Connected Vehicle Security Act of 2026

This legislation seeks to protect the United States' economic and national security by restricting the presence of connected vehicles and their associated software and hardware linked to foreign adversaries. It specifically prohibits the importation, manufacture, sale, resale, or introduction into interstate commerce of these items. The bill identifies four covered countries : the Democratic People's Republic of North Korea, the People's Republic of China, the Russian Federation, and the Islamic Republic of Iran. Effective January 1, 2027, the bill prohibits connected vehicles if their country of origin is a covered country, or if their manufacturer is more than 15 percent owned or controlled by an entity from a covered country. The same date applies to covered software , with a 25 percent ownership or control threshold for developers. For connected vehicle hardware , the prohibition takes effect on January 1, 2030, also with a 25 percent ownership or control threshold for manufacturers, though an exception exists for repair or warranty of older model vehicles. The Secretary of Commerce is empowered to issue authorizations for items that would otherwise be prohibited, provided a thorough risk assessment confirms they pose no undue threat to national security. The bill also establishes procedures for binding rulings and advisory opinions to clarify the applicability of prohibitions and requires a declaration of conformity for regulated items. Violations of these prohibitions carry substantial civil penalties, starting at $1,500,000 or five times the transaction value. The legislation mandates annual reports to Congress detailing enforcement activities, the effectiveness of the prohibitions, and any identified gaps or challenges. It also encourages interagency coordination and consultation with existing advisory bodies to ensure alignment and avoid conflicting regulatory requirements. The bill clarifies its interaction with existing Commerce Department regulations regarding information and communications technology supply chain security, including a delayed implementation for certain software and hardware not previously covered.