S. 4429 Would Add a Whole-Vehicle Ban Beyond the BIS Rule · Traverse Analysis
S. 4429 Would Add a Whole-Vehicle Ban Beyond the BIS Rule
Primary lensExport controls
Sub-topicLicensing regime
Evidence base6 records used
Use caseExport-control exposure
S. 4429 would create a separate whole-vehicle screen
The Senate Commerce Committee has scheduled S. 4429, the Connected Vehicle Security Act of 2026, for a July 15 markup. The introduced bill would preserve Part 791 and add a separate whole-vehicle prohibition keyed to vehicle origin, design location, and manufacturer control. That prohibition can apply even when the vehicle contains none of the software or hardware covered by today's Bureau of Industry and Security regulations.
That distinction changes the compliance question. Section 4 of the bill would bar the importation, manufacture, sale, resale, or introduction into interstate commerce of a connected vehicle from January 1, 2027 when the vehicle has a covered-country origin, was designed in a covered country, or was made by a manufacturer above a specified covered-country ownership or control threshold. The prohibition would apply regardless of whether covered software or connected-vehicle hardware is present, removed before the transaction, or installed later.
The starts elsewhere. It regulates transactions involving Vehicle Connectivity System hardware and covered software linked to China or Russia, then separately restricts certain sales and commercial services by connected-vehicle manufacturers subject to Chinese or Russian ownership or control. Its declarations ask whether the regulated software and hardware supply chain is clean. S. 4429 would also ask whether the vehicle itself fails a statutory origin, design, or control test.
An importer could therefore have a satisfactory software bill of materials and hardware bill of materials under Part 791 and still face a prohibited vehicle under the introduced bill. That is the central operating consequence of the text now headed to markup.
The 2027 file starts with origin, design, and control
The bill's vehicle test has three different factual routes. Each needs its own evidence.
The first route is country of origin. S. 4429 defines that term for the bill rather than cross-referencing customs origin law. An item's country of origin would include the country where it is manufactured. It would also include a country whose government owns or controls, or has jurisdiction or direction over, the entity that manufactures or supplies the item. A customs marking conclusion or tariff-origin certificate may contain relevant facts, but it does not answer that statutory definition by itself.
The second route is design location. Under section 4(a)(1), a connected vehicle designed within China, Russia, Iran, or North Korea would fall into the vehicle prohibition even if final assembly occurs elsewhere. The bill does not define the point at which a vehicle is designed within a country. If the text advances unchanged, companies will need to identify who owns the platform architecture, where the relevant design work occurred, and which entity controlled the design decisions. A final-assembly address will not close that inquiry.
The third route is manufacturer ownership or control. The bill's manufacturer test would reach a joint venture, subsidiary, or other entity when more than 15 percent of its equity, voting interest, board representation, or other indicia of control is held directly or indirectly by one or more entities organized in a covered country or principally based there. This is not merely a majority-control rule. It is a low, multi-factor threshold that reaches board rights and other control indicators as well as shares.
The evidence file must expand to the vehicle level. It should show the manufacturing country, design locations, manufacturer organization and principal place of business, direct and indirect ownership, voting rights, board representation, contractual controls, and any facts that could change during the model year. Supplier questionnaires limited to component origin will leave the vehicle-level test unanswered.
Commercial-vehicle reach turns on the carry-forward clause
The current rule expressly excludes a connected vehicle with a gross vehicle weight rating above 10,000 pounds. BIS explained in its January 2025 final rule that it was limiting the action to passenger vehicles while considering a separate commercial-vehicle rule for trucks and buses.
S. 4429 uses a broader definition. It covers a mechanically powered vehicle made primarily for public streets, roads, and highways when it has, or was originally equipped to have, specified wireless communications capability. The only express vehicle exclusion in that definition is for a vehicle operated solely on rail. The introduced definition contains no 10,000-pound ceiling.
That difference raises a commercial-vehicle question rather than resolving one. Section 8(c)(1) says that any exclusion or exception to a prohibition under the current Part 791 rule would remain valid and apply to the bill's section 4(a) prohibitions. The 10,000-pound limit sits in Part 791's definition of connected vehicle. The introduced bill does not say whether that definitional limit is an exclusion that carries forward. Commerce would begin a rulemaking in 2030 on whether inherited exclusions and exceptions should continue, change, or end, but the text leaves the pre-2030 treatment of heavy vehicles open to interpretation.
A fleet or manufacturer should therefore test both readings rather than assume that heavy vehicles are inside or outside the proposed perimeter. The same vehicle definition would cover a vehicle whose communications function is disabled or removed at the time of the relevant transaction if it was originally equipped or designed to communicate, subject to the same carry-forward question. For long production cycles, companies should preserve the whole-vehicle origin, design, and ownership record while tracking any committee amendment or Commerce interpretation that resolves the weight-limit issue.
New component categories run on a later clock
The bill also changes the component perimeter, but on a different timetable. Its covered software and hardware definitions include machine-learning models and other artificial-intelligence components that directly enable decision-making or control of an automated driving system at the vehicle level. The hardware definition lists the familiar communications modules, processors, antennas, and programmable devices. It then expressly adds electronics integrated into a battery that directly enable or control monitoring, management, security, or external communication. It also includes air bags, air bag inflators, and seatbelt systems through a separate safety-equipment definition.
Those items are not all treated the same way under current Part 791. The current rule focuses on VCS hardware that directly enables the communications function and excludes items that exclusively supply or manage power for the VCS. The bill's text is therefore capable of reaching product categories that the present VCS file may not inventory.
The effective dates are staggered. For software and hardware already covered by Part 791, the bill sets January 1, 2027 and January 1, 2030. Section 8 would delay software and hardware newly covered beyond Part 791 until a date after January 1, 2030 and before January 1, 2032. The separate whole-vehicle prohibition does not carry that delayed-new-component language.
The vehicle and component prohibitions run on different clocks. The vehicle origin, design, and 15 percent control test would arrive first in 2027. Newly added component categories could follow between 2030 and 2032. Treating the later component window as a delay for the whole bill would misread the structure.
The 2025 rulemaking points to an additive file
The January 2025 BIS rule split the compliance record by hardware, software, manufacturer status, and model year. S. 4429 would add a vehicle-level record on top of that architecture rather than replace it. That precedent supports an additive evidence file, but it does not answer the bill's separate origin, design, or control tests.
The bill expressly preserves Commerce's authority to administer the current Part 791 connected-vehicle rules. It also carries existing exclusions and exceptions into the new statutory prohibitions, subject to a rulemaking beginning in 2030 on whether they should continue, change, or end. Existing general and specific authorizations issued before 2030 would generally remain in effect until January 1, 2032 unless Commerce modifies, suspends, or revokes them under the bill's conditions.
The proposed statute would not erase the current declarations, recordkeeping duties, general authorizations, specific authorizations, advisory opinions, or enforcement process. A company would need to know which protection comes from Part 791, which prohibition comes from S. 4429, and whether a carried-forward exclusion answers both. The safe record is a crosswalk, not a merged conclusion.
One side of the crosswalk should track the present VCS hardware and covered-software rules, including HBOM and SBOM support, model-year groupings, supplier evidence, authorizations, and material changes. The other should track the bill's vehicle and component definitions, covered countries, design facts, ownership thresholds, transaction types, and effective dates. A conclusion under one column should not be copied into the other without identifying the provision that makes it work.
Statutory authorizations add congressional notice
Current Part 791 lets BIS issue specific authorizations after a case-by-case risk review. The agency states that decisions are not made public and generally allows 90 days for a decision, subject to additional time. Advisory opinions carry a 60-day target, but BIS may extend the review or decline to issue an opinion within that period.
Section 4(c) would create a more structured authorization gate for items otherwise prohibited by the statute. Commerce would have to find clear and convincing evidence, supported by a written risk assessment, that the item does not pose and is not reasonably likely to pose the listed national-security risks. At least 60 days before the authorization takes effect, Commerce would have to send Congress a detailed notice and the underlying analysis. The authorization could not take effect if a joint resolution of disapproval became law during that period.
The bill would also require a procedure for binding rulings or advisory opinions and call for a decision within 45 days after a sufficiently clear application. It would require publication of a list of ruled-on items while protecting the requester's identity. These provisions could improve the value of advance guidance. Only an authorization under section 4(c), not a ruling or advisory opinion under section 4(d), would face the 60-day congressional-notice condition.
The penalty language raises the cost of getting the scope wrong. For each prohibited transaction, the introduced bill sets a civil penalty of at least the greater of $1.5 million or five times the transaction value. Each day of a continuing violation would count separately. That is a reason to settle the applicable definition and transaction count before relying on a commercial workaround.
Importers should build the crosswalk before model lock
The immediate task is not to certify compliance with a bill that has not passed. It is to find the missing evidence while contracts, designs, and supplier relationships can still be documented.
Start at the vehicle level. Record every manufacturing location and the entities responsible for platform and systems design. Map direct and indirect ownership, voting rights, board seats, contractual rights, and other control indicators for the vehicle manufacturer. Test the map against the bill's more-than-15-percent threshold and preserve dated corporate records showing the result.
Then move to software and hardware. Identify developers and manufacturers, their places of organization and principal business, and the ownership and control chain needed for the more-than-25-percent component tests. Expand the component inventory to flag battery-control electronics and safety equipment that may sit outside today's VCS workstream. Keep the existing Part 791 HBOM, SBOM, Declaration of Conformity, authorization, advisory, and ten-year recordkeeping files intact.
Finally, connect each conclusion to the planned transaction. The bill separately names importation, manufacture, sale, resale, and introduction into interstate commerce, and its transaction definition also reaches installation, managed services, data transmission, software updates, repairs, hosting, and arrangements designed to evade the statute. The relevant evidence owner may differ by transaction. Procurement may own the supplier chain, corporate legal may own the control analysis, engineering may own design provenance, and import compliance may own entry records. The crosswalk should name each owner and the date when the evidence must be refreshed.
Markup is the first change point
The July 15 committee agenda is subject to change, and the committee could adopt a substitute or amendments. The introduced text is therefore a planning marker, not a final compliance instruction. The most consequential items to watch are the whole-vehicle prohibition, the interaction between its broader vehicle definition and the carry-forward clause, the four-country list, the 15 percent and 25 percent control thresholds, the treatment of newly covered components, and the relationship between statutory authorizations and existing Part 791 relief.
The proposal also has a second procedural marker. Senator Moreno submitted Senate Amendment 5977, a related but materially different connected-vehicle measure intended for the fiscal 2027 defense authorization bill. It was ordered to lie on the table. Unlike introduced S. 4429, it retained a 10,000-pound GVWR ceiling and used a foreign-entity-of-concern test. Submission did not make the amendment law or add it to the defense bill, but it shows that connected-vehicle restrictions have been positioned for more than one legislative path.
If S. 4429 does not advance or the whole-vehicle provisions are removed, Part 791 remains the operative federal connected-vehicle rule. If the introduced architecture survives, the decisive change will be the extra vehicle-level test. A clean modem, software stack, or supplier authorization will remain relevant. It will no longer be the end of the inquiry.
Free account
Keep reading with a free account.
Today's analysis is open to everyone. A free account opens the full archive and full tool output. No card required.