A Border Rule That Rewrites Assembly-Hub Economics
On May 27, 2026, Senator Elissa Slotkin and Representative Haley Stevens introduced the Protecting America from Chinese Cars Act at the Mackinac Policy Conference — and in doing so, handed Mexico a governance crisis it has no current tools to address. The bill would prohibit connected vehicles manufactured in China, or by companies with more than 15 percent Chinese ownership, from entering the United States even temporarily. No day trips across the border. No transiting. In Slotkin's words, these vehicles are "surveillance packages on wheels — fully capable of geolocating individual drivers, collecting full-motion video, and mapping sensitive infrastructure sites, including our military."
The security concern is not imaginary. Connected vehicles collect extraordinary volumes of data — LIDAR maps, passenger biometrics, geolocation trails, cabin audio and video — and Chinese automakers operate under the 2017 National Intelligence Law, which compels Chinese companies to cooperate with state intelligence activities on demand. A fleet of Chinese-made vehicles moving through US border regions carries theoretical but real risks of bulk surveillance at scale. That is the strongest version of the argument, and it deserves to be taken seriously before being challenged.
But the bill does not stop at Chinese brands. It reaches any vehicle with more than 15 percent Chinese ownership anywhere in the supply chain — a definition broad enough to implicate Mexican-assembled Fords, GMCs, and BMWs carrying Chinese-manufactured telematics chips, cameras, or infotainment systems. That is where Mexico's $185 billion automotive export industry enters the equation.
Mexico's Position as Assembly Hub
Mexico exports roughly 78 percent of its vehicles to the United States — 3.39 million units in 2025 — making it the most US-dependent automotive production base in the world. Global automakers chose Mexico precisely for its USMCA tariff access, geographic proximity to US consumers, and deep manufacturing capacity. Monterrey, Saltillo, San Luis Potosí, and Puebla are not peripheral assembly points; they are load-bearing nodes in the North American automotive system.
Within that system, Chinese Tier 1 and Tier 2 suppliers are deeply embedded. Chinese brands also captured roughly 25 percent of Mexico's own vehicle market when import tariffs stood at 20 percent. That penetration alarmed Washington enough that Mexico raised tariffs to 50 percent on January 1, 2026 — and Chinese vehicle imports fell 45.3 percent in the first month. But a tariff on Chinese-branded vehicles does nothing about Chinese-origin components inside nominally Mexican or American-brand vehicles rolling off Monterrey assembly lines.
The Slotkin-Stevens bill, if it passes, would force every Mexican auto exporter to prove that no covered software or hardware component traces to a Chinese-connected entity. That is a supply chain audit burden of extraordinary scope — and it arrives at a moment when Mexico has no regulatory framework to either verify compliance or credibly push back.
The Missing Framework
Mexico enacted a new Federal Law for the Protection of Personal Data Held by Private Parties (LFPDPPP) on March 21, 2025, replacing the independent regulator INAI with the Secretariat of Anti-Corruption and Good Governance. The reformed law is a meaningful step forward for general personal data protection: it introduces automated decision-making rights, tightens consent rules, and mandates sector-specific guidelines from a new AI body.
What it does not do — at all — is address connected vehicle data. There are no sector-specific rules for automotive telematics. No data localization requirements for vehicle-generated geolocation or biometric streams. No cross-border transfer restrictions covering the data flows that connected vehicles continuously transmit. No mandatory supply chain transparency rules for Tier 1 or Tier 2 vehicle suppliers. The LFPDPPP's theoretical coverage extends to personal data wherever collected, but general-purpose frameworks are not interoperable with the hardware-level supply chain declarations the US rules require.
The United States published its connected vehicle final rule on January 14, 2025, through the Bureau of Industry and Security, requiring Declarations of Conformity for all Vehicle Connectivity Systems and Automated Driving Systems with Chinese or Russian links. Software prohibitions take effect for Model Year 2027 vehicles; hardware prohibitions extend to Model Year 2030. Civil penalties reach $377,700 per violation or twice the transaction value, whichever is greater. Mexico has no equivalent — not even a draft framework in public consultation.
What a Proportionate Response Looks Like
Mexico does not need to replicate Washington's adversarial posture toward Chinese technology. A proportionate response would focus on three elements. First, mandatory data classification rules for vehicle-generated data — distinguishing aggregate mapping data from individually identifiable geolocation or biometric streams, and subjecting the latter to localization or audit requirements. Second, supply chain transparency obligations for automakers assembling in Mexico, requiring disclosure of the origin of connectivity and driving automation components. Third, interoperability with US BIS compliance declarations, so that automakers exporting from Mexico can satisfy both regimes in a single audit rather than navigating two incoherent frameworks.
The divergence across North America is striking. Canada is taking a maximally permissive stance — admitting 49,000 Chinese EVs annually at 6.1 percent tariff. Mexico raised tariffs to 50 percent under US pressure. The United States is building hardware-level supply chain prohibitions. None of these three positions is coordinated with the others. Mexico's situation is distinct from both neighbors: it is not primarily a destination market for Chinese cars but an assembly-and-export platform, which means the governance stakes are higher and the economic exposure more direct.
Sovereignty Requires a Framework
The Slotkin-Stevens bill may or may not pass in its current form. But it represents a durable direction in Washington's thinking: if Mexico cannot demonstrate that vehicles assembled within its borders meet US data-security standards, the US will make that determination unilaterally. A country with no connected-vehicle governance framework has no standing in that negotiation.
Mexico built its automotive export dominance through decades of deliberate industrial policy. Protecting that dominance in the era of connected vehicles requires the same intentionality — not mimicking US restrictions, but establishing a credible domestic framework that can enter into dialogue with US and EU standards on equal footing rather than simply accepting them as non-negotiable terms of market access.