivity system hardware
covered by such prohibitions during the one-year period
preceding submission of the report;
(3) explaining any exclusions, exemptions, or
authorizations made by the Secretary, including the rationale
and criteria applied;
(4) assessing the effectiveness of such prohibitions in
decreasing the threats to the national security of the United
States posed by connected vehicles;
(5) including metrics on enforcement, compliance rates,
violations identified, penalties assessed, and any identified
gaps or challenges; and
(6) making recommendations with respect to further
decreasing such threats.
SEC. 7. REPORT ON AUTOMOTIVE SUPPLY CHAIN RESILIENCY AND SECURITY.
(a) In General.--Not later than 18 months after the date of the
enactment of this Act, the Secretary shall submit to Congress a report
assessing the resilience and security of supply chains critical to the
United States automotive sector.
(b) Elements.--The report required by subsection (a) may--
(1) identify the segments, materials, components, and
technologies within the automotive supply chain that are most
dependent on a covered country;
(2) assess the extent to which the dependencies identified
under paragraph (1) pose significant risk to the economic or
national security of the United States; and
(3) recommend specific policies and measures to support the
development and expansion of supply chains outside of covered
countries for the dependencies identified under paragraph (2)
that pose the most significant risk to the economic or national
security of the United States.
(c) Considerations.--In identifying segments, materials,
components, and technologies within the automotive supply chain under
subsection (b)(1), the Secretary may consider--
(1) safety equipment;
(2) hardware or software that enables the transmission,
receipt, conversion, or processing of automotive sensing (such
as LiDAR, radar, video, or ultrawideband);
(3) electric vehicle batteries;
(4) smart glass, antenna glass, and other electronically
controlled automotive glass that directly enables the
transmission, receipt, conversion, or processing of radio
frequency communications; and
(5) any other segments, materials, components,
technologies, hardware, or software identified by the
Department of Commerce for consideration during the process of
promulgating subpart D of part 791 of title 15, Code of Federal
Regulations.
(d) Use of Existing Information.--In preparing the report required
by subsection (a), the Secretary shall, to the maximum extent
practicable, utilize existing analyses, assessments, reports, data, and
other relevant information available to the Department of Commerce or
another Federal department or agency to avoid unnecessary duplication
of effort.
SEC. 8. REPORT ON CONSUMER EDUCATION OF DEFECTIVE CHINESE AIR BAGS AND
AIR BAG COMPONENTS.
(a) Definitions.--In this section:
(1) Auction company.--The term ``auction company'' means a
person taking possession of a motor vehicle owned by another to
sell at an auction.
(2) Dealer.--The term ``dealer'' means a person that sold
at least 5 motor vehicles during the prior 12 months to buyers
that in good faith bought the vehicles other than for resale.
(3) Distributor.--The term ``distributor'' means a person
that sold at least 5 motor vehicles during the prior 12 months
for resale.
(4) Passenger car.--The term ``passenger car'' means a
motor vehicle with motive power, except a low-speed vehicle,
multipurpose passenger vehicle, motorcycle, or trailer,
designed for carrying 10 persons or less.
(5) Title.--The term ``title'' means the certificate of
title or other document issued by the State indicating
ownership.
(b) In General.--Not later than one year after the date of the
enactment of this Act, the Secretary of Transportation shall submit to
Congress a report identifying opportunities to inform buyers of
passenger cars if the original air bag on the passenger car has been
replaced, and could have been replaced with a defective Chinese air bag
or defective Chinese air bag component.
(c) Elements.--The report required under subsection (b) shall--
(1) identify sources of available information on a
passenger car's air bag deployment and replacement, such as a
title, a vehicle history report, or other sources;
(2) determine which sellers of passenger cars, such as
dealers, distributors, and auction companies, have access to
available information identified under paragraph (1), and
identify opportunities for passenger car sellers to inform
potential buyers of information on the passenger car's air bag
deployment and replacement;
(3) identify options to encourage dealers, distributors,
auction companies, and buyers to have passenger cars inspected
to determine if an air bag was replaced with a defective air
bag as identified by the National Highway Traffic Safety
Administration; and
(4) recommend specific actions that could be taken to
notify potential buyers of passenger cars if the car's air bag
was replaced, and could have air bag components identified as
defective by the National Highway Traffic Safety
Administration.
(d) Coordination With Other Relevant Agencies.--In preparing the
report required under subsection (b), the Secretary of Transportation
shall, to the maximum extent practicable, coordinate with the Federal
Trade Commission, the Department of Homeland Security, and any other
Federal department or agency involved in identifying passenger cars
with defective air bags or, more generally, informing buyers of
passenger car components and condition.
SEC. 9. REGULATIONS.
Not later than December 31, 2028, the Secretary shall issue or
amend final regulations, pursuant to section 553 of title 5, United
States Code, including by amending regulations issued under subpart D
of part 791 of title 15, Code of Federal Regulations, or successor
regulations, to establish prohibitions and requirements applicable to
connected vehicles with a gross vehicle weight rating greater than
4,536 kilograms (10,000 pounds), consistent with the authorities and
requirements under this Act. Such prohibitions and requirements shall
take effect not later than December 31, 2032.
SEC. 10. SEVERABILITY; REGULATORY CONTINUITY.
(a) Severability.--If any provision of this Act, or the application
of any such provision to any person or circumstance, is held to be
invalid, the remainder of this Act, and the application of the
remaining provisions to any person or circumstance, shall not be
affected.
(b) Restoration of Prior Regulations.--
(1) In general.--If a court of competent jurisdiction
enters a final judgment holding invalid or unenforceable a
provision of this Act or any regulations prescribed to carry
out section 4, the Secretary may, notwithstanding any other
provision of this Act, reissue or reinstate, in whole or in
part, any similar regulations that were in effect on the day
before the date of the enactment of this Act.
(2) Application of certain laws.--Reinstatement of
regulations under paragraph (1) shall not be subject to
sections 551, 553 through 559, and 701 through 706 of title 5,
United States Code.
SEC. 11. INTERACTION WITH REGULATIONS.
(a) Rule of Construction.--Nothing in this Act shall be construed
to prohibit, limit, or otherwise affect the authority of the Secretary
of Commerce--
(1) to implement or administer subpart D of part 791 of
title 15, Code of Federal Regulations, as added by the final
rule of the Bureau of Industry and Security entitled ``Securing
the Information and Communications Technology and Services
Supply Chain: Connected Vehicles'' (90 Fed. Reg. 5360);
(2) under Executive Order 13873 (50 U.S.C. 1701 note;
relating to securing the information and communications
technology and services supply chain); or
(3) under Executive Order 14034 (50 U.S.C. 1701 note;
relating to protecting Americans' sensitive data from foreign
adversaries).
(b) Delayed Implementation for Software Not Covered by
Regulations.--In the case of covered software that is subject to a
prohibition under section 4(a)(2) and is not subject to subpart D of
part 791 of title 15, Code of Federal Regulations, as in effect on the
day before the date of the enactment of this Act, the Secretary shall
not implement the prohibition with respect to such software
incorporated into connected vehicles before model year 2029.
(c) Delayed Implementation for Hardware Not Covered by
Regulations.--In the case of vehicle connectivity system hardware that
is subject to a prohibition under section 4(a)(3) and is not subject to
subpart D of part 791 of title 15, Code of Federal Regulations, as in
effect on the day before the date of the enactment of this Act, the
Secretary shall not implement the prohibition with respect to such
hardware incorporated into connected vehicles before model year 2032.
(d) Delayed Implementation for Connected Vehicles by Existing
United States Manufacturers and Operators.--
(1) In general.--Subject to paragraph (2), the prohibition
under section 4(a)(1) shall not apply with respect to a
connected vehicle of a model year before model year 2030 that
is manufactured, purchased pursuant to a master services
agreement or other similar contract executed before the date of
the enactment of this Act, or operated in a commercial fleet,
by an entity that--
(A) is selling passenger vehicles or operating a
commercial fleet of passenger vehicles in the United
States as of the date of the enactment of this Act; and
(B) has been manufacturing passenger vehicles or
operating a commercial fleet of passenger vehicles in
the United States for not less than five years before
such date of enactment.
(2) Compliance reporting.--Any entity benefitting from the
delayed implementation of section 4(a)(1) pursuant to this
subsection shall submit to the Secretary, not less frequently
than annually until the entity is in compliance with that
section, a report outlining the plan of the entity to come into
compliance by 2030. The Secretary shall protect any report
submitted under this paragraph as confidential business
information, except as otherwise required by law.
(e) Treatment of Prior Exclusions.--
(1) In general.--Subject to paragraph (2), any exclusion or
exception to a prohibition or definition under subpart D of
part 791 of title 15, Code of Federal Regulations, as in effect
on the day before the date of the enactment of this Act, shall
remain valid and shall apply to the prohibitions under section
4(a).
(2) Rulemaking.--Beginning January 1, 2030, the Secretary
shall conduct a rulemaking to determine whether exclusions or
exceptions described in paragraph (1) should be continued,
modified, or terminated for the purposes of this Act.
(f) Administrative Procedure.--Except as otherwise provided in this
Act, the functions exercised under this Act shall not be subject to
sections 551, 553 through 559, and 701 through 706 of title 5, United
States Code.
Calendar No. 671
119th CONGRESS
2d Session
S. 4429
[Report No. 119-146]
_______________________________________________________________________
A BILL
To prohibit the importation, manufacture, sale, resale, or introduction
into interstate commerce in the United States of connected vehicles and
related software and hardware associated with foreign adversaries.
_______________________________________________________________________
September 22, 2026
Reported with an amendment