The ban already exists. That is the part that keeps getting lost.
Since March 17, 2025, it has been unlawful to import or sell a passenger vehicle in the United States that runs connectivity or automated-driving software developed by a company owned by, controlled by, or subject to the direction of China or Russia. The same Commerce Department rule bars Chinese- and Russian-controlled automakers from selling connected vehicles here at all, no matter where the plant sits or where the parts came from. It is codified, it is in force, and it is available for anyone to read in the Federal Register.
So when the Senate spends a week haggling over a bill described as banning Chinese cars, the useful question is what is actually being haggled over. It is not the prohibition. It is the exception.
The Connected Vehicle Security Act of 2026 is not primarily a ban bill. It is a permissions bill. Its most consequential language has nothing to do with showrooms and everything to do with who may sign a waiver, on what evidence, and how much of that decision the rest of us get to see.
A rule is only as strong as the authority underneath it
Here is the piece that explains the timing. The existing ban is not built on trade law or safety law. It rests on the International Emergency Economic Powers Act and Executive Order 13873, the 2019 order that declared a national emergency over the information and communications technology supply chain. That emergency has to be renewed. Every year. The Commerce rule itself lists the annual continuations, one per year since 2020, like rings on a tree.
Which means the current ban can be unwound without a single vote in Congress. No floor time, no conference committee, no filibuster. A future administration needs a rulemaking notice and a signature.
That is the vulnerability the sponsors, Senators Bernie Moreno and Elissa Slotkin, are actually addressing, and it explains why an industry that already enjoys the protection is spending real money to have the same protection written twice. General Motors and the United Auto Workers both endorsed the bill on the day it was introduced. Companies do not lobby for redundancy. They lobby for permanence.
The waiver machine is the actual policy
Read the bill’s authorization section and the shape of the thing becomes clear. Commerce could still let a prohibited item into the country, but only after clearing a set of hurdles that are unusual in trade regulation. The Secretary, consulting Defense, Transportation, State and Energy, would have to find on “clear and convincing evidence,” supported by a written risk assessment, that the item poses no undue risk of data exfiltration, remote manipulation, or harm to critical infrastructure and the domestic industrial base.
Then comes the part that matters. The waiver cannot take effect for 60 days, during which Commerce must hand Congress the determination and the underlying analysis. If Congress enacts a joint resolution of disapproval inside that window, the waiver dies.
That is the Congressional Review Act’s logic, applied not to a rule but to individual parts. Congress has long claimed that kind of look-in on arms sales. Applying it to telematics control units and battery electronics is new, and it is a meaningful transfer of power from the executive branch to the legislative one.
There is a transparency mechanism attached, and it is the provision most likely to surprise people. Commerce would have to publish and maintain a public list of every authorized item, naming the manufacturer and the product where possible, along with a detailed explanation of why each one does not pose a risk. Where naming is impossible, the department would have to publish technical criteria specific enough that importers can work out the answer themselves. The first list would be due by January 1, 2027.
Why automakers want their own handcuffs
If you have never sourced a vehicle program, the industry’s enthusiasm looks like protectionism and nothing else. It is also engineering logistics. A telematics control unit going into a 2030 vehicle is chosen, validated and locked into tooling years before the first customer sees it. Regulatory certainty is worth more to a program manager than regulatory leniency, because a lenient rule that flips costs more than a strict rule that holds. A published list of approved parts, with a 45-day turnaround on binding rulings, is a bankable answer. A discretionary waiver that can be revoked by the next administration is not.
Automakers also already built the plumbing. The 2025 rule requires manufacturers and connectivity-hardware importers to file Declarations of Conformity with Commerce ahead of each model year, backed by software and hardware bills of materials detailed enough to identify the author, timestamp, component and supplier behind proprietary additions to the code, with records kept for a decade. Your car now needs a provenance file for its software. That work is done and paid for. Having spent it, the industry would rather see the standard locked in than rewritten.
Where the bill goes further than the rule
The statute would not simply ratify the regulation. It reaches past it in ways worth knowing.
The 2025 rule applies only to vehicles rated at or below 10,000 pounds gross vehicle weight. Heavy trucks and buses sit outside it. The bill’s definition of a connected vehicle carries no weight ceiling at all; the only carve-out is for vehicles that run on rails. It also widens the list of covered countries beyond China and Russia to include Iran and North Korea.
It closes the de-content loophole, too. A vehicle counts as connected if it was designed, manufactured or originally equipped to communicate, “regardless of whether such capability is enabled, disabled, or removed.” You cannot unplug the modem on the dock and call it a different car. A companion provision voids anything renamed, rebranded or restructured to dodge the prohibition.
Then there is ownership. The prohibitions attach not only to companies organized in a covered country but to joint ventures and subsidiaries in which a covered-country entity holds more than a set share of equity, voting interest, board representation or other indicia of control. The version introduced in April set that share at more than 25 percent. The number has moved during committee work, and it remains the most contested figure in the bill, because it determines whether a handful of European and Asian automakers with Chinese shareholders are inside or outside the wall. We walked through the reported text’s ownership threshold and its collateral damage when the committee acted.
The definition of a prohibited transaction is broader than most readers will expect. It covers acquisition, importation, installation and use, and explicitly includes ongoing activity: managed services, data transmission, software updates, repairs, and the hosting of apps for consumer download. Under that definition, pushing an over-the-air update can be the violation. Civil penalties start at the greater of $1.5 million or five times the value of the transaction, and each day a violation continues counts as a separate one.
What it means in the service bay
The hardware prohibition would begin January 1, 2030, and the repair exemption is narrower than it first appears: parts imported for repair or warranty work are exempt when they go into a vehicle with a model year before 2030. That builds a permanent two-tier parts world. A 2029 vehicle and a 2031 vehicle can carry the same module and live under different sourcing rules for the rest of their lives. Body shops, insurers and parts distributors will be reading model years off VINs to know which catalog they are allowed to buy from.
Used cars are handled more gently. The bill’s definition of resale excludes vehicles previously titled to and used by a consumer, so private sales and normal used-car retailing do not become federal violations.
The hardware definition also reaches beyond radios. It picks up the electronics built into a battery that monitor, manage, secure or communicate about its performance, and it names safety equipment, which the bill defines as air bags, air bag inflators and seat belt systems. Commerce had considered battery management systems in its early rulemaking and then dropped them from the final rule; the statute puts them back and adds restraints on top. Our earlier reporting covered how far that component list stretches.
That deserves a sober look rather than a cheer. The largest safety recall in American history involved air bag inflators: roughly 67 million of them, by NHTSA’s count. Its lesson was not only that a supplier failed. It was that inflator manufacturing is so concentrated that when one source goes bad, replacement parts take a decade to reach cars. Narrowing an already narrow supplier pool is a defensible national-security choice. It is not a free one, and the bill’s own phase-in language concedes as much: for software and hardware that the 2025 rule does not already cover, Commerce could not implement the prohibition until after January 1, 2030, and would have to do it before January 1, 2032.
What to watch
The bill cleared the Senate Commerce Committee unanimously in late July, which its sponsors announced as a bipartisan milestone. Legislation with that profile usually moves fastest by unanimous consent, an option that disappears the moment one senator objects. As of this writing the Senate has not passed it, and the House companion has not been voted on.
Meanwhile the policy keeps arriving in pieces. Commerce owns the sale and import side. We have already explained why a Chinese automaker could build a U.S. factory tomorrow and still not sell you the car, and why the rule that blocks them has nothing to do with where the plant is. The same fragmentation shows up in autonomy, where the United States still hands out permission slips one vehicle at a time.
If you forget every date and dollar figure in this piece, keep one idea. The argument in Washington is no longer about whether Chinese vehicle technology gets into American cars. That question was settled by regulation eighteen months ago. The argument is about who holds the pen that writes the exceptions, and whether the rest of us get to read what it writes.
Bans make headlines. Waivers make policy.