A complete substitute amendment, v2 fundamentally restructures the prohibitions on connected vehicles and related components from foreign adversaries. It introduces a detailed 'foreign entity of concern' definition, refines the scope of 'connected vehicle' to focus on lighter vehicles, adds new safe harbor and individual exceptions, and mandates new reports on supply chain resiliency and defective airbags.
Connected Vehicle Security Act of 2026
- Sponsor
- Sen. Moreno, Bernie [R-OH]
- Committees
- Commerce, Science, and Transportation Committee (primary)
- Last action
- Sep 22, 2026
Bottom line
The bill aims to secure the U.S. connected vehicle supply chain from national security risks posed by foreign adversaries by implementing comprehensive prohibitions and a robust regulatory oversight system.
What it actually does
This bill prohibits the importation, manufacture, sale, resale, or introduction into interstate commerce in the United States of connected vehicles, covered software, and vehicle connectivity system hardware that are primarily designed, developed, manufactured, or supplied by foreign adversaries or foreign entities of concern. It establishes a regulatory framework for authorizations, advisory opinions, and a safe harbor period for violations, while also requiring reports on supply chain resilience and consumer education regarding defective air bags.
Proponents argue
Proponents argue that the bill is essential for protecting U.S. national and economic security, preventing surveillance, espionage, cyber intrusion, and disruption of critical infrastructure by foreign adversaries, particularly given the rapid expansion of automotive manufacturing and exports by countries like the People's Republic of China. They contend that connected vehicles collect vast amounts of sensitive data and foreign control over these systems poses an unacceptable threat.
Opponents contend
While not explicitly stated in the bill, potential opponents or those impacted by the restrictions might argue that the prohibitions could lead to increased vehicle costs for consumers, limit consumer choice, and disrupt established global automotive supply chains, potentially hindering innovation or creating trade tensions with affected countries. Concerns could also be raised about the administrative burden on businesses and the complexity of compliance.
The bill is moderately complex due to technical definitions and regulatory procedures, requiring a dedicated reading time for full comprehension, which may exceed the time typically allotted for public review of such legislation.
Section 4(a)(1)
Prohibition on Connected Vehicles from Foreign Adversaries
Beginning January 1, 2027, this provision prohibits the import, manufacture, sale, resale, or introduction into U.S. interstate commerce of connected vehicles (under 10,000 lbs GVWR) if they are primarily designed, developed, manufactured in, or supplied from a 'covered country' (North Korea, China, Russia, Iran), or if their manufacturer, developer, designer, or supplier is a 'foreign entity of concern.' This applies regardless of whether specific software or hardware components are present at the time of transaction.
Supporters argue
Proponents argue this prohibition is crucial for national security, preventing foreign adversaries from embedding surveillance capabilities or control mechanisms directly into vehicles operating within the United States, thereby protecting sensitive data and critical infrastructure.
Critics contend
Potential opponents might argue that such broad prohibitions could stifle competition, increase costs for consumers, and create significant disruptions for global automotive supply chains that often involve components and design contributions from various international sources.
Tradeoffs
This provision balances national security imperatives against potential economic impacts, including consumer choice, vehicle affordability, and the complexities of global automotive manufacturing and trade relations.
Section 4(a)(2)
Prohibition on Covered Software from Foreign Adversaries
This provision prohibits the integration of 'covered software' into connected vehicles manufactured for model year 2027 or later, if that software is designed, developed, manufactured in, or supplied from a 'covered country,' or if its developer or supplier is a 'foreign entity of concern.' Covered software includes application, middleware, system software, and AI components enabling vehicle connectivity or automated driving functions.
Section 4(a)(3)
Prohibition on Vehicle Connectivity System Hardware from Foreign Adversaries
Effective January 1, 2030, this provision prohibits the integration of 'vehicle connectivity system hardware' into connected vehicles if the hardware is manufactured in, or supplied from, a 'covered country,' or if its manufacturer or supplier is a 'foreign entity of concern.' This includes components like microcontrollers, modems, and EV battery electronic systems. An exception is made for hardware used for repair or warranty purposes for vehicles manufactured before model year 2030.
Section 4(c)
Authorization and Trusted Supplier Process
The Secretary of Commerce may issue general or specific authorizations for items that would otherwise be prohibited, provided they do not pose an undue national security risk. Authorizations issued on or after January 1, 2030, are subject to Congressional disapproval. The Secretary must publish a list of authorized items and establish a procedure for entities to request authorization. Additionally, the Secretary is required to create and maintain a list of 'trusted entities' that supply connected vehicle components.
Section 4(d)
Advisory Opinions on Prohibitions
The Secretary of Commerce must establish a procedure by January 1, 2027, for importers, manufacturers, or sellers to seek advisory opinions on whether a specific connected vehicle, software, or hardware is prohibited under the Act, or if it has been altered to circumvent prohibitions. The Secretary must issue opinions within 45 days, with a requirement to notify Congress if this deadline is missed. A public list of advisory opinions will be maintained, but without identifying information of the requester.
Section 4(f)
Safe Harbor for Curing Violations
The bill establishes a one-year safe harbor period during which civil penalties will not accrue for a violation of the prohibitions, provided the person promptly discloses the violation to the Bureau of Industry and Security, diligently undertakes remedial measures, cooperates with the Bureau, completes the cure within the prescribed period, and did not engage in willful misconduct, knowing violation, fraud, or misrepresentation.
Section 7
Report on Automotive Supply Chain Resiliency and Security
Within 18 months of enactment, the Secretary of Commerce must submit a report to Congress assessing the resilience and security of critical automotive supply chains. This report will identify segments, materials, components, and technologies most dependent on 'covered countries,' assess the risks posed by these dependencies, and recommend policies to develop and expand alternative supply chains outside of covered countries. The report should consider safety equipment, automotive sensing hardware/software, electric vehicle batteries, and smart glass.
Section 9
Regulations for Heavy Connected Vehicles
By December 31, 2028, the Secretary of Commerce must issue or amend regulations to establish prohibitions and requirements for connected vehicles with a gross vehicle weight rating greater than 4,536 kilograms (10,000 pounds), consistent with the authorities and requirements of this Act. These regulations must take effect no later than December 31, 2032.
The definition of 'foreign entity of concern' includes specific equity or control thresholds: more than 15 percent for entities manufacturing, developing, designing, or supplying connected vehicles, and more than 25 percent for entities manufacturing, developing, designing, or supplying covered software or vehicle connectivity system hardware.
Section 3(6)(B)(iii)
Why it matters:This is standard legislative practice for defining complex terms with precise numerical criteria, but the specific percentages are critical for determining the applicability of the bill's prohibitions.
Case for: Proponents would argue that these specific thresholds provide clear, measurable criteria for identifying foreign control, allowing for targeted application of the prohibitions and reducing ambiguity for businesses trying to comply.
Case against: Critics might argue that these thresholds are arbitrary or could be easily circumvented through complex ownership structures, or that they might inadvertently capture entities with minimal foreign influence. The differing percentages for vehicles vs. components could also add complexity.
Estimated impact: This provision directly determines which entities and, by extension, which vehicles, software, and hardware are subject to the bill's prohibitions, impacting a significant portion of the global automotive supply chain.
The definition of 'covered software' explicitly excludes open-source software (unless modified for proprietary purposes and not redistributed) and software subcomponents designed, developed, manufactured, or supplied prior to March 17, 2026, as long as they are not maintained, augmented, or otherwise altered by a foreign entity of concern after that date.
Section 3(4)(B)
Why it matters:This is standard practice for refining definitions to avoid unintended consequences or overreach, but it represents significant carve-outs from the general prohibition.
Case for: Proponents would argue that these exclusions prevent unnecessary burdens on the use of widely adopted open-source technologies and acknowledge existing software components, focusing the prohibitions on new or proprietary software that could be directly influenced by foreign adversaries.
Case against: Critics might argue that even open-source software, if modified or maintained by foreign entities of concern, could pose risks, and that the 'prior to March 17, 2026' exclusion could create a legacy vulnerability if not carefully managed.
Estimated impact: These exclusions significantly narrow the scope of the software prohibition, allowing for continued use of a large volume of existing and open-source software components in connected vehicles.
The prohibition on connected vehicles (Section 4(a)(1)) does not apply to vehicles of a model year before 2030 that are manufactured, purchased under a contract before enactment, or operated in a commercial fleet by an entity that has been selling or operating passenger vehicles in the U.S. for at least five years before the enactment date. Such entities must submit annual compliance reports until 2030.
Section 11(d)
Why it matters:This is a common legislative technique to provide a transition period for established industries, but its placement might obscure its significance for affected parties.
Case for: Proponents would argue this provides a crucial grace period for existing U.S. manufacturers and commercial fleet operators to adjust their supply chains and vehicle acquisition strategies without immediate disruption, ensuring market stability while transitioning to the new security requirements.
Case against: Critics might argue that delaying implementation for certain entities could create an uneven playing field or prolong the national security risks that the bill aims to address, especially if these entities continue to operate vehicles with components from foreign adversaries.
Estimated impact: This provision significantly impacts the immediate compliance burden for established U.S. automotive manufacturers and commercial fleet operators, granting them several years to adapt before the full prohibition takes effect for their existing operations.
Except as otherwise provided in the Act, the functions exercised under this Act shall not be subject to sections 551, 553 through 559, and 701 through 706 of title 5, United States Code (the Administrative Procedure Act, or APA).
Section 11(f)
Why it matters:This is a common legislative tactic to streamline agency action, particularly in areas deemed critical for national security, but it limits transparency and public input compared to standard rulemaking processes.
Case for: Proponents would argue that exempting most functions from the APA allows the Secretary of Commerce to act swiftly and decisively on national security matters without being bogged down by lengthy administrative procedures, which is critical for responding to evolving threats.
Case against: Critics would contend that broad APA exemptions reduce transparency, limit public and industry input, and restrict judicial review, potentially leading to arbitrary decisions or unintended consequences without adequate checks and balances.
Estimated impact: This provision significantly alters the administrative process for implementing and enforcing the Act, granting the Secretary of Commerce greater discretion and speed but reducing public accountability and opportunities for challenge.