S. 4429

[Congressional Bills 119th Congress]
[From the U.S. Government Publishing Office]
[S. 4429 Introduced in Senate (IS)]

<DOC>

119th CONGRESS
2d Session
S. 4429

To prohibit the importation, manufacture, sale, resale, or introduction 
into interstate commerce in the United States of connected vehicles and 
related software and hardware associated with foreign adversaries.

_______________________________________________________________________

IN THE SENATE OF THE UNITED STATES

April 29, 2026

Mr. Moreno (for himself and Ms. Slotkin) introduced the following bill; 
which was read twice and referred to the Committee on Commerce, 
Science, and Transportation

_______________________________________________________________________

A BILL

To prohibit the importation, manufacture, sale, resale, or introduction 
into interstate commerce in the United States of connected vehicles and 
related software and hardware associated with foreign adversaries.

Be it enacted by the Senate and House of Representatives of the 
United States of America in Congress assembled,

SECTION 1. SHORT TITLE.

This Act may be cited as the ``Connected Vehicle Security Act of 
2026''.

SEC. 2. FINDINGS.

Congress makes the following findings:
(1) The United States automotive industry is critical to 
the national economy, supporting millions of jobs, supply 
chains, and advanced manufacturing. The introduction of 
vehicles and components controlled by foreign adversaries 
threatens United States economic security, industrial 
competitiveness, and technological leadership.
(2) The People's Republic of China has rapidly expanded its 
automotive manufacturing capacity and is increasingly targeting 
export markets. Despite having the largest market in the world, 
the People's Republic of China exports nearly 8,000,000 
vehicles annually, approximately twice the volume exported by 
any other country, demonstrating the scale at which vehicles 
and components controlled by a foreign adversary may enter 
global markets, including the United States.
(3) Connected vehicles incorporate advanced information and 
communications technologies that collect, process, and transmit 
vast amounts of sensitive data, including geolocation, 
operational, and personal information, and are capable of being 
remotely accessed and controlled.
(4) In Executive Order 13873 (50 U.S.C. 1701 note; relating 
to securing the information and communications technology and 
services supply chain), the President declared a national 
emergency with respect to the threat posed by foreign 
adversaries creating and exploiting vulnerabilities in 
information and communications technology and services.
(5) The access, control, or influence of vehicle 
connectivity systems or automated driving systems by foreign 
adversaries creates substantial economic and national security 
risks to the United States, including risks of surveillance, 
espionage, cyber intrusion, and disruption of critical 
infrastructure. Such risks fall within the scope of the 
national emergency described in Executive Order 13873 and pose 
an unacceptable threat to the security and resilience of the 
United States.

SEC. 3. DEFINITIONS.

In this Act:
(1) Automated driving system.--The term ``automated driving 
system'' means hardware and software that, collectively, are 
capable of performing the entire dynamic driving task for a 
connected vehicle on a sustained basis, regardless of whether 
it is limited to a specific operational design domain.
(2) Connected vehicle.--
(A) In general.--Except as provided by subparagraph 
(B), the term ``connected vehicle'' means a vehicle 
driven or drawn by mechanical power and manufactured 
primarily for use on public streets, roads, and 
highways, that--
(i) integrates onboard networked hardware 
with automotive software systems to communicate 
via dedicated short-range communication, 
cellular telecommunications connectivity, 
satellite communication, or other wireless 
spectrum connectivity with any other network or 
device; or
(ii) is designed, manufactured, or 
originally equipped to communicate via such 
methods, regardless of whether such capability 
is enabled, disabled, or removed at the time of 
importation, manufacture, sale, resale, or 
introduction of the vehicle into interstate 
commerce in the United States.
(B) Exclusion.--The term ``connected vehicle'' does 
not include a vehicle operated only on a rail line.
(3) Connected vehicle hardware.--The term ``connected 
vehicle hardware'' means--
(A) a vehicle connectivity system; and
(B) vehicle connectivity system hardware.
(4) Country of origin.--The term ``country of origin'', 
with respect to an item, means the country--
(A) in which the item is manufactured; or
(B) the government of which owns or controls, or 
has jurisdiction or direction over--
(i) the entity manufacturing the item; or
(ii) the entity supplying the item.
(5) Covered country.--The term ``covered country'' means--
(A) the Democratic People's Republic of North 
Korea;
(B) the People's Republic of China;
(C) the Russian Federation; and
(D) the Islamic Republic of Iran.
(6) Covered software.--The term ``covered software''--
(A) means the software-based components installed 
in or on a connected vehicle, or designed to be 
installed in or on a connected vehicle, including 
application, middleware, and system software, executed 
by the primary processing unit or units of an item that 
directly enables the function of a vehicle connectivity 
system or automated driving system at the vehicle 
level; and
(B) includes any machine-learning model or other 
artificial intelligence component that directly enables 
decision-making or control of an automated driving 
system at the vehicle level.
(7) Electric vehicle.--The term ``electric vehicle'' has 
the meaning given that term in section 3 of the Electric and 
Hybrid Vehicle Research, Development, and Demonstration Act of 
1976 (15 U.S.C. 2502).
(8) Importation.--The term ``importation'' has the meaning 
given the term ``import'' in section 1001 of the Controlled 
Substances Import and Export Act (21 U.S.C. 951).
(9) Resale.--
(A) In general.--The term ``resale'', with respect 
to an item, means the transfer of ownership of the item 
by an individual or entity that acquired the item for 
the purpose of transfer in the ordinary course of 
business, and not for the use of or consumption by the 
individual or entity.
(B) Exclusion.--The term ``resale'' does not 
include the transfer of a connected vehicle that was 
previously titled or registered to, and used by, a 
consumer or end-user or was acquired for bona fide use, 
lease, or operation by the individual or entity 
transferred the vehicle.
(10) Safety equipment.--The term ``safety equipment'', with 
respect to a vehicle, means air bags, air bag inflators, and 
seatbelt systems.
(11) Secretary.--The term ``Secretary'' means the Secretary 
of Commerce, acting through the Under Secretary of Commerce for 
Industry and Security.
(12) Transaction.--The term ``transaction''--
(A) means any acquisition, importation, transfer, 
installation, dealing in, or use of any item subject to 
a prohibition under section 4(a), including ongoing 
activities, such as managed services, data 
transmission, software updates, repairs, or the 
platforming or data hosting of applications for 
consumer download; and
(B) includes--
(i) any other transaction, the structure of 
which is designed or intended to evade or 
circumvent this Act; and
(ii) a class of transactions.
(13) Vehicle connectivity system.--The term ``vehicle 
connectivity system'' means a vehicle connectivity system 
hardware or covered software item installed in or on a 
connected vehicle, or designed to be installed in or on a 
connected vehicle, that directly enables the function of 
transmission, receipt, conversion, or processing of radio 
frequency communications at a frequency over 450 megahertz.
(14) Vehicle connectivity system hardware.--The term 
``vehicle connectivity system hardware''--
(A) means software-enabled or programmable 
components that--
(i) are installed in or on a connected 
vehicle or designed to be installed in or on a 
connected vehicle;
(ii) are directly connected to a vehicle 
connectivity system; and
(iii) directly enable the function of a 
vehicle connectivity system or are part of an 
item that directly enables the function of a 
vehicle connectivity system; and
(B) includes--
(i) microcontrollers, microcomputers or 
modules, systems on a chip, networking or 
telematics units, cellular modem/modules, Wi-Fi 
microcontrollers or modules, Bluetooth 
microcontrollers or modules, satellite 
communication systems, other wireless 
communication microcontrollers or modules, 
external antennas, digital signal processors, 
and field-programmable gate arrays;
(ii) electronic systems integrated into a 
battery that directly enable or control the 
monitoring, management, security, or external 
communication of battery performance or 
operation, including any transmitter or 
interface component that performs such 
functions; and
(iii) safety equipment.

SEC. 4. PROHIBITION ON CONNECTED VEHICLES AND OTHER TRANSACTIONS THAT 
THREATEN ECONOMIC OR NATIONAL SECURITY.

(a) Prohibitions.--
(1) Connected vehicles.--On and after January 1, 2027, the 
importation, manufacture, sale, resale, or introduction into 
interstate commerce in the United States of a connected vehicle 
is prohibited if--
(A) the country of origin of the connected vehicle 
is a covered country or the connected vehicle is 
designed within a covered country, without regard to 
whether--
(i) at the time of importation, sale, 
resale, or introduction, the vehicle is 
equipped with any covered software or connected 
vehicle hardware subject to a prohibition under 
paragraph (2) or (3); or
(ii) any such covered software or connected 
vehicle hardware--
(I) is removed from the vehicle 
before importation, sale, resale, or 
introduction; or
(II) will be installed after 
importation, sale, resale, or 
introduction; or
(B) the manufacturer of the connected vehicle is a 
joint venture, subsidiary, or other entity in which 
more than 15 percent of the equity interest, voting 
interest, board representation, or other indicia of 
control, whether directly or indirectly, is owned or 
controlled by an entity, or combination of entities, 
organized under the laws of, or with its principal 
place of business in, a covered country.
(2) Covered software.--On and after January 1, 2027, the 
integration of covered software into a connected vehicle that 
is imported, manufactured, sold, resold, or introduced into 
interstate commerce into the United States is prohibited if--
(A) the country of origin of the covered software 
is a covered country; or
(B) the developer of the software--
(i) is organized under the laws of, or has 
its principal place of business in, a covered 
country; or
(ii) is a joint venture, subsidiary, or 
other entity in which more than 25 percent of 
the equity interest, voting interest, board 
representation, or other indicia of control, 
whether directly or indirectly, is owned or 
controlled by an entity, or combination of 
entities, described in clause (i).
(3) Connected vehicle hardware.--
(A) In general.--On and after January 1, 2030, the 
importation, manufacture, sale, resale, or introduction 
into interstate commerce in the United States of any 
connected vehicle hardware is prohibited if--
(i) the country of origin of the hardware 
is a covered country; or
(ii) the manufacturer of the hardware--
(I) is organized under the laws of, 
or has its principal place of business 
in, a covered country; or
(II) is a joint venture, 
subsidiary, or other entity in which 
more than 25 percent of the equity 
interest, voting interest, board 
representation, or other indicia of 
control, whether directly or 
indirectly, is owned or controlled by 
an entity, or combination of entities, 
described in subclause (I).
(B) Repair and warranty.--The prohibition under 
subparagraph (A) shall not apply to connected vehicle 
hardware that is imported, manufactured, sold, resold, 
or introduced into interstate commerce in the United 
States for the purpose of repair or under warranty for 
a connected vehicle with a model year before model year 
2030.
(4) Additional items.--Subject to an applicable ruling or 
advisory opinion issued under subsection (d), a prohibition 
under paragraph (1), (2), or (3) applies with respect to a 
connected vehicle, covered software, or connected vehicle 
hardware, as the case may be, that is renamed, rebranded, 
restructured, or altered to circumvent the prohibition.
(5) Exception.--The prohibitions under paragraphs (1), (2), 
and (3) shall not apply to the importation, manufacture, sale, 
resale, or introduction into interstate commerce in the United 
States of a connected vehicle, covered software, or connected 
vehicle hardware, as the case may be, for the sole purpose of 
testing and evaluation by an entity that--
(A) is organized under the laws of a State in the 
United States;
(B) does not have its principal place of business 
in a covered country; and
(C) is not 25 percent or more, whether directly or 
indirectly, owned or controlled by an entity, or 
combination of entities, organized under the laws of, 
or with its principal place of business in, a covered 
country.
(b) Related Transactions.--
(1) In general.--The Secretary shall prescribe regulations, 
pursuant to section 553 of title 5, United States Code, to 
prohibit any specific transaction relating to connected 
vehicles, including the importation, sale, distribution, 
integration, or use of a connected vehicle, covered software, 
connected vehicle hardware, or any other item subject to a 
prohibition under subsection (a), that the Secretary determines 
poses an undue or unacceptable threat to the economic or 
national security of the United States.
(2) Notice.--If the Secretary prohibits a transaction under 
paragraph (1), the Secretary shall deliver, by certified United 
States mail, to the parties to the transaction a notice of the 
prohibition that includes an identification, by name, of the 
specific item that the Secretary determines poses an undue or 
unacceptable threat to the economic or national security of the 
United States.
(c) Authorizations.--
(1) Issuance.--
(A) In general.--The Secretary, in consultation 
with the Secretary of Defense, the Secretary of 
Transportation, the Secretary of State, and the 
Secretary of Energy, may issue a general or specific 
authorization for the importation, manufacture, sale, 
resale, or introduction into interstate commerce in the 
United States of an item that would otherwise be 
subject to the prohibitions under subsection (a) if--
(i) the Secretary determines, based on 
clear and convincing evidence and a written 
risk assessment, that the importation, 
manufacture, sale, resale, or introduction of 
the item does not pose, and is not reasonably 
likely to pose--
(I) an undue risk of data 
exfiltration from, or remote 
manipulation or operation of, a 
connected vehicle;
(II) a risk to critical 
infrastructure or the integrity of the 
industrial base of the United States; 
or
(III) any other risk to the 
national security of the United States;
(ii) not less than 60 days before the 
authorization takes effect, the Secretary 
submits to Congress a detailed written 
notification, including the determination under 
clause (i) and underlying analysis, including 
the written risk assessment; and
(iii) during the 60-day period described in 
clause (ii), there is not enacted into law a 
joint resolution of disapproval with respect to 
the authorization of the item.
(B) Continued validity and modification and 
revocation of authorizations.--
(i) Continued validity of existing 
authorizations.--Except as provided by clauses 
(ii) and (iii), any general or specific 
authorization issued under subparagraph (A) or 
subpart D of part 791 of title 15, Code of 
Federal Regulations, before January 1, 2030, 
shall remain in effect until January 1, 2032, 
unless modified, suspended or revoked under 
clause (ii).
(ii) Modification or revocation of general 
or specific authorizations.--The Secretary may, 
at any time, modify, suspend, or revoke a 
general or specific authorization described in 
clause (i) if the Secretary--
(I) determines that the 
authorization no longer satisfies the 
requirements of subparagraph (A)(i); 
and
(II) provides the public with an 
opportunity to comment before 
modifying, suspending, or revoking the 
authorization.
(2) Publication of list of authorized items.--
(A) In general.--The Secretary shall publish, 
pursuant to section 553 of title 5, United States Code, 
and maintain a list of the items the importation, 
manufacture, sale, resale, or introduction into 
interstate commerce in the United States of which is 
authorized under paragraph (1). The initial such list 
shall be published not later than January 1, 2027.
(B) Inclusions.--
(i) In general.--To the extent possible, 
the Secretary shall include, in the list 
required by subparagraph (A), the manufacturer 
and product name for each item on the list.
(ii) Other identifying characteristics.--
When it is not possible to include, in the list 
required by subparagraph (A), the manufacturer 
and product name for an item, the Secretary 
shall provide technical criteria sufficient to 
enable the automotive industry and importers to 
determine without undue difficulty whether the 
importation, manufacture, sale, resale, or 
introduction into interstate commerce in the 
United States of an item is authorized under 
paragraph (1). In carrying out this clause, the 
Secretary shall protect intellectual property 
to the extent practicable.
(iii) Risk assessment.--To the extent 
possible, the Secretary shall include, in the 
list required by subparagraph (A), a detailed 
explanation about why each item on the list 
does not pose an undue risk described in 
subparagraph (A) or (B) of paragraph (1).
(3) Requests for authorization.--Not later than January 1, 
2027, the Secretary shall establish a procedure pursuant to 
which an importer, manufacturer, supplier, or seller or 
reseller may seek the authorization under paragraph (1) of the 
importation, manufacture, sale, resale, or introduction into 
interstate commerce in the United States of an item described 
in subsection (a) that would otherwise be subject to the 
prohibitions under that subsection.
(d) Rulings and Advisory Opinions.--
(1) In general.--Not later than January 1, 2027, the 
Secretary shall establish a procedure pursuant to which an 
importer, manufacturer, or seller or reseller may seek a 
binding ruling or advisory opinion with respect to whether--
(A) the importation, manufacture, sale, resale, or 
introduction into interstate commerce in the United 
States of an item is or is not prohibited under this 
section; or
(B) a connected vehicle, covered software, or 
connected vehicle hardware has been renamed, rebranded, 
restructured, or altered to circumvent the prohibitions 
under subsection (a).
(2) Timing.--The Secretary shall issue a ruling or advisory 
opinion under paragraph (1) with respect to an item not later 
than 45 days after receiving an application supported by a 
reasonably clear description of the item.
(3) Publication.--
(A) In general.--The Secretary shall--
(i) publish a list of the items for which 
the Secretary has issued rulings and advisory 
opinions under paragraph (1); and
(ii) update that list not less frequently 
than annually.
(B) Prohibition on publication of identifying 
information.--The Secretary shall not publish the name 
of, or other information that might reasonably 
identify, the party that requested the ruling or 
advisory opinion.
(4) Continued validity of existing rulings and opinions.--
Except as provided by paragraph (5), a ruling or advisory 
opinion issued under this subsection or subpart D of part 791 
of title 15, Code of Federal Regulations, before January 1, 
2027, shall remain in effect.
(5) Modification or revocation.--The Secretary may modify, 
suspend, or revoke any binding ruling or advisory opinion 
issued under paragraph (1) or subpart D of part 791 of title 
15, Code of Federal Regulations, with respect to an item at any 
time if the Secretary determines that the circumstances that 
led to the ruling or opinion have changed.
(e) Declaration of Conformity.--The Secretary shall establish a 
process under which a person that imports, manufactures, sells, 
resells, or introduces into interstate commerce in the United States a 
connected vehicle or connected vehicle hardware is required to submit a 
declaration, to be known as a ``declaration of conformity'', to the 
Secretary before importing, manufacturing, selling, reselling, or 
introducing the vehicle or hardware that certifies that the vehicle or 
hardware is not subject to a prohibition under subsection (a).
(f) Civil Penalties.--
(1) In general.--The Secretary shall assess a civil penalty 
for each transaction that is a violation of a prohibition under 
subsection (a) in an amount that is not less than the greater 
of--
(A) $1,500,000; or
(B) five times the value of the transaction.
(2) Continuing violations.--In the case of a violation that 
occurs on more than one day, each day on which the violation 
continues shall be treated as a separate violation.
(g) Classified Information.--The Secretary may rely on classified 
information in carrying out this section, which may be submitted to a 
reviewing court ex parte and in camera.
(h) Petitions for Review.--The filing in a court of a petition for 
review shall not stay the effectiveness of any action under this 
section unless ordered by the court.

SEC. 5. USE OF EXISTING ADVISORY BODIES; INTERAGENCY COORDINATION.

(a) Use of Existing Advisory Bodies.--
(1) In general.--In carrying out this Act, the Secretary 
may consult, as appropriate, with existing advisory committees 
of the Department of Transportation and other relevant Federal 
agencies, including the Advisory Committee on Automation in 
Transportation, on matters relating to connected vehicles and 
associated national security risks.
(2) Scope of consultation.--Consultation under paragraph 
(1) may include consideration of--
(A) risks relating to data security, cybersecurity, 
and supply chain integrity associated with connected 
vehicles;
(B) the effectiveness of authorities and 
regulations issued under this Act;
(C) emerging technologies and threat vectors 
relevant to connected vehicle ecosystems; and
(D) recommendations made to the Secretary with 
respect to regulatory, enforcement, and policy measures 
to mitigate risks described in subparagraph (A).
(b) Interagency Coordination.--In carrying out this Act, the 
Secretary may consult and coordinate, as appropriate, with the Federal 
Communications Commission and other relevant Federal agencies to ensure 
alignment with respect to the scope, timeline, and implementation of 
any prohibitions or restrictions issued under this Act, including to 
avoid duplicative, inconsistent, or conflicting regulatory 
requirements.

SEC. 6. REPORTS.

Not later than one year after the date of the enactment of this 
Act, and annually thereafter, the Secretary shall submit to Congress a 
report--
(1) describing activities carried out to enforce the 
prohibitions under section 4, including enforcement actions 
taken and resources utilized;
(2) providing a detailed accounting of items covered by 
such prohibitions during the 1-year period preceding submission 
of the report;
(3) explaining any exclusions, exemptions, or 
determinations made by the Secretary, including the rationale 
and criteria applied;
(4) assessing the effectiveness of such prohibitions in 
decreasing the threats to the economic and national security of 
the United States posed by connected vehicles;
(5) including metrics on enforcement, compliance rates, 
violations identified, penalties assessed, and any identified 
gaps or challenges; and
(6) making recommendations with respect to further 
decreasing such threats.

SEC. 7. SEVERABILITY; REGULATORY CONTINUITY.

(a) Severability.--If any provision of this Act, or the application 
of such provision to any person or circumstance, is held to be invalid, 
the remainder of this Act, and the application of the remaining 
provisions to any person or circumstance, shall not be affected.
(b) Restoration of Prior Regulations.--If a court of competent 
jurisdiction enters a final judgment holding invalid or unenforceable a 
provision of this Act and supersedes regulations prescribed to carry 
out section 4, the Secretary may, notwithstanding any other provision 
of this Act, reissue or reinstate, in whole or in part, any similar 
regulations that were in effect on the day before the date of the 
enactment of this Act.

SEC. 8. INTERACTION WITH REGULATIONS.

(a) Rule of Construction.--Nothing in this Act shall be construed 
to prohibit, limit, or otherwise affect the authority of the Secretary 
of Commerce to implement or administer subpart D of part 791 of title 
15, Code of Federal Regulations, as added by the final rule of the 
Bureau of Industry and Security entitled ``Securing the Information and 
Communications Technology and Services Supply Chain: Connected 
Vehicles'' (90 Fed. Reg. 5360).
(b) Delayed Implementation for Software and Hardware Not Covered by 
Regulations.--In the case of covered software and connected vehicle 
hardware that is subject to a prohibition under paragraph (2) or (3) of 
section 4(a) and is not subject to subpart D of part 791 of title 15, 
Code of Federal Regulations, as in effect on the day before the date of 
the enactment of this Act, the Secretary shall implement the 
prohibition under section 4(a) after January 1, 2030, and before 
January 1, 2032.
(c) Treatment of Prior Exclusions.--
(1) In general.--Subject to paragraph (2), any exclusion or 
exception to a prohibition under subpart D of part 791 of title 
15, Code of Federal Regulations, as in effect on the day before 
the date of the enactment of this Act, shall remain valid and 
shall apply to the prohibitions under section 4(a).
(2) Rulemaking.--Beginning January 1, 2030, the Secretary 
shall conduct a rulemaking, pursuant to section 553 of title 5, 
United States Code, to determine whether exclusions or 
exceptions described in paragraph (1) should be continued, 
modified, or terminated for the purposes of this Act.
<all>