What changed between these versions
A complete substitute amendment, v2 fundamentally restructures the prohibitions on connected vehicles and related components from foreign adversaries. It introduces a detailed 'foreign entity of concern' definition, refines the scope of 'connected vehicle' to focus on lighter vehicles, adds new safe harbor and individual exceptions, and mandates new reports on supply chain resiliency and defective airbags.
Overview
Extensive changes throughout the bill, indicating a comprehensive rewrite rather than minor adjustments. · v2 fundamentally restructures the regulatory framework, clarifying definitions, introducing new compliance mechanisms, and expanding reporting requirements, while narrowing the immediate scope of 'connected vehicle' prohibitions for certain vehicle types and providing delayed implementation for others.
The most significant change is the replacement of v1's entire operative text with a complete substitute amendment in v2. This includes the introduction of a new, comprehensive 'foreign entity of concern' definition that underpins the prohibitions, replacing simpler 'country of origin' and direct ownership criteria. The scope of 'connected vehicle' is refined, new safe harbor provisions and exceptions for individuals are added, and new reporting requirements regarding supply chain resiliency and defective airbags are introduced. While the core intent to prohibit foreign adversary-linked vehicles remains, the mechanisms and scope are substantially altered.
Major additions
This new subparagraph clarifies that the definition of 'connected vehicle' in Section 9 (which mandates regulations for heavy vehicles) applies without the gross vehicle weight rating limitation specified in Section 3(2)(A).
This addition ensures that while the primary prohibitions in Section 4 focus on lighter connected vehicles, the Secretary retains the authority to regulate heavier connected vehicles through future rulemaking, thereby extending the bill's potential reach to commercial fleets and other large vehicles.
This new definition explicitly defines 'electric vehicle battery' as a rechargeable battery designed to store and supply electrical energy for the propulsion of a hybrid or electric vehicle.
The introduction of this definition is significant because 'electric vehicle battery' is subsequently included in the definition of 'vehicle connectivity system hardware' in Section 3(12)(A)(iii), bringing certain battery components under the scope of prohibitions if they are linked to foreign entities of concern.
This new, extensive definition establishes 'foreign entity of concern' as a central concept. It includes individuals acting as agents or residents of covered countries (unless US citizens/residents) and entities with principal places of business in covered countries, subsidiaries, or entities with specific ownership/control thresholds by covered countries (e.g., >15% for connected vehicles, >25% for software/hardware).
This definition is foundational to v2's prohibitions, replacing v1's simpler 'country of origin' and direct ownership percentage criteria. It provides a more detailed and potentially broader framework for identifying entities subject to the bill's restrictions, significantly impacting how manufacturers and suppliers are assessed for compliance.
This new paragraph clarifies that a connected vehicle, covered software, or vehicle connectivity system hardware is not considered to be designed, developed, manufactured in, or supplied by a foreign entity of concern based solely on the country of citizenship of individuals employed by an entity that is not itself a foreign entity of concern.
This provision offers a crucial clarification for entities operating outside of covered countries but employing individuals who are citizens of covered countries. It helps prevent unintended broad prohibitions based on individual citizenship, focusing the restriction on the entity's control and location.
This new subparagraph introduces a 'Limited authority for certain entities' clause. It restricts the Secretary's ability to issue authorizations for connected vehicles otherwise prohibited under Section 4(a)(1) to entities with principal places of business in covered countries, unless those entities were already selling passenger vehicles in the U.S. and manufacturing them in the U.S. for at least 5 years before the Act's enactment.
This creates a specific carve-out for certain established foreign manufacturers, potentially allowing them to continue operations under authorization while new entrants from covered countries face stricter barriers. It impacts the competitive landscape for foreign manufacturers in the U.S. market.
This new clause specifies the expiration date for authorizations issued under Section 4(c)(1)(A) after the date of enactment but before January 1, 2030. These authorizations will remain in effect until the earlier of the date specified in their terms or January 1, 2030.
This provides a clear sunset for newly issued authorizations during an interim period, creating a defined timeline for compliance and review, which was not present in v1's more general authorization validity provisions.
This new clause mandates that the Secretary publish a list of all general or specific authorizations issued under subpart D of part 791 of title 15, Code of Federal Regulations, before the date of the enactment of this Act, by January 1, 2027.
This increases transparency regarding existing authorizations under prior regulations, providing clarity to the industry and public about which items are currently permitted, which was not an explicit requirement in v1.
This new paragraph requires the Secretary to create and maintain a list of 'trusted entities' that supply connected vehicles, covered software, vehicle connectivity systems, and vehicle connectivity system hardware. An entity can be determined as trusted if it does not pose an undue or unacceptable national security risk.
This introduces a proactive mechanism for identifying compliant suppliers, potentially streamlining the authorization process for entities on the list and providing clarity to the industry about reliable sources. It shifts some burden from individual item authorization to entity-level trust assessment.
This new paragraph mandates the Secretary establish a robust process to redact confidential business information and other sensitive information from publication in the lists of authorizations.
This addition ensures that while transparency is increased through published lists, proprietary and sensitive business information of companies seeking authorizations is protected, addressing a potential concern for industry stakeholders.
This new subparagraph requires the Secretary to notify relevant Congressional committees within 7 days if an advisory opinion is not issued within the 45-day period.
This adds a new accountability mechanism for the Secretary, ensuring that delays in issuing advisory opinions are reported to Congress, potentially prompting faster action and reducing uncertainty for applicants.
This new subparagraph excludes the 45-day timing requirement for advisory opinions if the applicant has not made good faith efforts to provide prompt responses to inquiries or requests for additional information from the Secretary.
This clarifies that the 45-day timeline is contingent on applicant cooperation, preventing applicants from exploiting delays caused by their own inaction. It ensures a more efficient and fair process.
This new section establishes a 'Safe Harbor' period of one year during which a person may cure a violation of subsection (a) without civil penalties, provided they promptly disclose the violation, diligently undertake remedial measures, cooperate with the Bureau of Industry and Security, complete the cure within the prescribed period, and did not engage in willful misconduct, knowing violation, fraud, material misrepresentation, or circumvention.
This is a significant addition that provides a pathway for entities to rectify unintentional violations without incurring severe penalties, promoting compliance through remediation rather than immediate punitive action. It reduces the risk for companies acting in good faith.
This new paragraph creates an exception to civil penalties for individuals who transport a vehicle into the United States in violation of a prohibition if the vehicle is for personal use and the individual does not know about the prohibition.
This protects individual consumers from civil penalties for unknowingly importing prohibited vehicles for personal use, focusing enforcement on commercial entities and those with intent to violate. It reduces the burden on ordinary citizens.
This new section mandates the Secretary to submit a report to Congress within 18 months assessing the resilience and security of supply chains critical to the U.S. automotive sector. The report should identify dependencies on covered countries, assess risks, and recommend policies to expand supply chains outside covered countries. It also specifies considerations like safety equipment, automotive sensing hardware/software, EV batteries, and smart glass.
This introduces a new, comprehensive reporting and strategic planning requirement focused on broader automotive supply chain vulnerabilities, moving beyond just connected vehicles to address systemic risks. It aims to inform future policy decisions for strengthening domestic and allied supply chains.
This new section mandates the Secretary of Transportation to submit a report to Congress within one year identifying opportunities to inform buyers of passenger cars if their original airbag has been replaced and could have been replaced with a defective Chinese airbag or component. It includes elements like identifying information sources, opportunities for sellers to inform buyers, and options to encourage inspections.
This introduces a new consumer safety and awareness initiative, specifically targeting a known risk from defective automotive components from a covered country. It aims to protect consumers and enhance transparency in the used car market regarding critical safety features.
This new section requires the Secretary to issue or amend final regulations by December 31, 2028, for connected vehicles with a gross vehicle weight rating greater than 4,536 kilograms (10,000 pounds), consistent with the Act's authorities and requirements. These regulations must take effect by December 31, 2032.
This is a significant expansion of the bill's regulatory scope, explicitly mandating future prohibitions and requirements for heavy-duty connected vehicles, which were largely excluded from the immediate prohibitions in Section 4(a) for lighter vehicles. It ensures a phased approach to regulating the entire connected vehicle market.
This new paragraph specifies that the reinstatement of regulations under Section 10(b)(1) (restoration of prior regulations) shall not be subject to certain sections of title 5, United States Code (Administrative Procedure Act sections 551, 553-559, and 701-706).
This provision streamlines the process for the Secretary to quickly reinstate prior regulations if a court invalidates provisions of this Act, bypassing standard administrative procedure requirements. This ensures regulatory continuity and responsiveness in the face of legal challenges.
These new clauses clarify that nothing in the Act shall be construed to prohibit, limit, or otherwise affect the Secretary of Commerce's authority under Executive Order 13873 (securing ICT supply chain) or Executive Order 14034 (protecting sensitive data from foreign adversaries).
This explicitly preserves the Secretary's existing authorities under relevant Executive Orders, ensuring that this Act complements rather than supersedes broader national security efforts related to technology and data. It provides legal clarity regarding the interaction of different authorities.
This new subsection introduces delayed implementation for covered software not already subject to existing regulations (15 CFR part 791 subpart D). For such software incorporated into connected vehicles, the prohibition under Section 4(a)(2) shall not be implemented before model year 2029.
This provides a grace period for software components not yet covered by existing regulations, allowing industry time to adjust to the new prohibitions. It mitigates immediate disruption for certain software suppliers and manufacturers.
This new subsection introduces delayed implementation for vehicle connectivity system hardware not already subject to existing regulations (15 CFR part 791 subpart D). For such hardware incorporated into connected vehicles, the prohibition under Section 4(a)(3) shall not be implemented before model year 2032.
Similar to software, this provides a grace period for hardware components not yet covered by existing regulations, allowing industry more time to adjust to the new prohibitions. The later date for hardware reflects potentially longer supply chain adjustments.
This new subsection introduces delayed implementation for connected vehicles of a model year before 2030, manufactured, purchased, or operated by entities that are existing U.S. passenger vehicle sellers or commercial fleet operators (for at least five years). These entities must submit annual compliance reports.
This provides a significant grace period for established U.S. manufacturers and commercial fleet operators to transition away from prohibited connected vehicles, mitigating immediate operational and economic disruption. It acknowledges the investment and existing infrastructure of these entities.
This new subsection states that, except as otherwise provided in the Act, the functions exercised under this Act shall not be subject to certain sections of title 5, United States Code (Administrative Procedure Act sections 551, 553-559, and 701-706).
This provision generally exempts the implementation of this Act from many standard Administrative Procedure Act requirements, allowing for potentially faster and more flexible regulatory action by the Secretary. This could streamline the process of issuing regulations and making determinations.
Deletions
This definition specified 'connected vehicle hardware' to mean a vehicle connectivity system and vehicle connectivity system hardware.
The explicit definition of 'Connected vehicle hardware' as a top-level term was removed. While the underlying components (vehicle connectivity system hardware) are still defined and covered, the removal of this overarching definition streamlines the definitional section and avoids redundancy with the more specific 'vehicle connectivity system hardware' term which is retained and expanded upon in v2.
This definition specified 'country of origin' as the country where an item is manufactured, or the country whose government owns/controls/has jurisdiction over the manufacturing or supplying entity.
This definition was central to v1's prohibitions but has been entirely replaced by the more comprehensive 'foreign entity of concern' definition in v2. The deletion signifies a fundamental shift in how the bill identifies and targets prohibited items and entities, moving from a country-centric approach to an entity-centric one with more detailed control criteria. This makes the scope of prohibitions more nuanced and potentially broader in application.
This definition referred to the meaning of 'electric vehicle' in section 3 of the Electric and Hybrid Vehicle Research, Development, and Demonstration Act of 1976.
The direct definition of 'electric vehicle' was removed. However, the concept is still present through the new definition of 'electric vehicle battery' in Section 3(5) of v2, which implicitly refers to electric and hybrid vehicles. The removal of the top-level definition streamlines the definitions without losing the underlying policy intent related to EV components.
This definition specified 'safety equipment' as air bags, air bag inflators, and seatbelt systems.
The explicit definition of 'safety equipment' was removed. However, the concept of safety equipment is still addressed in v2 through Section 7(c)(1) (report on supply chain resiliency) and Section 8 (report on defective Chinese air bags), indicating a shift from direct prohibition of safety equipment to a focus on supply chain assessment and consumer education regarding such components. This changes the regulatory approach for these specific items.
v1 required the Secretary of Commerce to consult with these four Secretaries before issuing a general or specific authorization.
v2 removes the explicit requirement for consultation with these specific Secretaries for all authorizations. While interagency coordination is still broadly encouraged in Section 5, this change streamlines the authorization issuance process by removing a mandatory consultation step, potentially allowing the Secretary of Commerce to act more independently in these determinations. However, it also reduces the explicit involvement of other key agencies in individual authorization decisions. The consultation is now implicit or discretionary rather than mandatory for each authorization decision. The requirement for a 60-day Congressional notification period before an authorization takes effect (for authorizations issued before Jan 1, 2030) was also removed, replaced by a notification *upon* issuance and a disapproval resolution mechanism only for authorizations issued *on or after* Jan 1, 2030.
Modifications
This modification narrows the stated scope of the threat addressed by the bill, focusing the legislative intent more specifically on industrial competitiveness and technological leadership, rather than broadly including economic security. This aligns with the removal of 'economic' from the title of Section 4 and Section 6, indicating a more precise focus on national security implications.
Before
v1 stated that the introduction of vehicles and components controlled by foreign adversaries threatens 'United States economic security, industrial competitiveness, and technological leadership'.
After
v2 states that the introduction of vehicles and components controlled by foreign adversaries threatens 'the industrial competitiveness and technological leadership of the United States'.
This is a stylistic change with no operative impact on the definition or scope of automated driving systems.
Before
v1 defined 'automated driving system' as hardware and software capable of performing the dynamic driving task 'regardless of whether it is limited to a specific operational design domain'.
After
v2 defines 'automated driving system' as hardware and software capable of performing the dynamic driving task 'regardless of whether the system is limited to a specific operational design domain'.
This modification significantly narrows the immediate application of the bill's prohibitions to lighter connected vehicles (10,000 pounds or less) and those communicating at specific frequencies. Heavier vehicles are now subject to future rulemaking under new Section 9. This means that many commercial vehicles and heavy-duty trucks are not immediately covered by the prohibitions in Section 4(a), providing a phased approach to regulation.
Before
v1 defined 'connected vehicle' as a vehicle driven by mechanical power, manufactured for public roads, that integrates networked hardware with software to communicate wirelessly, or is designed/manufactured/equipped to communicate, regardless of whether the capability is enabled, disabled, or removed.
After
v2 defines 'connected vehicle' with additional criteria: 'regardless of propulsion technology', a 'gross vehicle weight rating of 4,536 kilograms (10,000 pounds) or less', and communication 'at a radio frequency over 450 megahertz'. It also refines the language regarding communication capability removal.
The explicit inclusions clarify the breadth of software intended to be covered. The new exclusions for open-source software and older, unaltered software subcomponents provide important carve-outs, reducing the compliance burden for developers and manufacturers using such components and potentially preventing unintended prohibitions on widely used or legacy software.
Before
v1 defined 'covered software' as software-based components enabling vehicle connectivity or automated driving, including machine-learning models or AI components.
After
v2 expands the description of 'covered software' to explicitly include 'any application, middleware, system software, and any machine-learning model or other artificial intelligence component'. It also adds new exclusions for 'open-source software, unless that open-source software has been modified for proprietary purposes and not redistributed or shared' and 'software subcomponents that were designed, developed, manufactured, or supplied prior to March 17, 2026, as long as those software subcomponents are not maintained, augmented, or otherwise altered by a foreign entity of concern after March 17, 2026'.
This modification provides greater clarity on what constitutes 'resale' under the Act, ensuring that the term applies consistently across different types of prohibited items. The explicit inclusion of dealers in the exclusion for previously used vehicles clarifies that standard used-vehicle sales by dealers are not considered 'resale' subject to the prohibitions, reducing the compliance burden on the used car market.
Before
v1 defined 'resale' for an 'item' and excluded transfers of connected vehicles previously titled/registered/used by a consumer or end-user, or acquired for bona fide use/lease/operation.
After
v2 clarifies the definition of 'resale' to apply to 'vehicle, software, or hardware'. The exclusion for transfers of connected vehicles now also includes those acquired for bona fide use, lease, or operation 'by the individual or entity that was transferred the vehicle or by a dealer (as defined in section 30102(a)(2) of title 49, United States Code)'.
This modification provides greater precision on the scope of prohibited activities, ensuring that the definition of 'transaction' covers all relevant categories of items and a broader range of activities, including digital services related to connected vehicles. This strengthens the enforcement capabilities against attempts to circumvent the Act through various means.
Before
v1 defined 'transaction' as any acquisition, importation, transfer, installation, dealing in, or use of any 'item' subject to prohibition, including ongoing activities and evasion.
After
v2 clarifies the definition of 'transaction' to apply to any 'vehicle, software, or hardware' subject to prohibition. It also expands the scope of ongoing activities to include 'provision of platform services or data hosting of applications for consumer download'. The evasion clause is also expanded to include 'arrangement, practice, or course of conduct'.
The clarification ensures that only components directly enabling connectivity are covered. The explicit inclusion of EV battery systems brings these critical components under scrutiny, reflecting their growing importance in connected vehicles. The new exclusion for non-connectivity components significantly reduces the compliance burden for manufacturers by exempting basic, non-sensitive parts, focusing the prohibitions on truly connected and potentially vulnerable hardware.
Before
v1 defined 'vehicle connectivity system hardware' to include software-enabled/programmable components enabling VCS function, listing examples like microcontrollers, telematics units, battery systems, and safety equipment.
After
v2 refines the definition by clarifying 'connectivity functions' instead of 'function' and explicitly includes 'electronic systems integrated into an electric vehicle battery' (which was previously part of a broader 'safety equipment' inclusion in v1). It also adds a new exclusion for 'component parts that do not contribute to the connectivity function' (e.g., brackets, fasteners, passive electronics).
This modification narrows the stated focus of the prohibitions to national security threats, aligning with the change in Section 2(1) and Section 6. It indicates a more precise legislative intent to address security risks rather than broader economic concerns, although economic impacts may still be a consequence of national security threats.
Before
The title of Section 4 referred to threats to 'Economic or National Security'.
After
The title of Section 4 refers to threats to 'National Security'.
This is a major shift in how prohibited connected vehicles are identified. The introduction of 'foreign entity of concern' (defined in Section 3(6)) provides a more nuanced and potentially broader basis for prohibition, moving beyond simple country of origin to include various forms of control and influence. This makes compliance more complex for manufacturers but aims to more effectively target vehicles with adversary links.
Before
v1 prohibited connected vehicles from Jan 1, 2027, if their 'country of origin' was a covered country or designed there, or if the manufacturer was >15% owned/controlled by a covered country entity.
After
v2 prohibits connected vehicles from Jan 1, 2027, if they are 'primarily designed, primarily developed, or manufactured in, or supplied from, a covered country' OR if the 'manufacturer, developer, designer, or supplier of the connected vehicle is a foreign entity of concern'.
This modification aligns the software prohibition with the vehicle's model year, providing a clearer implementation timeline for manufacturers. The shift to 'foreign entity of concern' and broader origin criteria (similar to connected vehicles) means that software developers and suppliers will be assessed under the more detailed control framework, potentially broadening the scope of prohibited software.
Before
v1 prohibited covered software from Jan 1, 2027, if its 'country of origin' was a covered country, or if the developer was organized/based in a covered country, or >25% owned/controlled by a covered country entity.
After
v2 prohibits covered software if the connected vehicle it's integrated into was manufactured for 'model year 2027 or later' AND if the software is 'designed, developed, or manufactured in, or supplied from, a covered country' OR if the 'manufacturer, developer, designer, or supplier of the software is a foreign entity of concern'.
Similar to connected vehicles and software, the shift to 'foreign entity of concern' and broader origin criteria means hardware manufacturers and suppliers will be assessed under the more detailed control framework. The clarified repair/warranty exception provides more precise guidance on when existing vehicles can receive replacement parts without violating the prohibition, ensuring continued maintenance for older models.
Before
v1 prohibited connected vehicle hardware from Jan 1, 2030, if its 'country of origin' was a covered country, or if the manufacturer was organized/based in a covered country, or >25% owned/controlled by a covered country entity. The repair/warranty exception applied to 'a connected vehicle with a model year before model year 2030'.
After
v2 prohibits vehicle connectivity system hardware from Jan 1, 2030, if it is 'manufactured in, or supplied from, a covered country' OR if the 'manufacturer or supplier of the hardware is a foreign entity of concern'. The repair/warranty exception now applies to hardware 'integrated into a vehicle that is manufactured for a model year before model year 2030' or imported for repair/warranty for 'a connected vehicle of a model year before model year 2030'.
These modifications tighten the testing and evaluation exception by preventing prohibited vehicles from being driven on public roads even for testing, reducing potential security risks. Explicitly allowing Federal agencies to conduct testing ensures that government entities can perform necessary evaluations without being subject to the prohibitions. The updated entity criteria align the exception with the bill's new core definitional framework.
Before
v1 allowed an exception for testing and evaluation by a U.S.-organized entity, not having its principal place of business in a covered country, and not 25% or more owned/controlled by a covered country entity.
After
v2 adds two new conditions for the exception: 'in the case of a connected vehicle, the vehicle is not intended to be driven on public roads' OR 'in the case of a connected vehicle, covered software, or vehicle connectivity system hardware, the testing or evaluation is by... a Federal agency'. The entity criteria were also updated to refer to 'is not a foreign entity of concern'.
This modification aligns with other changes in the bill, narrowing the explicit focus of the Secretary's authority to prohibit transactions solely based on national security concerns, rather than broader economic security considerations. This provides a more precise mandate for the Secretary's regulatory actions.
Before
v1 authorized the Secretary to prohibit transactions posing an undue threat to 'the economic or national security of the United States'.
After
v2 authorizes the Secretary to prohibit transactions posing an undue threat to 'the national security of the United States'.
The change in Congressional notification from a pre-effective date review to an 'upon issuance' notification streamlines the authorization process, potentially allowing the Secretary to act more quickly. However, it also reduces Congress's proactive oversight window for authorizations issued before 2030. The shortening of the validity period for existing authorizations (from Jan 1, 2032, to Jan 1, 2030) creates a tighter timeline for review and potential re-authorization under the new framework, impacting entities currently operating under such authorizations.
Before
v1 allowed the Secretary to issue authorizations if the item did not pose undue risks, requiring a 60-day Congressional notification before the authorization took effect, during which a joint resolution of disapproval could be enacted. Existing authorizations (pre-Jan 1, 2030) were valid until Jan 1, 2032.
After
v2 allows the Secretary to issue authorizations if the item does not pose undue risks. It changes the Congressional notification requirement to *upon* issuing an authorization, including a redacted written risk assessment. The joint resolution of disapproval mechanism now applies only to authorizations issued *on or after January 1, 2030*. Existing authorizations (under 15 CFR part 791 subpart D) are valid until the earlier of their specified date or Jan 1, 2030.
This modification ensures that software components, which are critical to connected vehicle functionality and security, are also subject to the declaration of conformity requirement. This increases the accountability of software developers and suppliers and provides the Secretary with a more comprehensive overview of compliant components entering the market.
Before
v1 required a person importing, manufacturing, selling, reselling, or introducing a 'connected vehicle or connected vehicle hardware' to submit a declaration of conformity.
After
v2 requires a person importing, manufacturing, selling, reselling, or introducing a 'connected vehicle, covered software, or vehicle connectivity system hardware' to submit a declaration of conformity.
This modification introduces a new exception to the mandatory civil penalties, specifically for individuals transporting vehicles for personal use without knowledge of the prohibition (as detailed in the new Section 4(g)(3)). This softens the enforcement for unwitting individual consumers while maintaining strict penalties for commercial or knowing violations.
Before
v1 stated that the Secretary 'shall assess a civil penalty' for each violation.
After
v2 states that 'Except as provided by paragraph (3), the Secretary shall assess a civil penalty' for each violation.
This is a minor change that broadens the discretion of the Secretary in choosing which advisory committees to consult, without limiting the overall intent to seek expert advice. It removes a specific, non-binding example, making the provision more general.
Before
v1 allowed the Secretary to consult with existing advisory committees, 'including the Advisory Committee on Automation in Transportation'.
After
v2 allows the Secretary to consult with existing advisory committees, removing the specific mention of 'including the Advisory Committee on Automation in Transportation'.
Allowing a classified annex enables the Secretary to provide more sensitive and detailed information to Congress regarding national security threats and enforcement, enhancing oversight. Specifying the covered items provides clarity on the scope of reporting. The removal of 'economic' from the threat description aligns with other changes in the bill, focusing the reporting on national security aspects.
Before
v1 required an annual report to Congress describing enforcement activities, items covered, exclusions, effectiveness in decreasing 'threats to the economic and national security', metrics, and recommendations.
After
v2 requires an annual report to Congress that 'may contain a classified annex'. It clarifies 'connected vehicles, covered software, and vehicle connectivity system hardware' as items covered. It assesses effectiveness in decreasing 'threats to the national security' (removing 'economic').
This modification clarifies that not only explicit exclusions or exceptions but also definitional interpretations from prior regulations will continue to apply. This provides greater continuity and legal certainty for industry stakeholders who have relied on existing regulatory definitions, preventing unintended changes in scope due to new definitions in this Act.
Before
v1 stated that any 'exclusion or exception to a prohibition' under existing regulations shall remain valid and apply to the Act's prohibitions.
After
v2 states that any 'exclusion or exception to a prohibition or definition' under existing regulations shall remain valid and apply to the Act's prohibitions.
Scope
Complete substitute — The changes are scattered throughout the bill, affecting nearly every section from definitions to prohibitions, authorizations, and reporting requirements, and introducing entirely new sections. — v2 represents a meaningful change in policy direction. While the core objective of prohibiting foreign adversary-linked connected vehicles remains, the mechanisms for identifying prohibited entities ('foreign entity of concern'), the immediate scope of vehicles covered (lighter vehicles), and the compliance pathways (safe harbor, trusted suppliers) are fundamentally altered. It also expands the bill's future regulatory reach to heavy vehicles and introduces new supply chain and consumer safety reporting mandates. — The changes interact extensively with existing provisions. The new 'foreign entity of concern' definition in Section 3(6) fundamentally redefines the criteria for prohibitions in Section 4(a), impacting all related enforcement and authorization processes. The new delayed implementation schedules in Section 11 modify the immediate application of prohibitions for various categories of items and entities. The new reporting requirements in Sections 7 and 8 introduce entirely new mandates that will require interagency coordination and data collection.
Impact analysis
Manufacturers, developers, designers, and suppliers of connected vehicles, software, and hardware
Procedural change and potential narrowing of scope for certain components. The new 'foreign entity of concern' definition requires a more detailed assessment of ownership and control, increasing compliance complexity. However, the safe harbor provision offers a pathway to rectify unintentional violations, and specific exclusions for open-source and legacy software may reduce burden for some.
The criteria for determining prohibited items shifted from 'country of origin' and direct ownership percentages to a more complex 'foreign entity of concern' definition and broader design/development/manufacturing/supply origins. New exclusions for open-source software and older components, and a safe harbor for curing violations, were introduced.
Manufacturers and operators of heavy-duty connected vehicles (over 10,000 pounds)
Delayed impact and future regulatory burden. They gain an immediate exemption from the main prohibitions but will face new, specific regulations in the future, requiring long-term planning for compliance.
These vehicles are explicitly excluded from the immediate prohibitions in Section 4(a) but are now subject to future regulations mandated by new Section 9, with those regulations taking effect by December 31, 2032.
Entities with existing authorizations under 15 CFR part 791 subpart D
Loss of extended validity. These entities face an earlier deadline for review or re-authorization under the new framework, potentially requiring accelerated compliance efforts.
The validity of their authorizations is now limited to the earlier of their specified date or January 1, 2030 (shortened from January 1, 2032 in v1).
Individuals transporting connected vehicles for personal use
Gain of protection. This group is shielded from significant financial penalties for unwitting violations, reducing the personal risk associated with unknowingly importing a prohibited vehicle.
A new exception to civil penalties is provided if the vehicle is for personal use and the individual does not know about the prohibition.
U.S. automotive industry (including manufacturers, suppliers, and commercial fleet operators)
Increased reporting burden and delayed compliance. They will need to contribute to new reports and strategize for supply chain diversification. However, the delayed implementation provides a significant grace period for adapting to the new prohibitions, mitigating immediate disruption.
New reporting requirements are introduced regarding automotive supply chain resiliency (Section 7) and consumer education on defective Chinese airbags (Section 8). Additionally, existing U.S. manufacturers and operators benefit from delayed implementation of prohibitions for certain pre-2030 model year vehicles (Section 11(d)).
The Secretary of Commerce
Increased and streamlined authority. The Secretary gains more precise tools and flexibility in implementing and enforcing the Act, with reduced procedural hurdles for certain actions, but also takes on new responsibilities for reports and lists.
The Secretary's authority is refined with new definitions, a safe harbor provision, and new reporting mandates. Consultation requirements for authorizations are streamlined, and the Secretary gains authority to create a 'trusted suppliers' list and issue regulations for heavy vehicles. Many functions are exempted from certain APA requirements.