Key Takeaways
- • Congress introduced bipartisan legislation on April 29, 2026 (Senate) and May 11, 2026 (House) to codify and expand connected vehicle restrictions, adding Iran and North Korea to the existing China and Russia restrictions under current Commerce Department regulations.
- • The CV Security Act expands covered products beyond current rules to include battery electronics, airbags, airbag inflators, and seatbelts, with explicit inclusion of machine-learning and AI components in automated driving systems, effective January 1, 2027 for software and vehicles, with hardware restrictions phased in by January 1, 2030.
- • The bill shifts from the current "ownership or control" framework to focus on country of origin and manufacturer principal place of business, establishing specific numerical thresholds: 15% equity/control threshold for connected vehicle manufacturers and 25% threshold for software developers and hardware manufacturers.
- • Civil penalties are substantially increased to the greater of $1,500,000 or five times the transaction value per violation, with each day of violation counted separately, materially raising compliance stakes for automotive suppliers and manufacturers.
- • The legislation requires the Secretary of Commerce to publish an authorized items list by January 1, 2027, and mandates 60-day Congressional notice before general or specific authorizations take effect, creating new procedural requirements not present in existing regulations.
Summary
Congress has introduced comprehensive bipartisan legislation designed to codify and significantly expand the connected vehicle regulatory framework established by the U.S. Department of Commerce. Senators Bernie Moreno (R-OH) and Elissa Slotkin (D-MI) introduced the Connected Vehicle Security Act of 2026 in the Senate on April 29, 2026, followed by identical House legislation introduced by Congressman John Moolenaar (R-MI) and Congresswoman Debbie Dingell (D-MI) on May 11, 2026. The bill would amend and extend existing restrictions codified in the Commerce Department's connected vehicle regulations administered under the Securing the Information and Communications Technology and Services Supply Chain (ICTS) authority.
The legislation represents a material departure from current restrictions in several critical respects. Most significantly, the CV Security Act expands the universe of restricted countries from China and Russia under existing regulations to include Iran and North Korea, effective January 1, 2027. The bill also broadens the definition of covered products substantially. While current regulations focus on Vehicle Connectivity System hardware and covered software, the proposed law adds battery electronics, airbags, airbag inflators, and seatbelts to the scope of restricted components. For covered software, the bill explicitly includes machine-learning models and artificial intelligence components that directly enable decision-making or control of automated driving systems, eliminating ambiguity in the current regulatory framework.
The substantive framework governing which products and manufacturers face restrictions undergoes a significant structural shift. Current regulations prohibit imports and sales of connected vehicles and related components designed, developed, manufactured, or supplied by persons owned by, controlled by, or subject to jurisdiction or direction of China or Russia. The CV Security Act instead focuses on country of origin and the manufacturer's principal place of business and incorporation, with specific numerical control thresholds: 15% equity, voting interest, board representation, or other indicia of control for connected vehicle manufacturers, and 25% for software developers and hardware manufacturers. This shift from ownership/control analysis to country-of-origin analysis diverges materially from the current regulatory approach and introduces objective numerical benchmarks.
Implementation timelines are staggered to accommodate market transition. Restrictions on connected vehicles and covered software take effect January 1, 2027, while connected vehicle hardware restrictions phase in between January 1, 2030, and January 1, 2032, with existing regulatory exclusions and exceptions subject to rulemaking review. The bill mandates that the Secretary of Commerce publish an authorized items list by January 1, 2027, identified by product name and manufacturer—a requirement absent from current regulations. Additionally, new procedural requirements impose 60-day Congressional advance notice and require the absence of an enacted joint resolution of disapproval before general or specific authorizations take effect.
Enforcement penalties are substantially increased, now set at the greater of $1,500,000 or five times the transaction value per violation, with each day of violation treated as a separate violation. This represents a significant escalation from existing enforcement mechanisms and materially raises compliance and due-diligence requirements for automotive suppliers, manufacturers, and related entities. The legislation is expected to evolve during the legislative process, with final implementation heavily dependent on Commerce Department rulemaking and statutory interpretation.
The legislation represents a material departure from current restrictions in several critical respects. Most significantly, the CV Security Act expands the universe of restricted countries from China and Russia under existing regulations to include Iran and North Korea, effective January 1, 2027. The bill also broadens the definition of covered products substantially. While current regulations focus on Vehicle Connectivity System hardware and covered software, the proposed law adds battery electronics, airbags, airbag inflators, and seatbelts to the scope of restricted components. For covered software, the bill explicitly includes machine-learning models and artificial intelligence components that directly enable decision-making or control of automated driving systems, eliminating ambiguity in the current regulatory framework.
The substantive framework governing which products and manufacturers face restrictions undergoes a significant structural shift. Current regulations prohibit imports and sales of connected vehicles and related components designed, developed, manufactured, or supplied by persons owned by, controlled by, or subject to jurisdiction or direction of China or Russia. The CV Security Act instead focuses on country of origin and the manufacturer's principal place of business and incorporation, with specific numerical control thresholds: 15% equity, voting interest, board representation, or other indicia of control for connected vehicle manufacturers, and 25% for software developers and hardware manufacturers. This shift from ownership/control analysis to country-of-origin analysis diverges materially from the current regulatory approach and introduces objective numerical benchmarks.
Implementation timelines are staggered to accommodate market transition. Restrictions on connected vehicles and covered software take effect January 1, 2027, while connected vehicle hardware restrictions phase in between January 1, 2030, and January 1, 2032, with existing regulatory exclusions and exceptions subject to rulemaking review. The bill mandates that the Secretary of Commerce publish an authorized items list by January 1, 2027, identified by product name and manufacturer—a requirement absent from current regulations. Additionally, new procedural requirements impose 60-day Congressional advance notice and require the absence of an enacted joint resolution of disapproval before general or specific authorizations take effect.
Enforcement penalties are substantially increased, now set at the greater of $1,500,000 or five times the transaction value per violation, with each day of violation treated as a separate violation. This represents a significant escalation from existing enforcement mechanisms and materially raises compliance and due-diligence requirements for automotive suppliers, manufacturers, and related entities. The legislation is expected to evolve during the legislative process, with final implementation heavily dependent on Commerce Department rulemaking and statutory interpretation.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.