Phased Regulatory Roadmap
The Ministry of Road Transport and Highways (MoRTH) has released a draft notification proposing mandatory cybersecurity and software update management systems under the AIS-189 standard. The amendment to the Central Motor Vehicles Rules, 1989 introduces two key provisions: Rule 125-T for Cyber Security and Cyber Security Management Systems (CSMS), and Rule 125-U for Software Updates and Software Update Management Systems (SUMS). These requirements apply to passenger vehicles (M category), goods carriers (N category), trailers (T category), and for software updates, also cover agricultural and construction machinery.
The compliance timeline unfolds in multiple phases. Level 3 and above automated vehicles must comply by October 1, 2026 for new models and April 1, 2027 for existing models. OTA-enabled vehicles with OTA-capable ECUs (excluding infotainment and tracking devices) face an April 1, 2028 deadline for new models and October 1, 2028 for existing models. By October 1, 2029, all OTA-enabled vehicles and those supporting software updates without OTA capability must comply, along with vehicles lacking any software update or OTA functionality.
Impact on Automotive Cybersecurity Ecosystem
AIS-189 aligns India’s framework with global standards for vehicle cybersecurity and software lifecycle management, targeting the growing connected vehicle and software-defined vehicle landscape. The standard mandates automakers to establish structured cybersecurity governance, risk assessment processes, incident monitoring, and secure software update mechanisms throughout a vehicle’s lifecycle. This regulatory push forces OEMs, tier-1 suppliers, and software developers to integrate cybersecurity from design through end-of-life, covering ECUs, OTA update channels, and fleet management systems. MoRTH has opened a 30-day public comment period after gazette publication before finalizing the rules, accelerating India’s transition from voluntary cybersecurity measures to mandatory compliance for connected and autonomous vehicles.
Source: ETAuto
