H.R. 8730 — Connected Vehicle Security Act of 2026

This section makes findings regarding the national security and economic risks posed by vehicles and components controlled by foreign adversaries. It states that the United States automotive industry supports millions of jobs and that the People’s Republic of China exports nearly 8,000,000 vehicles annually—approximately twice the volume of any other country—while highlighting risks from connected vehicle technologies that collect sensitive data and may be subject to remote access or control.

This section defines key terms for purposes of the Act, including automated driving system, connected vehicle (excluding rail-only vehicles), covered country (i.e., North Korea, China, Russia, and Iran), covered software (including machine-learning models enabling automated driving), electric vehicle, resale, safety equipment, transaction (including ongoing activities such as software updates), vehicle connectivity system (enabling radio frequency communications over 450 megahertz), and vehicle connectivity system hardware (including microcontrollers, cellular modems, and battery-integrated systems).

This section prohibits, on and after January 1, 2027, the importation, manufacture, sale, resale, or introduction into interstate commerce of connected vehicles whose country of origin is a covered country or that are designed in a covered country, or whose manufacturer is a joint venture, subsidiary, or other entity in which more than 15 percent of equity interest, voting interest, board representation, or other indicia of control is held by entities organized under the laws of or with a principal place of business in a covered country. It further prohibits the integration of covered software whose country of origin is a covered country or whose developer is organized under the laws of or has its principal place of business in a covered country, or in which more than 25 percent of equity interest, voting interest, board representation, or other indicia of control is held by such entities. On and after January 1, 2030, the section prohibits the importation, manufacture, sale, resale, or introduction into interstate commerce of connected vehicle hardware meeting the same country-of-origin or 25-percent control criteria, while exempting hardware imported for repair or warranty purposes on connected vehicles with model years before 2030. The section directs the Secretary to issue regulations prohibiting any transaction relating to connected vehicles, covered software, or connected vehicle hardware that the Secretary determines poses an undue or unacceptable threat to U.S. economic or national security, and authorizes the Secretary, in consultation with the Secretaries of Defense, Transportation, State, and Energy, to issue general or specific authorizations for otherwise prohibited items upon a determination, based on clear and convincing evidence and a written risk assessment, that the item does not pose specified risks to data, critical infrastructure, or national security.

This section authorizes the Secretary of Transportation to consult with existing advisory committees, including the Advisory Committee on Automation in Transportation, on matters relating to connected vehicles and associated national security risks. Consultation may address data security, cybersecurity, and supply chain integrity risks; the effectiveness of authorities under this Act; emerging technologies and threat vectors; and related regulatory, enforcement, and policy recommendations. The section also authorizes the Secretary to coordinate with the Federal Communications Commission and other relevant agencies to align the scope, timeline, and implementation of any prohibitions or restrictions and to avoid duplicative or conflicting requirements.

This section directs the Secretary to submit to Congress, not later than one year after the date of enactment of this Act and annually thereafter, reports on enforcement of the prohibitions under section 4. The reports must describe enforcement actions and resources utilized; provide a detailed accounting of covered items; explain any exclusions, exemptions, or determinations and the criteria applied; assess effectiveness in reducing threats to U.S. economic and national security from connected vehicles; include metrics on enforcement, compliance rates, violations, penalties, and identified gaps; and offer recommendations for further decreasing such threats.

This section provides a severability clause ensuring that if any provision of the Act or its application is held invalid, the remainder of the Act remains in effect. It also authorizes the Secretary to reissue or reinstate, in whole or in part, regulations similar to those in effect the day before enactment if a court invalidates a provision of the Act that supersedes regulations prescribed under section 4.

This section (1) preserves the Secretary of Commerce’s authority to implement or administer subpart D of part 791 of title 15, Code of Federal Regulations, as added by the final rule entitled “Securing the Information and Communications Technology and Services Supply Chain: Connected Vehicles”; (2) delays implementation of the prohibitions under section 4(a)(2) and (3) for covered software and connected vehicle hardware not subject to those regulations until after January 1, 2030, and before January 1, 2032; and (3) maintains the validity of prior exclusions and exceptions under the regulations, subject to a rulemaking under 5 U.S.C. 553 beginning January 1, 2030, to determine whether they should be continued, modified, or terminated.