Connected Vehicle Security Act of 2026
- Sponsor
- Rep. Moolenaar, John R. [R-MI-2]
- Committees
- Foreign Affairs Committee (primary)
- Last action
- May 11, 2026
Bottom line
The bill aims to bolster U.S. national and economic security by restricting the presence of connected vehicles and their components linked to foreign adversaries in the domestic market, citing risks of surveillance, espionage, and critical infrastructure disruption.
What it actually does
This bill prohibits the importation, manufacture, sale, resale, or introduction into interstate commerce in the United States of connected vehicles, their software, and hardware if they originate from or are controlled by entities in covered countries such as China, Russia, North Korea, and Iran. It establishes phased implementation dates for these prohibitions, starting January 1, 2027, for vehicles and software, and January 1, 2030, for hardware, while also creating processes for authorizations and advisory opinions.
Proponents argue
Proponents argue that the bill is essential to protect the United States from significant national security and economic risks posed by foreign adversaries' access to and control over connected vehicle technology. They contend that connected vehicles collect vast amounts of sensitive data and can be remotely manipulated, making them a vector for surveillance, cyber intrusion, and disruption of critical infrastructure, thereby necessitating proactive measures to secure the automotive supply chain.
Opponents contend
Critics might argue that the bill's broad prohibitions could lead to substantial disruptions in the global automotive supply chain, potentially increasing costs for manufacturers and consumers, and limiting innovation. Concerns could also be raised about the practical challenges of tracing complex supply chains to determine 'country of origin' or 'control,' and whether the thresholds for foreign ownership are appropriately set to avoid unintended impacts on legitimate international partnerships.
The bill is moderately complex due to technical definitions and phased implementation, requiring a dedicated read of about 15-20 minutes to grasp its full implications, which is reasonable for its scope.
Section 4(a)(1)
Prohibition on Connected Vehicles from Covered Countries
Beginning January 1, 2027, this provision prohibits the importation, manufacture, sale, resale, or introduction into U.S. interstate commerce of connected vehicles if their country of origin is a covered country (China, Russia, North Korea, Iran) or if they were designed in such a country. It also applies if the vehicle's manufacturer is more than 15% owned or controlled by an entity from a covered country, regardless of whether specific software or hardware components are present at the time of transaction.
Supporters argue
Proponents argue this prohibition is a critical first step to prevent foreign adversaries from gaining a foothold in the U.S. connected vehicle market, thereby safeguarding national security, economic competitiveness, and sensitive data from potential exploitation.
Critics contend
Critics might contend that a blanket prohibition based on country of origin or a relatively low ownership threshold (15%) could be overly broad, potentially disrupting established global supply chains and limiting consumer choice without sufficient evidence of direct threat from every vehicle or manufacturer meeting these criteria.
Tradeoffs
This provision balances the imperative of national security against potential economic disruption and the complexities of global automotive manufacturing. It aims for a strong preventative measure but risks broad market impacts.
Section 4(a)(2)
Prohibition on Covered Software from Covered Countries
Effective January 1, 2027, this section prohibits the integration of 'covered software' into connected vehicles destined for the U.S. market if the software's country of origin is a covered country, or if its developer is organized in or has its principal place of business in a covered country, or is more than 25% controlled by such an entity. Covered software includes application, middleware, system software, and AI/machine-learning models that enable vehicle connectivity or automated driving systems.
Section 4(a)(3)
Prohibition on Connected Vehicle Hardware from Covered Countries
Starting January 1, 2030, this provision prohibits the importation, manufacture, sale, resale, or introduction into U.S. interstate commerce of 'connected vehicle hardware' if its country of origin is a covered country or its manufacturer is organized in or controlled by an entity from a covered country (with a >25% control threshold). This hardware includes components like microcontrollers, modems, wireless communication modules, and even safety equipment. An exception is made for hardware used for repair or warranty purposes on vehicles with a model year before 2030.
Section 4(c)
Authorization Process for Otherwise Prohibited Items
The Secretary of Commerce, in consultation with other federal agencies (Defense, Transportation, State, Energy), may issue authorizations for items that would otherwise be prohibited. Such authorizations require clear and convincing evidence and a written risk assessment demonstrating no undue risk of data exfiltration, remote manipulation, critical infrastructure threat, or national security risk. Congress must be notified 60 days prior, and a joint resolution of disapproval can block the authorization. The Secretary must publish a list of authorized items and establish a procedure for authorization requests by January 1, 2027.
Section 4(f)
Civil Penalties for Violations
This section mandates civil penalties for each violation of the prohibitions under subsection (a). The penalty amount must be at least the greater of $1,500,000 or five times the value of the transaction. For continuing violations, each day the violation persists is treated as a separate offense.
Section 8
Interaction with Existing Regulations and Phased Implementation
This section clarifies that the Act does not limit the Secretary of Commerce's authority under existing regulations (Subpart D of Part 791 of Title 15, Code of Federal Regulations, related to connected vehicles). It also specifies delayed implementation for covered software and hardware not already subject to these existing regulations, with prohibitions taking effect between January 1, 2030, and January 1, 2032. Furthermore, existing exclusions or exceptions under the prior regulations remain valid, but the Secretary must conduct a rulemaking starting January 1, 2030, to review their continuation, modification, or termination for the purposes of this Act.
The definition of 'vehicle connectivity system hardware' explicitly includes 'safety equipment,' such as air bags, air bag inflators, and seatbelt systems. This means these critical safety components, if they are directly connected to a vehicle connectivity system and enable its function, would be subject to the prohibition on hardware from covered countries starting January 1, 2030.
Section 3(14)(B)(iii)
Why it matters:This inclusion might be a deliberate attempt to ensure comprehensive security, recognizing that even seemingly non-communicative components can be compromised if integrated into a connected system. It could also be a standard legislative practice to ensure all relevant parts are covered, but its specific mention highlights a potentially overlooked impact.
Case for: Proponents would argue that modern vehicle safety systems are increasingly integrated with electronic controls and communication networks, making them potential vectors for cyberattacks or remote manipulation. Including them ensures a holistic approach to securing the entire connected vehicle ecosystem, preventing adversaries from exploiting any part of the vehicle's critical functions.
Case against: Critics might argue that prohibiting safety-critical components based on country of origin could severely disrupt the supply of essential parts, potentially leading to vehicle production delays, increased costs, or even safety compromises if alternative suppliers are not readily available or certified. They might contend that the direct security risk from a simple airbag inflator, for example, is minimal compared to a telematics unit.
Estimated impact: Potentially significant impact on the global supply chain for automotive safety components, requiring major re-sourcing and qualification efforts for manufacturers by 2030.
The definition of 'transaction' is exceptionally broad, encompassing not only the initial acquisition, importation, transfer, installation, dealing in, or use of prohibited items, but also 'ongoing activities, such as managed services, data transmission, software updates, repairs, or the platforming or data hosting of applications for consumer download.' It also explicitly includes any transaction designed or intended to evade or circumvent the Act.
Section 3(12)
Why it matters:The broad definition is likely intended to create a comprehensive enforcement net, preventing circumvention through service agreements or post-sale activities. This is standard legislative practice for anti-evasion measures in complex regulatory fields.
Case for: Proponents would argue that a narrow definition of 'transaction' would create significant loopholes, allowing foreign adversaries to maintain influence or access through ongoing services even if the initial vehicle or component is prohibited. This broad scope ensures the intent of the Act is fully realized.
Case against: Critics might contend that such a broad definition could create an undue compliance burden for service providers, software developers, and data hosts who may not have direct control over the origin of every component or software in a connected vehicle. It could also lead to complex legal interpretations regarding what constitutes 'evasion.'
Estimated impact: Significant impact on the entire ecosystem of connected vehicle services, requiring all service providers, software update mechanisms, and data hosts to ensure compliance with the prohibitions.
The bill establishes different thresholds for foreign adversary control: connected vehicles are prohibited if the manufacturer is more than 15% owned or controlled by an entity from a covered country, whereas covered software and connected vehicle hardware are prohibited if their developer/manufacturer is more than 25% owned or controlled by such an entity.
Section 4(a)(1)(B) vs. Section 4(a)(2)(B)(ii) and 4(a)(3)(A)(ii)(II)
Why it matters:The distinction in thresholds likely reflects a legislative judgment about the relative ease of influence or control over different parts of the supply chain, or the perceived risk level. A lower threshold for the final product (the vehicle) might be intended to cast a wider net for the most visible and integrated component.
Case for: Proponents would argue that the lower 15% threshold for the entire connected vehicle reflects the heightened national security risk associated with the complete system, which integrates all components and collects comprehensive data. The slightly higher 25% for individual software and hardware components acknowledges the complexities of global component sourcing while still maintaining a strong control measure.
Case against: Critics might argue that these differing thresholds create unnecessary complexity and potential confusion for multinational corporations trying to comply. They could also contend that even a 15% ownership threshold is exceptionally low for triggering a full prohibition, potentially impacting companies with minor foreign investment that pose no actual security threat.
Estimated impact: Impacts the structure of foreign investment and joint ventures in the automotive sector, requiring careful scrutiny of ownership stakes for both vehicle manufacturers and component/software developers.