Connected Vehicle Security Act of 2026

The ban covers new sales by importers, carmakers, and dealers. A car already titled to and used by a driver is left out, so trade-ins and used sales would still be legal.

The 2030 ban on connected parts would not apply to parts for a model older than 2030. That covers parts brought in for repairs or to honor a warranty.

The $1.5 million minimum fine would not apply to a person bringing in a car they own, lease, or rent for personal use. This holds only if they did not know it was banned.

Commerce would have to write rules, after public comment, that block specific uses it finds risky. These can include software updates, data service, and repairs. Anyone named in such an order would get a certified letter naming the item.

Cars made, designed, or shipped from China, Russia, Iran, or North Korea could not be sold here starting January 1, 2027. Carmakers more than 15 percent owned or controlled from those countries are covered too.

Today's Commerce rule already covers some car software and parts. For software it does not reach, the ban would start with 2029 models. For parts it does not reach, the ban would start with 2032 models.

An approval granted under today's Commerce rule, or before 2030 under this law, would end on its own date or January 1, 2030, whichever comes first. Commerce could change or cancel it sooner.

The car ban would not apply to models older than 2030 for firms that have sold cars or run a car fleet here for five years. It also covers cars bought under contracts signed before the law. These firms would send Commerce a yearly plan to comply, kept confidential.

A company would pay no fines for a year while it fixes a violation. It must report the problem quickly, cooperate, and not have acted on purpose or tried to dodge the law.

Each banned sale would cost at least $1.5 million, or five times the sale value, whichever is greater. Every day a violation continues counts as a new one.

Importers, carmakers, and dealers would file a signed statement with Commerce before each sale. It would state that the car, part, or software is not banned.

Commerce would have to write rules for connected vehicles over 10,000 pounds, such as big trucks and buses, by the end of 2028. Those rules must take effect by the end of 2032.

The bill's findings say connected cars gather location and personal data and can be reached remotely. Cars and car software from China, Russia, Iran, and North Korea would be kept out of the U.S. market.

Commerce could rely on classified information to enforce the ban. A judge could review that material in private, without the company fighting the order seeing it.

Going to court would not put an enforcement action on hold. It would keep running unless the judge orders otherwise.

Unless the bill says otherwise, Commerce actions would not follow the main federal law on agency procedure. That law sets rules for public comment, hearings, and court review of agency decisions.

Commerce would publish which otherwise-banned items it has allowed, with the maker and product name where possible. It would also explain why each one is not a risk.

When Commerce grants an exception, it would send Congress its written risk review, minus trade secrets. Starting in 2030, an exception would not stand if Congress passes a law to cancel it.

Commerce would publish the items it has ruled on and update that list at least once a year. It could not publish the name of the company that asked, or anything else identifying it.

If a court strikes down part of this law or its rules, Commerce could bring back the rules in place before the law. It could do so without the usual public notice and comment.