India now has a paper trail for connected-vehicle security, and Kia’s local arm has just signed onto both halves of it. ARAI issued the company confirmations covering AIS 189, which governs a Cyber Security Management System, and AIS 190, which governs a Software Update Management System.
Two standards, two different jobs
The governance side takes in risk assessment, incident management and continuous monitoring of cyber risk across a vehicle’s life. The update side covers planning, validation, deployment, over-the-air package protection and traceability.
The distinction matters because a manufacturer can pass one and stall on the other. Security governance without disciplined update handling leaves known flaws unpatched. Update pipelines without governance push code to cars with no clear accountability for what shipped.
Atul Sood, Kia India’s senior vice president for sales and marketing, framed the pair as a customer-protection measure as much as a regulatory one, saying secure and evolving software is now as important as performance and safety.
A market building its own compliance lane
India has been assembling this regime for months. ARAI only recently consolidated testing, verification, validation and homologation for vehicle cybersecurity under one roof, and both standards anchor its service line.
What the confirmations do not do is certify a product. They show that a process exists, that risk is assessed on a schedule, and that updates can be traced. The security of any individual ECU still rests on how faithfully that process runs. Kia’s roadmap names the usual scaffolding: continuous risk monitoring, staff awareness work, internal audits and process improvement.
