Connected Vehicle Security Act Advances in Senate

The Connected Vehicle Security Act of 2026 cleared the Senate Commerce Committee on July 22, marking a significant step toward enactment but not final passage. The bipartisan measure, led in the Senate by Sens. Bernie Moreno and Elissa Slotkin, was introduced as S. 4429 in April; companion legislation was subsequently introduced in the House by Reps. John Moolenaar and Debbie Dingell. It must still pass both chambers in identical form and be signed by the president before becoming law. GovInfo

If enacted, the bill would prohibit connected vehicles originating from—or controlled by—China, Russia, Iran or North Korea from entering the U.S. market beginning in 2027. It would also restrict connected-vehicle software linked to those countries from 2027 and covered hardware from 2030. The Commerce Department would oversee compliance through declarations of conformity, waivers, authorizations and advisory rulings, with substantial civil penalties available for violations. 

The legislation would build on Commerce Department regulations finalized in January 2025 covering certain Chinese- and Russian-linked vehicle connectivity systems and automated-driving software. By placing broader protections in statute and extending them to Iran and North Korea, the bill would make the policy more durable while requiring automakers and suppliers to trace the ownership and origin of critical software, communications equipment and other covered components. In practice, manufacturers could face near-term compliance and supply-chain costs, but the phased deadlines are intended to give the industry time to replace prohibited technology. 

Volvo's Dodge

Although Volvo Cars exceeds the bill’s Chinese-ownership threshold, its existing Commerce Department authorization would preserve its ability to sell connected vehicles in the United States through 2031, unless the authorization is modified or revoked.

Longer-term U.S. sales would likely depend on securing a new authorization and continuing to demonstrate adequate governance, technology and data-security safeguards.