Connected Vehicle Security Act of 2026

What It Means for Battery Pack Producers

Summary for battery pack producers

If your battery management system (BMS), the microcontrollers, communication chips, or software that monitor and control a battery pack, is designed, developed, or manufactured by an entity from China, Russia, Iran, or North Korea, it will be illegal to import, manufacture, sell, resell, or introduce into U.S. commerce starting on a fixed schedule: software by January 1, 2027, hardware by January 1, 2030.

This applies regardless of vehicle weight, closing an exemption that currently protects heavy trucks and buses. There is no phase-out for existing designs. Producers need to requalify BMS supply chains against country-of-origin and ownership tests now, not when the bill is enacted.

What the bill actually does

The Connected Vehicle Security Act of 2026 (S.4429 / H.R.8730) is real, bipartisan legislation, not a rumour or a leak. It was introduced by Sens. Bernie Moreno (R-Ohio) and Elissa Slotkin (D-Mich.) on April 29, 2026, with a House companion from Reps. John Moolenaar (R-Mich.) and Debbie Dingell (D-Mich.) on May 11, 2026. It builds on and tightens an existing Commerce Department rule, rather than starting from scratch.

The existing rule it’s building on: In January 2025, the Bureau of Industry and Security (BIS) finalized a rule (“Securing the Information and Communications Technology and Services Supply Chain: Connected Vehicles,” 90 Fed. Reg. 5360) restricting Vehicle Connectivity System (VCS) hardware and software tied to China and Russia. That rule deliberately left BMS out unless it had its own external wireless link, and it exempted any vehicle over 10,000 lbs gross vehicle weight, meaning commercial trucks and buses were untouched.

What the new bill changes:

• Adds two countries. Iran and North Korea join China and Russia as “covered countries.” The existing BIS rule only covers China and Russia.
• Explicitly pulls in battery electronics. The bill’s definition of restricted hardware now includes, verbatim, “electronic systems integrated into a battery that directly enable or control the monitoring, management, security, or external communication of battery performance or operation, including any transmitter or interface component that performs such functions.” That is BMS microcontrollers, comms interfaces, and any transmitter. Even if the battery pack has no independent wireless link (the loophole the original rule left open).
• Removes the weight exemption. The bill’s definition of a “connected vehicle” has no weight threshold at all, only a carve-out for rail vehicles. Heavy-duty EV trucks and buses, previously exempt above 10,000 lbs, are now fully in scope.
• Adds a lower ownership threshold for hardware/software. A supplier is “covered” if 25% or more of its equity, voting interest, or board representation is controlled by a covered-country entity (15% for the vehicle manufacturer itself).

Why now: the security backdrop

Congress is citing a real, documented risk pattern, though one specific data point in circulating summaries needs a correction. In July 2026, India’s government ordered several Bluetooth-linked BMS apps (BAT-BMS, Epoch-i-ion, Lossigy) pulled from app stores after viral videos showed people remotely disabling moving e-rickshaws by pairing with unsecured, unauthenticated battery packs from close range. This was a real vulnerability and a real enforcement action, but it was an India-specific ban on low-cost, unbranded e-rickshaw battery packs, not a global ban and not (so far) linked to passenger EVs from major manufacturers. It’s a legitimate example of the risk category lawmakers are worried about, not evidence of a worldwide recall.

This post has been built based on the support of and sponsorship from: illumion, Custom Power, Quarto Technical Services, Eatron Technologies and About:Energy

Does this apply to 12V and 48V mild-hybrid (MHEV) batteries?

Likely yes, and this is a broader sweep than most readers assume. The bill isn’t limited to high-voltage EV traction packs.

On the vehicle side, the “connected vehicle” definition (Section 3(2)) is powertrain-agnostic: it just requires a public-road vehicle with, or designed to have, wireless connectivity. It doesn’t distinguish ICE, mild-hybrid, full-hybrid, plug-in, or battery-electric. Virtually every modern MHEV platform has telematics, so the vehicle itself clears that bar the same way a BEV would.

On the battery side, Section 3(14)(B)(ii) covers “electronic systems integrated into a battery that directly enable or control the monitoring, management, security, or external communication of battery performance or operation,” with no voltage or chemistry qualifier anywhere in the text. A 12V smart battery sensor or a 48V mild-hybrid pack’s BMS that monitors state-of-charge, manages cell balancing, or communicates over the vehicle network fits that language just as literally as a full EV traction pack’s BMS does.

The one real ambiguity: Section 3(14)(A) sets a general three-part test for “VCS hardware” (installed in/on the vehicle, directly connected to a VCS, and directly enabling VCS function) before subsection (B) says the term “includes” the battery-electronics language. It isn’t settled whether (B) items must independently satisfy (A)’s “directly connected to a VCS” prong, or whether (B) stands alone. That matters specifically for low-voltage systems: a 12V/48V BMS that only talks over the internal CAN bus, not wired directly to the telematics/VCS module, might escape coverage under the strict reading. This is exactly the gap that let BMS dodge the existing BIS rule in the first place, and exactly what Congress appears to be trying to close by adding battery language at all. Given that intent, the more likely reading is that battery electronics are covered regardless of a direct VCS connection, but this would ultimately be resolved by BIS through the bill’s ruling/advisory-opinion process (Section 4(d)) or implementing regulations. No legal commentary has addressed this narrower question yet.

Practical takeaway: don’t assume a 12V or 48V system is out of scope just because it isn’t a full EV pack. The statute reads on function (monitor, manage, communicate), not voltage class or chemistry, so mild-hybrid 48V packs and even smart 12V starter batteries with communicating BMS chips are plausibly in-scope if sourced from a covered country.

Timeline

Penalties: civil penalties of at least $1.5 million or five times the transaction value, per violation, with each day of a continuing violation counted separately.

Status as of this writing: passed Senate Commerce Committee unanimously (not merely “under consideration”). Still needs a full Senate floor vote and House committee action before it could reach the President.

Does this apply to grid-scale battery energy storage (BESS)?

No, and the reason is structural, not incidental. The bill’s definition of “connected vehicle” (Section 3(2)(A)) is limited to “a vehicle driven or drawn by mechanical power and manufactured primarily for use on public streets, roads, and highways.” A stationary grid-storage installation isn’t a vehicle under any reading of that text, and the BMS/battery-electronics language only applies as “connected vehicle hardware,” hardware installed in or on something that already qualifies as a vehicle. So even though a grid-storage BMS may be functionally similar to an EV pack’s BMS, CVSA’s gating definition excludes it outright.

Grid-scale BESS security is instead the subject of separate, much earlier-stage legislation: the CHARGE Act (H.R.7635), introduced by Rep. Greg Steube (R-Fla.) on February 20, 2026, would ban energy storage systems with remote-monitoring capability tied to Chinese entities, citing the same espionage-risk logic (a January 2026 RAND Corporation commentary flagged CATL and BYD by name as suppliers whose firmware and software could pose malware risk to the grid). Unlike CVSA, the CHARGE Act has no cosponsors and is sitting in the House Ways and Means Committee with no scheduled markup. A separate, narrower bill from Rep. John Moolenaar would bar DHS from procuring batteries from six PRC-aligned manufacturers, a federal procurement restriction, not a market-wide ban.

Bottom line for producers with shared EV/stationary-storage BMS platforms: the EV side of your business is on CVSA’s fixed 2027/2030 clock; the stationary-storage side currently has no comparable statutory deadline. CHARGE Act is the one to watch if it picks up cosponsors or gets attached to a larger vehicle like the NDAA.

References

1. S.4429 – Connected Vehicle Security Act of 2026, congress.gov
2. H.R.8730 – Connected Vehicle Security Act of 2026, congress.gov
3. S.4429 bill text (PDF), moreno.senate.gov
4. Slotkin, Moreno Bill to Protect National & Economic Security from Chinese Vehicles Advances Unanimously, slotkin.senate.gov
5. Moolenaar, Dingell Joint Statement on Senate Commerce Committee Passage, chinaselectcommittee.house.gov
6. Connected Vehicles Face Growing National Security Scrutiny Under Defense Bill, Holland & Knight
7. Securing the ICTS Supply Chain: Connected Vehicles, 90 Fed. Reg. 5360, Federal Register
8. BIS Narrows Connected Vehicle Prohibitions; Compliance Begins in Model Year 2027, NNR Global Logistics
9. Senate Commerce Advances Connected Vehicle Security Act, goodcarbadcar.net
10. Bill Banning Chinese-Made Automobiles Gaining Momentum in the Senate, Daily Caller
11. Chinese vehicle control unit poses remote shutdown risk for India’s electric buses, Business Today
12. Government Bans BAT-BMS, Epoch-i-ion, Lossigy Apps Over E-Rickshaw Remote Shutdown Threat, The Researchers