Connected Vehicle Security and Trade Controls

Full Title:
Connected Vehicle Security Act of 2026

Summary#

This bill would bar many connected vehicles, and the software and hardware that make them connected, from U.S. commerce when those items are tied to certain foreign countries. The main goal is to reduce economic and national security risks from vehicle systems that can send, receive, or be remotely controlled.

  • Main change: From January 1, 2027, the import, manufacture, sale, resale, or introduction into interstate commerce of connected vehicles (and certain covered software) is prohibited when the vehicle, software, or its maker has specified ties to North Korea, China, Russia, or Iran. Connected vehicle hardware is similarly prohibited starting January 1, 2030.
  • Who sets rules: The Secretary of Commerce (through the Under Secretary for Industry and Security) will implement the bans, publish lists of authorized items, and create processes for authorizations, rulings, and declarations of conformity.
  • Exceptions: Narrow testing and evaluation exceptions for U.S. entities, repair and warranty exceptions for hardware used on vehicles older than model year 2030, and the Secretary may grant authorizations after a written risk assessment and a 60‑day notice to Congress.
  • Enforcement tools: Civil penalties of at least $1.5 million or five times the transaction value per violation; each day of continued violation counts separately.
  • Administrative duties: The Secretary must publish an initial list of authorized items by January 1, 2027, establish a ruling/advisory process, require declarations of conformity, and send annual reports to Congress.

What it means for you#

  • Consumers / Car buyers
    • Cars made in or designed in North Korea, China, Russia, or Iran would be banned from U.S. commerce after Jan 1, 2027 in many cases. The ban applies even if connectivity features are turned off or removed.
    • Used consumer-owned cars transferred after personal use are excluded from the resale prohibition (so ordinary private used-car sales are generally not covered).
  • Automakers and importers
    • Must check country-of-origin and ownership ties for vehicles, software, and hardware. They must submit a declaration of conformity before selling or importing covered items.
    • Vehicles manufactured by companies more than 15% owned or controlled by entities in a covered country would be banned under the vehicle rule. Higher ownership thresholds apply for software and hardware rules.
    • Can seek authorizations, binding rulings, or advisory opinions from Commerce to allow specific items.
  • Software developers and suppliers
    • Software developed in or tied to a covered country, or developed by companies more than 25% owned or controlled by such entities, would be banned from integration into U.S. vehicles after Jan 1, 2027.
    • Machine learning models or AI that enable vehicle-level control are treated as covered software.
  • Parts suppliers, repair shops, and warranty providers
    • New connected vehicle hardware from covered countries would be barred starting Jan 1, 2030.
    • Parts imported for repair or warranty work on vehicles with model years before 2030 are exempt from the hardware ban.
  • Dealers and resellers
    • Resale by businesses that buy to resell is covered by the ban, but transfers of previously titled consumer vehicles are excluded.
  • Testing labs and researchers
    • U.S.-based entities not controlled by covered-country interests may import or use banned items solely for testing and evaluation under narrow conditions.
  • Other governments or agencies
    • The bill does not specifically change purchase rules for federal agencies beyond the Commerce Secretary’s authorities and processes described.

Expenses#

No publicly available information.

Possible cost and financial effects noted in the bill or likely from its design include:

  • Compliance costs for the Department of Commerce to run authorization, ruling, and enforcement programs (staffing, technical review, and rulemaking).
  • Costs for automakers, importers, and suppliers to document supply chains, submit declarations, and seek rulings or authorizations.
  • Potential enforcement revenue from civil penalties, though the bill does not estimate amounts or how fines would be used.
  • Possible industry costs from needing to redesign supply chains, switch suppliers, or substitute components not tied to covered countries.
  • The bill requires annual reports to Congress, which implies ongoing administrative costs.

Proponents' View#

  • The bill appears intended to reduce risks that connected vehicle systems could be used for surveillance, data theft, remote control, or disruption of infrastructure by foreign adversaries.
  • It could strengthen U.S. economic and industrial security by limiting entry of vehicles, software, or hardware controlled by listed foreign countries.
  • The staged approach (software and vehicles first, hardware later) could give industry time to adjust supply chains.
  • The authorization and ruling processes provide a path for specific items to be allowed after a written risk assessment, which could enable necessary trade when risk is shown to be low.
  • Narrow testing, repair, and warranty exceptions aim to limit harm to research and to owners of older vehicles.

Opponents' View#

  • One concern is uncertainty in definitions such as “country of origin,” “designed within,” and how ownership or control is measured across complex global supply chains. This may make compliance difficult.
  • The bans could disrupt automotive supply chains and raise costs for manufacturers, dealers, and consumers if large suppliers or components are affected.
  • The later start date for hardware (2030) and the delayed implementation clause for items not already covered by a referenced regulation create complexity about timing and enforcement.
  • The civil penalties are large per violation, which could create heavy financial risk for companies that misinterpret the rules.
  • It is unclear how the Secretary will balance national security reviews with industry needs, and how transparent the risk assessments and authorization decisions will be in practice.
  • No public cost estimate is provided, so the budget impact on federal agencies and the wider economic effect are not clear.