The short answer is 42 USC 7523, 7524. This is the complaint filed by DOJ.
From the complaint: "Light-duty vehicles must satisfy emission standards for certain air pollutants. 40 C.F.R. §§ 86.1811-04, 86.1811-09, 86.1811-10". EPA issues certificates of conformity w.r.t. those standards. "manufacturer must submit an application to EPA for each model year and for each test group of vehicles that it intends to enter into United States commerce. 40 C.F.R. § 86.1843-01", and are covered "only if the vehicles are as described in the
manufacturer’s application for the COC 'in all material respects.' 40 C.F.R. § 86.1848-10(c)(6)". It is further prohibited to introduce into commerce "any new motor vehicle not covered by a COC issued by EPA under regulations prescribed by the Act governing vehicle emission standards" (which basically says, not only must you do it, you are forbidden to not do it).
All all "auxiliary emission control devices must be listed (40 C.F.R. § 86.1844-01(d)(11)), and it is claimed that the vehicles with "defeat devices" which are a subcase of auxiliary emission control devices cannot be certified. Section 203(a)(3)(B) of 42 U.S.C. § 7522(a)(3)(B) "makes it a violation 'for any person to manufacture ...any part... where a principal effect of the part ... is to bypass...any ...element of design installed ... in compliance with regulations”". There are also reporting requirements which it is alleged were not followed.