S. 4429 — Connected Vehicle Security Act of 2026

This section sets forth congressional findings on the economic importance of the U.S. automotive industry; the People's Republic of China's annual export of nearly 8 million vehicles; the data collection, processing, and remote access capabilities of connected vehicles; the national emergency declared in Executive Order 13873 concerning foreign adversaries' threats to information and communications technology supply chains; and the national security risks, including surveillance, espionage, cyber intrusion, and critical infrastructure disruption, from foreign adversaries' access to vehicle connectivity or automated driving systems.

This section defines 14 terms for purposes of the Act, including "automated driving system" (i.e., hardware and software capable of performing the entire dynamic driving task for a connected vehicle); "connected vehicle" (i.e., a motor vehicle with onboard networked hardware for wireless communication, excluding rail vehicles); "connected vehicle hardware"; "country of origin" (i.e., country of manufacture or where the government owns, controls, or directs the manufacturer or supplier); "covered country" (i.e., North Korea, China, Russia, and Iran); "covered software" (i.e., software enabling vehicle connectivity or automated driving systems, including AI components); "electric vehicle"; "importation"; "resale"; "safety equipment" (i.e., air bags, inflators, and seatbelt systems); "Secretary" (i.e., Secretary of Commerce acting through the Under Secretary of Commerce for Industry and Security); "transaction" (i.e., broad activities involving prohibited items, including evasion attempts); "vehicle connectivity system"; and "vehicle connectivity system hardware" (i.e., software-enabled components enabling radio frequency communications over 450 megahertz, including microcontrollers, modems, antennas, and certain battery systems).

This section prohibits, on and after January 1, 2027, the importation, manufacture, sale, resale, or introduction into U.S. interstate commerce of (1) connected vehicles (i.e., vehicles with wireless connectivity capable of data exfiltration or remote manipulation) if from a covered nation, designed there, or manufactured by an entity with more than 15% equity, voting, board, or control interest held by a covered nation entity; and (2) integration of covered software (i.e., software performing key vehicle functions) into such vehicles if from a covered nation or developed by an entity organized there or with more than 25% such interest. It further prohibits, on and after January 1, 2030, importation, manufacture, sale, resale, or introduction of connected vehicle hardware (i.e., physical components enabling connectivity) if from a covered nation or manufactured by an entity organized there or with more than 25% such interest (except for repair or warranty on pre-model year 2030 vehicles). Prohibitions extend to renamed, rebranded, or altered items to evade them and do not apply to U.S.-based testing and evaluation; the Secretary of Commerce must regulate related transactions posing undue economic or national security risks (with notice to parties) and, in consultation with other secretaries, may authorize otherwise-prohibited items via risk assessment and 60-day advance notice if no undue risks exist.

This section authorizes the Secretary of Transportation, in carrying out this Act, to (1) consult, as appropriate, with existing advisory committees of the Department of Transportation—including the Advisory Committee on Automation in Transportation—and other federal agencies on connected vehicle national security risks, including data security, cybersecurity, supply chain integrity, emerging technologies and threats, and related regulatory or policy recommendations; and (2) consult and coordinate, as appropriate, with the Federal Communications Commission and other federal agencies to align the scope, timeline, and implementation of prohibitions or restrictions under this Act and avoid duplicative, inconsistent, or conflicting requirements.

This section directs the Secretary to submit to Congress, not later than one year after enactment of this Act and annually thereafter, a report that (1) describes activities carried out to enforce the prohibitions under section 4, including enforcement actions taken and resources utilized; (2) provides a detailed accounting of items covered by such prohibitions during the one-year period preceding submission of the report; (3) explains any exclusions, exemptions, or determinations made by the Secretary, including the rationale and criteria applied; (4) assesses the effectiveness of such prohibitions in decreasing threats to the economic and national security of the United States posed by connected vehicles; (5) includes metrics on enforcement, compliance rates, violations identified, penalties assessed, and any identified gaps or challenges; and (6) makes recommendations with respect to further decreasing such threats.

This section (1) establishes a severability clause, providing that the invalidity of any provision of the Act, or its application to any person or circumstance, does not affect the remainder of the Act or the application of the remaining provisions; and (2) authorizes the Secretary to reissue or reinstate, in whole or in part, any similar regulations in effect on the day before enactment if a court holds invalid a provision of the Act that supersedes regulations prescribed to carry out section 4.

This section establishes rules for interaction between this Act and subpart D of 15 CFR part 791, as added by the Bureau of Industry and Security final rule entitled “Securing the Information and Communications Technology and Services Supply Chain: Connected Vehicles” (90 Fed. Reg. 5360), by (1) preserving the Secretary of Commerce's authority to implement and administer that subpart; (2) delaying implementation of prohibitions under section 4(a)(2) and (3) for covered software and connected vehicle hardware not subject to the subpart as in effect before enactment until after January 1, 2030, and before January 1, 2032; and (3) maintaining the validity of prior exclusions or exceptions under the pre-enactment subpart for this Act's prohibitions, subject to a rulemaking under 5 USC 553 beginning January 1, 2030, to determine whether to continue, modify, or terminate them.