Bill would ban connected vehicles and key vehicle software and hardware tied to China, Russia, Iran, and North Korea

Importing, making, selling, reselling, or introducing into interstate commerce a connected vehicle would be prohibited if it is primarily designed, developed, or made in, or supplied from, North Korea, China, Russia, or Iran, or if its maker, developer, designer, or supplier is a foreign entity of concern. A connected vehicle is a road vehicle of 10,000 pounds or less that can connect wirelessly. The ban applies even if connected software or hardware is removed before sale or added after. Foreign entities of concern include people and companies based in or controlled by those countries. A vehicle of a model year before 2030 is excepted if it is made, bought under an existing contract, or run in a fleet by a company that sells or operates passenger vehicles in the U.S. at enactment and has done so for at least 5 years. The ban starts January 1, 2027.

Putting covered software into a connected vehicle of model year 2027 or later would be prohibited if the software is designed, developed, or made in, or supplied from, a covered country, or comes from a foreign entity of concern. Covered software is vehicle software that directly enables a vehicle's wireless connection or its automated driving, including machine-learning models. It excludes most open-source software and subcomponents made before March 17, 2026. For software not covered by existing Commerce rules, the Secretary may not apply the ban to software in vehicles before model year 2029.

Putting vehicle connectivity system hardware into a connected vehicle would be prohibited if the hardware is made in, or supplied from, a covered country, or by a foreign entity of concern. The hardware includes microcontrollers, chips, telematics units, cellular modems, Wi-Fi, Bluetooth, and satellite modules, antennas, and electronics that control or communicate on electric vehicle batteries. The ban does not apply to hardware in vehicles of model years before 2030, or to hardware imported for repair or warranty of those vehicles. For hardware not covered by existing Commerce rules, the Secretary may not apply the ban to vehicles before model year 2032. The ban starts January 1, 2030.

The Commerce Secretary may authorize an otherwise banned vehicle, software, or hardware if the Secretary finds it does not pose an undue risk of data theft, remote control, harm to critical infrastructure, or other national security risk. The Secretary must give Congress a written notice and risk assessment. Makers must file a declaration of conformity before importing or selling, and the Secretary must issue advisory opinions within 45 days of a complete application. For authorizations on or after January 1, 2030, none may take effect if a joint resolution of disapproval is enacted. A company from a covered country can get a vehicle authorization only if it has sold passenger vehicles in the U.S. at enactment and made them in the U.S. for at least 5 years.

The Secretary must assess a civil penalty for each violating transaction of at least $1,500,000 or five times the transaction's value, whichever is greater, and each day of a continuing violation counts separately. A violator that promptly discloses the violation, cooperates, completes the cure, and did not act willfully gets a one-year safe harbor period without penalties. An individual who brings a personal-use vehicle into the U.S. without knowing it is banned is not penalized. The Secretary may rely on classified information, which a reviewing court may see in private. Filing a petition for review does not pause an action unless the court orders it.