S.Amdt. 5977

SA 5977. Mr. MORENO (for himself and Ms. Slotkin) submitted an
amendment intended to be proposed by him to the bill S. 4784, to
authorize appropriations for fiscal year 2027 for military activities
of the Department of Defense, for military construction, and for
defense activities of the Department of Energy, to prescribe military
personnel strengths for such fiscal year, and for other purposes; which
was ordered to lie on the table; as follows:

At the end of division A, add the following:

TITLE XVII--CONNECTED VEHICLE SECURITY ACT OF 2026

SEC. 1701. SHORT TITLE.

This title may be cited as the ``Connected Vehicle Security
Act of 2026''.

SEC. 1702. DEFINITIONS.

In this title:
(1) Automated driving system.--The term ``automated driving
system'' means hardware and software that, collectively, are
capable of performing the entire dynamic driving task for a
connected vehicle on a sustained basis, without human
intervention, regardless of whether it is limited to a
specific operational design domain.
(2) Connected vehicle.--
(A) In general.--Except as provided by subparagraph (B),
the term ``connected vehicle'' means a vehicle driven or
drawn by mechanical power and manufactured primarily for use
on public streets, roads, and highways, that--
(i)(I) integrates onboard networked hardware with
automotive software systems to communicate, at a radio
frequency over 450 megahertz, via dedicated short-range
communication, cellular telecommunications connectivity,
satellite communication, or other wireless spectrum
connectivity with any other network or device; or
(II) is designed, manufactured, or originally equipped to
communicate as described in clause (i), regardless of whether
such capability is enabled, disabled, or removed at the time
of importation, manufacture, sale, resale, or introduction of
the vehicle into interstate commerce in the United States;
and
(ii) has a gross vehicle weight rating of 4,536 kilograms
(10,000 pounds) or less.
(B) Exclusion.--The term ``connected vehicle'' does not
include a vehicle operated only on a rail line.

[[Page S3116]]

(3) Covered country.--The term ``covered country'' means--
(A) the Democratic People's Republic of North Korea;
(B) the People's Republic of China;
(C) the Russian Federation; and
(D) the Islamic Republic of Iran.
(4) Covered software.--
(A) In general.--The term ``covered software''--
(i) means the software-based components installed in or on
a connected vehicle, or designed to be installed in or on a
connected vehicle, including application, middleware, and
system software, executed by the primary processing unit or
units of an item that directly enables the function of a
vehicle connectivity system or automated driving system at
the vehicle level; and
(ii) includes any machine-learning model or other
artificial intelligence component that directly enables, at
the vehicle level, decision-making or control of an automated
driving system.
(B) Exclusion.--The term ``covered software'' does not
include open-source software, except to the extent that such
software has been modified, adapted, customized, integrated,
distributed, maintained, or otherwise incorporated into a
software product by, on behalf of, or under the direction or
control of a foreign entity of concern.
(5) Electric vehicle battery.--The term ``electric vehicle
battery'' means a rechargeable battery designed to store and
supply electrical energy for the propulsion of a hybrid or
electric vehicle.
(6) Foreign entity of concern.--The term ``foreign entity
of concern'' means--
(A) any individual, wherever located, who--
(i) acts as an agent, representative, or employee, or acts
in any other capacity at the order, request, or under the
direction or control, of a covered country or of a person
whose activities are directly or indirectly supervised,
directed, controlled, financed, or subsidized in whole or in
majority part by a covered country; or
(ii) is a citizen or resident of a covered country or a
country controlled by a covered country, and is not a United
States citizen or alien lawfully admitted for permanent
residence in the United States; or
(B) an entity--
(i) with a principal place of business in, headquartered
in, incorporated in, or otherwise organized under the laws of
a covered country or a country controlled by a covered
country;
(ii) that is a subsidiary or affiliate of an entity
described in clause (i); or
(iii) wherever organized or doing business, that is owned
or controlled by a covered country, participating in a
partnership or joint venture with an individual described in
subparagraph (A) or an entity described in clause (i), or
subject to other circumstances in which such an individual or
entity, or combination of such individuals or entities,
possesses the power, direct or indirect, whether or not
exercised, through--

(I) ownership of a majority or a dominant minority of the
total outstanding voting or financial interest in the entity,
board representation, proxy voting, a special share,
contractual arrangements, formal or informal arrangements to
act in concert, or other means, to determine, direct, or
decide important matters affecting the entity;
(II) with respect to a manufacturer, developer, designer,
or supplier of a connected vehicle, ownership or control of
more than 15 percent of the total outstanding equity
interest, voting interest, board representation, or other
indicia of control;
(III) with respect to a manufacturer, developer, designer,
or supplier of covered software, ownership or control of more
than 25 percent of the total outstanding equity interest,
voting interest, board representation, or other indicia of
control; or
(IV) with respect to a manufacturer or supplier of vehicle
connectivity system hardware, ownership or control of more
than 25 percent of the total outstanding equity interest,
voting interest, board representation, or other indicia of
control.

(7) Importation.-- The term ``importation'' has the meaning
given the term ``import'' in section 1001 of the Controlled
Substances Import and Export Act (21 U.S.C. 951).
(8) Resale.--
(A) In general.--The term ``resale'', with respect to a
vehicle, software, or hardware, means the transferring of
ownership of the vehicle, software, or hardware by an
individual or entity that acquired the vehicle, software, or
hardware for the purpose of transfer in the ordinary course
of business, and not for the use of or consumption by the
individual or entity.
(B) Exclusion.--The term ``resale'' does not include the
transfer of a connected vehicle that was previously titled or
registered to, and used by, a consumer or end-user or was
acquired for bona fide use, lease, or operation by the
individual or entity transferred the vehicle or by a dealer
(as defined in section 30102(a)(2) of title 49, United States
Code).
(9) Secretary.--The term ``Secretary'' means the Secretary
of Commerce, acting through the Under Secretary of Commerce
for Industry and Security.
(10) Transaction.--The term ``transaction''--
(A) means any acquisition, importation, transfer,
installation, dealing in, or use of any vehicle, software, or
hardware subject to a prohibition under section 1703(a),
including ongoing activities, such as managed services, data
transmission, software updates, repairs, or provision of
platform services or data hosting of applications for
consumer download; and
(B) includes--
(i) any other transaction, arrangement, practice, or course
of conduct, the structure or purpose of which is designed or
intended to evade or circumvent this title; and
(ii) a class of transactions.
(11) Vehicle connectivity system.--The term ``vehicle
connectivity system'' means vehicle connectivity system
hardware or a covered software item installed in or on a
connected vehicle, or designed to be installed in or on a
connected vehicle, that directly enables the function of
transmission, receipt, conversion, or processing of radio
frequency communications at a frequency over 450 megahertz.
(12) Vehicle connectivity system hardware.--
(A) In general.--The term ``vehicle connectivity system
hardware''--
(i) means software-enabled or programmable components
that--

(I) are installed in or on a connected vehicle or designed
to be installed in or on a connected vehicle;
(II) are directly connected to a vehicle connectivity
system; and
(III) directly enable the connectivity functions of a
vehicle connectivity system or are part of an item that
directly enables the function of a vehicle connectivity
system; and

(ii) includes--

(I) microcontrollers, microcomputers or modules, systems on
a chip, networking or telematics units, cellular modem/
modules, Wi-Fi microcontrollers or modules, Bluetooth
microcontrollers or modules, satellite communication systems,
other wireless communication microcontrollers or modules,
external antennas, digital signal processors, and field-
programmable gate arrays; and
(II) electronic systems integrated into an electric vehicle
battery that directly enable or control the monitoring,
management, security, or external communication of battery
performance or operation, including any transmitter or
interface component that performs such functions.

(B) Exclusion.--The term ``vehicle connectivity system
hardware'' does not include component parts that do not
contribute to the connectivity function of vehicle
connectivity system hardware, such as brackets, fasteners,
plastics, passive electronics, diodes, field effect
transistors, and bipolar junction transistors.

SEC. 1703. PROHIBITION ON CONNECTED VEHICLES AND OTHER
TRANSACTIONS THAT THREATEN ECONOMIC OR NATIONAL
SECURITY.

(a) Prohibitions.--
(1) Connected vehicles.--On and after January 1, 2027, the
importation, manufacture, sale, resale, or introduction into
interstate commerce in the United States of a connected
vehicle is prohibited if--
(A) the connected vehicle is designed, developed, or
manufactured in, or supplied from, a covered country, without
regard to whether--
(i) at the time of importation, sale, resale, or
introduction, the vehicle is equipped with any covered
software or vehicle connectivity system hardware subject to a
prohibition under paragraph (2) or (3); or
(ii) any such software or hardware--

(I) is removed from the vehicle before importation, sale,
resale, or introduction; or
(II) will be installed after importation, sale, resale, or
introduction; or

(B) the manufacturer, developer, designer, or supplier of
the connected vehicle is a foreign entity of concern.
(2) Covered software.--The integration of covered software
into a connected vehicle that is imported, manufactured,
sold, resold, or introduced into interstate commerce into the
United States is prohibited if--
(A) the connected vehicle into which the covered software
is integrated was manufactured for model year 2027 or later;
and
(B)(i) the covered software is designed, developed, or
manufactured in, or supplied from, a covered country; or
(ii) the manufacturer, developer, designer, or supplier of
the software is a foreign entity of concern.
(3) Vehicle connectivity system hardware.--
(A) In general.--On and after January 1, 2030, the
integration of any vehicle connectivity system hardware into
a connected vehicle that is imported, manufactured, sold,
resold, or introduced into interstate commerce into the
United States is prohibited if--
(i) the hardware is manufactured in, or supplied from, a
covered country; or
(ii) the manufacturer or supplier of the hardware is a
foreign entity of concern.
(B) Repair and warranty.--The prohibition under
subparagraph (A) shall not apply to vehicle connectivity
system hardware that is--
(i) integrated into a vehicle that is manufactured for a
model year before model year 2030; or
(ii) imported, manufactured, sold, resold, or introduced
into interstate commerce in the United States for the purpose
of repair, or under warranty, for a connected vehicle of a
model year before model year 2030.
(4) Additional items.--Subject to an applicable ruling or
advisory opinion issued under subsection (d), a prohibition
under paragraph

[[Page S3117]]

(1), (2), or (3) applies with respect to a connected vehicle,
covered software, or vehicle connectivity system hardware, as
the case may be, that is renamed, rebranded, restructured, or
altered to circumvent the prohibition.
(5) Exception.--The prohibitions under paragraphs (1), (2),
and (3) shall not apply to the importation, manufacture,
sale, resale, or introduction into interstate commerce in the
United States of a connected vehicle, covered software, or
vehicle connectivity system hardware, as the case may be, for
the sole purpose of testing and evaluation if--
(A) in the case of a connected vehicle, the vehicle is not
intended to be driven on public roads; or
(B) in the case of a connected vehicle, covered software,
or vehicle connectivity system hardware, the testing or
evaluation is by an entity that--
(i) is organized under the laws of a State in the United
States;
(ii) does not have its principal place of business in a
covered country; and
(iii) is not a foreign entity of concern.
(b) Related Transactions.--
(1) In general.--The Secretary shall prescribe regulations,
pursuant to section 553 of title 5, United States Code, to
prohibit any specific transaction relating to connected
vehicles, including the importation, sale, distribution,
integration, or use of a connected vehicle, covered software,
or vehicle connectivity system hardware, that the Secretary
determines poses an undue or unacceptable threat to the
economic or national security of the United States.
(2) Notice.--If the Secretary prohibits a transaction under
paragraph (1), the Secretary shall deliver, by certified
United States mail, to the parties to the transaction a
notice of the prohibition that includes an identification, by
name, of the specific vehicle, software, or hardware that the
Secretary determines poses an undue or unacceptable threat to
the economic or national security of the United States.
(c) Authorizations.--
(1) Issuance.--
(A) In general.--The Secretary, in consultation with the
Secretary of Defense, the Secretary of Transportation, the
Secretary of State, and the Secretary of Energy, may issue a
general or specific authorization for the importation,
manufacture, sale, resale, or introduction into interstate
commerce in the United States of a connected vehicle, covered
software, or vehicle connectivity system hardware that would
otherwise be subject to a prohibition under subsection (a)
if--
(i) the Secretary determines, based on clear and convincing
evidence and a written risk assessment, that the importation,
manufacture, sale, resale, or introduction of the vehicle,
software, or hardware does not pose, and is not reasonably
likely to pose--

(I) an undue risk of data exfiltration from, or remote
manipulation or operation of, a connected vehicle;
(II) a risk to critical infrastructure or the integrity of
the industrial base of the United States; or
(III) any other risk to the national security of the United
States;

(ii) not less than 60 days before the authorization takes
effect, the Secretary submits to Congress a detailed written
notification that--

(I) includes the determination under clause (i) and
underlying analysis, including the written risk assessment;
and
(II) redacts intellectual property and other sensitive
proprietary information; and

(iii) during the 60-day period described in clause (ii),
there is not enacted into law a joint resolution of
disapproval with respect to the authorization for the
vehicle, software, or hardware.
(B) Specific authorizations.--A specific authorization
issued under subparagraph (A) shall be in effect for an
initial one-year period and may be extended if the Secretary
determines appropriate.
(C) Continued validity and modification and revocation of
authorizations.--
(i) Continued validity of existing authorizations.--Except
as provided by clause (ii), any general or specific
authorization issued under subpart D of part 791 of title 15,
Code of Federal Regulations, before the date of the enactment
of this Act, shall remain in effect until January 1, 2030,
unless modified, suspended or revoked under clause (ii).
(ii) Modification or revocation of general or specific
authorizations.--The Secretary may, at any time, modify,
suspend, or revoke a general or specific authorization
described in clause (i) if the Secretary--

(I) determines that the authorization no longer satisfies
the requirements of subparagraph (A)(i); and
(II) provides the public with an opportunity to comment
before modifying, suspending, or revoking the authorization.

(iii) Publication required.--Not later than January 1,
2027, the Secretary shall publish a list of all general or
specific authorizations issued under subpart D of part 791 of
title 15, Code of Federal Regulations, before the date of the
enactment of this Act.
(2) Publication of list of authorized vehicles, software,
and hardware.--
(A) In general.--The Secretary shall, pursuant to section
553 of title 5, United States Code, publish and maintain a
list of the connected vehicles, covered software, and vehicle
connectivity system hardware the importation, manufacture,
sale, resale, or introduction into interstate commerce in the
United States of which is authorized under paragraph (1)(A).
(B) Initial list.--The initial list required by
subparagraph (A) shall be published not later than January 1,
2027.
(C) Inclusions.--
(i) In general.--To the extent possible, the Secretary
shall include, in the list required by subparagraph (A), the
manufacturer and product name for the connected vehicles,
covered software, and vehicle connectivity system hardware on
the list.
(ii) Risk assessment.--To the extent possible, the
Secretary shall include, in the list required by subparagraph
(A), a detailed explanation about why the connected vehicles,
covered software, and vehicle connectivity system hardware on
the list do not pose an undue risk described in paragraph
(1)(A)(i).
(D) Protection of intellectual property.--The Secretary
shall establish a robust process to redact intellectual
property and other sensitive information from publication in
the list required by subparagraph (A).
(3) Requests for authorization.--Not later than January 1,
2027, the Secretary shall establish a procedure pursuant to
which an importer, manufacturer, supplier, or seller or
reseller may seek the authorization under paragraph (1) of
the importation, manufacture, sale, resale, or introduction
into interstate commerce in the United States of connected
vehicles, covered software, or vehicle connectivity system
hardware that would otherwise be subject to a prohibition
under subsection (a).
(d) Rulings and Advisory Opinions.--
(1) In general.--Not later than January 1, 2027, the
Secretary shall establish a procedure pursuant to which an
importer, manufacturer, or seller or reseller may seek a
binding ruling or advisory opinion with respect to whether--
(A) the importation, manufacture, sale, resale, or
introduction into interstate commerce in the United States of
a connected vehicle, covered software, or vehicle
connectivity system hardware is or is not prohibited under
this section; or
(B) a connected vehicle, covered software, or vehicle
connectivity system hardware has been renamed, rebranded,
restructured, or altered to circumvent the prohibitions under
subsection (a).
(2) Timing.--The Secretary shall issue a ruling or advisory
opinion under paragraph (1) with respect to a connected
vehicle, covered software, or vehicle connectivity system
hardware not later than 45 days after receiving an
application supported by a reasonably clear description of
the vehicle, software, or hardware, as the case may be.
(3) Publication.--
(A) In general.--The Secretary shall--
(i) publish a list of all connected vehicles, covered
software, and vehicle connectivity system hardware for which
the Secretary has issued rulings and advisory opinions under
paragraph (1); and
(ii) update that list not less frequently than annually.
(B) Prohibition on publication of identifying
information.--The Secretary shall not publish the name of, or
other information that might reasonably identify, the party
that requested the ruling or advisory opinion.
(4) Continued validity of existing rulings and opinions.--
Except as provided by paragraph (5), a ruling or advisory
opinion issued under this subsection or subpart D of part 791
of title 15, Code of Federal Regulations, before January 1,
2027, shall remain in effect.
(5) Modification or revocation.--The Secretary may modify,
suspend, or revoke any binding ruling or advisory opinion
issued under paragraph (1) or subpart D of part 791 of title
15, Code of Federal Regulations, at any time if the Secretary
determines that the circumstances that led to the ruling or
opinion have changed.
(e) Declaration of Conformity.--The Secretary shall
establish a process under which a person that imports,
manufactures, sells, resells, or introduces into interstate
commerce in the United States a connected vehicle, covered
software, or vehicle connectivity system hardware is required
to submit a declaration, to be known as a ``declaration of
conformity'', to the Secretary before importing,
manufacturing, selling, reselling, or introducing the
vehicle, software, or hardware that certifies that the
vehicle, software, or hardware is not subject to a
prohibition under subsection (a).
(f) Civil Penalties.--
(1) In general.--Except as provided by paragraph (3), the
Secretary shall assess a civil penalty for each transaction
that is a violation of a prohibition under subsection (a) in
an amount that is not less than the greater of--
(A) $1,500,000; or
(B) five times the value of the transaction.
(2) Continuing violations.--In the case of a violation that
occurs on more than one day, each day on which the violation
continues shall be treated as a separate violation.
(3) Exception.--A civil penalty shall not apply under
paragraph (1) in a case in which an individual transports a
vehicle into the United States in violation of a prohibition
under subsection (a) if--
(A) the vehicle is owned or leased by the individual for
personal use; and
(B) the individual does not know that the vehicle, or
covered software or vehicle connectivity system hardware
integrated

[[Page S3118]]

into the vehicle, is subject to the prohibition.
(g) Classified Information.--The Secretary may rely on
classified information in carrying out this section, which
may be submitted to a reviewing court ex parte and in camera.
(h) Petitions for Review.--The filing in a court of a
petition for review shall not stay the effectiveness of any
action under this section unless ordered by the court.

SEC. 1704. USE OF EXISTING ADVISORY BODIES; INTERAGENCY
COORDINATION.

(a) Use of Existing Advisory Bodies.--
(1) In general.--In carrying out this title, the Secretary
may consult, as appropriate, with existing advisory
committees of the Department of Transportation and other
relevant Federal agencies on matters relating to connected
vehicles and associated national security risks.
(2) Scope of consultation.--Consultation under paragraph
(1) may include consideration of--
(A) risks relating to data security, cybersecurity, and
supply chain integrity associated with connected vehicles;
(B) the effectiveness of authorities and regulations issued
under this title;
(C) emerging technologies and threat vectors relevant to
connected vehicle ecosystems; and
(D) recommendations made to the Secretary with respect to
regulatory, enforcement, and policy measures to mitigate
risks described in subparagraph (A).
(b) Interagency Coordination.--In carrying out this title,
the Secretary may consult and coordinate, as appropriate,
with the Federal Communications Commission and other relevant
Federal agencies to ensure alignment with respect to the
scope, timeline, and implementation of any prohibitions or
restrictions issued under this title, including to avoid
duplicative, inconsistent, or conflicting regulatory
requirements.

SEC. 1705. REPORTS.

Not later than one year after the date of the enactment of
this Act, and annually thereafter, the Secretary shall submit
to Congress a report--
(1) describing activities carried out to enforce the
prohibitions under section 1703, including enforcement
actions taken and resources utilized;
(2) providing a detailed accounting of connected vehicles,
covered software, and vehicle connectivity system hardware
covered by such prohibitions during the 1-year period
preceding submission of the report;
(3) explaining any exclusions, exemptions, authorizations,
or determinations made by the Secretary, including the
rationale and criteria applied;
(4) assessing the effectiveness of such prohibitions in
decreasing the threats to the economic and national security
of the United States posed by connected vehicles;
(5) including metrics on enforcement, compliance rates,
violations identified, penalties assessed, and any identified
gaps or challenges; and
(6) making recommendations with respect to further
decreasing such threats.

SEC. 1706. REPORT ON AUTOMOTIVE SUPPLY CHAIN RESILIENCY AND
SECURITY.

(a) In General.--Not later than 18 months after the date of
the enactment of this Act, the Secretary shall submit to
Congress a report assessing the resilience and security of
supply chains critical to the United States automotive
sector.
(b) Elements.--The report required by subsection (a) shall,
at a minimum--
(1) identify the segments, materials, components, and
technologies within the automotive supply chain that are most
dependent on a covered country;
(2) assess the extent to which the dependencies identified
under paragraph (1) pose significant risk to the economic or
national security of the United States; and
(3) recommend specific policies and measures to support the
development and expansion of supply chains outside of covered
countries for the dependencies identified under paragraph (2)
that pose the most significant risk to the economic or
national security of the United States.
(c) Considerations.--In identifying segments, materials,
components, and technologies within the automotive supply
chain under subsection (b)(1), the Secretary shall consider,
at a minimum--
(1) safety equipment;
(2) hardware or software that enables the transmission,
receipt, conversion, or processing of automotive sensing
(such as LiDAR, radar, video, or ultrawideband);
(3) electric vehicle batteries;
(4) smart glass, antenna glass, and other electronically
controlled automotive glass that directly enables the
transmission, receipt, conversion, or processing of radio
frequency communications; and
(5) any other segments, materials, components,
technologies, hardware, or software identified by the
Department of Commerce for consideration during the process
of promulgating subpart D of part 791 of title 15, Code of
Federal Regulations.

SEC. 1707. REGULATIONS.

Not later than December 31, 2028, the Secretary shall issue
final regulations establishing prohibitions and requirements
applicable to connected vehicles with a gross vehicle weight
rating greater than 4,536 kilograms (10,000 pounds),
consistent with the authorities and requirements under this
title. Such prohibitions and requirements shall take effect
not later than December 31, 2032.

SEC. 1708. SEVERABILITY; REGULATORY CONTINUITY.

(a) Severability.--If any provision of this title, or the
application of any such provision to any person or
circumstance, is held to be invalid, the remainder of this
title, and the application of the remaining provisions to any
person or circumstance, shall not be affected.
(b) Restoration of Prior Regulations.--If a court of
competent jurisdiction enters a final judgment holding
invalid or unenforceable a provision of this title and
supersedes regulations prescribed to carry out section 1703,
the Secretary may, notwithstanding any other provision of
this title, reissue or reinstate, in whole or in part, any
similar regulations that were in effect on the day before the
date of the enactment of this title.

SEC. 1709. INTERACTION WITH REGULATIONS.

(a) Rule of Construction.--Nothing in this title shall be
construed to prohibit, limit, or otherwise affect the
authority of the Secretary of Commerce to implement or
administer subpart D of part 791 of title 15, Code of Federal
Regulations, as added by the final rule of the Bureau of
Industry and Security entitled ``Securing the Information and
Communications Technology and Services Supply Chain:
Connected Vehicles'' (90 Fed. Reg. 5360).
(b) Delayed Implementation for Hardware Not Covered by
Regulations.--In the case of vehicle connectivity system
hardware that is subject to a prohibition under section
1703(a)(3) and is not subject to subpart D of part 791 of
title 15, Code of Federal Regulations, as in effect on the
day before the date of the enactment of this Act, the
Secretary shall implement the prohibition with respect to
such hardware incorporated into connected vehicles of a model
year later than model year 2031 and earlier than model year
2033.
(c) Delayed Implementation for Connected Vehicles by
Existing United States Manufacturers and Operators.--The
prohibition under section 4(a)(1) shall not apply with
respect to a connected vehicle of a model year before model
year 2030 that is manufactured, purchased pursuant to a
master services agreement or other similar contract executed
before the date of the enactment of this Act, or operated in
a commercial fleet, by an entity that--
(1) is selling passenger vehicles or operating a commercial
fleet of passenger vehicles in the United States as of the
date of the enactment of this Act; and
(2) has been manufacturing passenger vehicles or operating
a commercial fleet of passenger vehicles in the United States
for not less than 5 years before such date of enactment.
(d) Treatment of Prior Exclusions.--
(1) In general.--Subject to paragraph (2), any exclusion or
exception to a prohibition or definition under subpart D of
part 791 of title 15, Code of Federal Regulations, as in
effect on the day before the date of the enactment of this
Act, shall remain valid and shall apply to the prohibitions
under section 1703(a).
(2) Rulemaking.--Beginning January 1, 2030, the Secretary
shall conduct a rulemaking, pursuant to section 553 of title
5, United States Code, to determine whether exclusions or
exceptions described in paragraph (1) should be continued,
modified, or terminated for the purposes of this title.
______