S4429-119

What This Bill Does

The Connected Vehicle Security Act would prohibit specified connected vehicles and related software beginning January 1, 2027, and specified connectivity hardware beginning January 1, 2030. The covered countries are China, Russia, Iran and North Korea. Vehicle restrictions reach covered-country origin or design and manufacturers with more than 15 percent covered-country equity, voting interest, board representation or other control; component developer/manufacturer ownership tests use more than 25 percent. Country of origin also considers government ownership, control, jurisdiction or direction over manufacturers and suppliers, not just assembly location. This analysis uses the introduced text, the available preferred version even though the bill's recorded status is reported. The proposal is not enacted law.

Who Benefits and How

Noncovered vehicle makers and automotive component suppliers may gain market opportunities as covered competitors are excluded. Drivers and communities may gain protection against the surveillance, remote-control and supply-chain risks targeted by the bill, although those gains depend on enforcement and substitution choices. Commerce could authorize an otherwise prohibited item only on clear and convincing evidence and a written risk assessment, after interagency consultation and at least 60 days' congressional notice without an enacted disapproval resolution. Legitimate testing by qualifying U.S.-organized entities is exempt. Hardware for repair or warranty service of pre-2030 model-year vehicles is exempt from the hardware ban, and bona fide used-vehicle transfers fall outside the defined commercial resale category. These are limited provisions, not exemptions for all aftermarket products or all covered-country vehicles.

Who Bears the Burden and How

Covered-country manufacturers and developers, including qualifying joint ventures or third-country affiliates, would lose access to prohibited U.S. transactions. U.S. automakers, importers, suppliers and commercial resellers face origin/control due diligence, declarations of conformity for vehicles and hardware, supply-chain changes and potential authorization applications. Vehicle buyers could face fewer choices or higher replacement costs. Commerce, acting through the Bureau of Industry and Security, must issue rules, maintain item lists, provide ruling procedures, enforce restrictions and report annually. Each prohibited transaction carries a civil penalty of at least the greater of $1.5 million or five times its value; a continuing violation is separately counted each day. Judicial review does not automatically stay agency action, and classified information may be submitted to the reviewing court privately. These are proposed rules, not a statement that all current connected vehicles are unlawful.

Key Provisions

• Prohibits covered vehicles and software from January 1, 2027 and hardware from January 1, 2030, but delays newly covered software or hardware outside the pre-enactment Commerce rule until an implementation date after January 1, 2030 and before January 1, 2032.
• Includes originally connected vehicles even if connectivity is disabled or removed, vehicle-level automated-driving AI models, connectivity components, specified battery electronics, and safety equipment; excludes rail-only vehicles.
• Applies a more-than-15-percent control threshold to vehicle manufacturers and a more-than-25-percent threshold to software or hardware entities; testing eligibility instead excludes U.S. entities that are 25 percent or more covered-country owned or controlled.
• Requires conformity declarations before covered vehicle or hardware transactions, and authorizes Commerce rules against specific transactions posing undue or unacceptable economic or national-security threats, with certified-mail notice naming the item.
• Requires authorization and binding-ruling procedures and initial authorized-item lists by January 1, 2027; rulings or advisory opinions are due within 45 days of a sufficiently clear application, with applicant identities withheld from the public list.
• Preserves existing Commerce rule authority and applicable exceptions pending a review starting January 1, 2030; generally preserves pre-2030 authorizations until January 1, 2032 subject to the stated revision/revocation provisions.
• Requires annual enforcement and effectiveness reports after one year, preserves remaining provisions after invalidation, and permits reinstatement of similar pre-enactment regulations under the specified final-judgment condition.