India Proposes Mandatory Cybersecurity Rules For Smart And Connected Vehicles

The Indian government has proposed stringent cybersecurity regulations for smart and connected vehicles to mitigate the growing risk of malware and digital threats. The draft notification mandates the implementation of AIS 190, a comprehensive standard that establishes a framework for secure vehicle software updates and Software Update Management Systems (SUMS). These rules are designed to ensure that all over-the-air and manual updates are traceable, authorized, and protected.

The proposed regulations apply to a wide range of vehicles, including passenger cars, commercial vehicles, and tractors. Specifically, the rules target any vehicle equipped with at least one electronic control unit (ECU) that supports Level-3 or higher automated driving capability. This move reflects the government's commitment to securing the increasingly digitized automotive ecosystem against potential cyberattacks that could compromise vehicle safety.

The compliance timeline is set to ensure a smooth transition for the industry. New vehicle models will be required to comply with these cybersecurity standards starting from October 2026. For existing models already on the road, the deadline for compliance is set for April 2027. This phased approach allows manufacturers sufficient time to upgrade their software management systems and ensure that their connected vehicle fleets meet the new national security benchmarks.