Centre Proposes Mandatory Cybersecurity and Software Update Rules for Vehicles

The Ministry of Road Transport and Highways (MoRTH) has proposed new regulations that would make cybersecurity and software update management systems mandatory for vehicles equipped with advanced technologies. This comes amid growing concerns over cyber threats as modern vehicles become increasingly connected and software-driven, making them more vulnerable to malware and other forms of cyberattacks.

Under the proposed framework, the rules would apply to passenger vehicles, commercial vehicles and tractors fitted with at least one electronic control unit (ECU) capable of supporting Level-3 or higher automated driving functions, The Economic Times reported,

New vehicle models equipped with Level-3 automation and above, including models such as the Mercedes-Benz S-Class, Audi A8 and BMW 7 Series, would be required to comply with the cybersecurity and cybersecurity management system requirements from October. Existing models would have to meet the requirements from April next year.

The regulations would then be expanded in phases. Vehicles capable of receiving over-the-air (OTA) software updates would be required to comply between April and October 2028, followed by vehicles with software update capability from October 2029.

Over-the-air software updates allow vehicles to receive software, firmware and system upgrades through Wi-Fi or cellular networks, similar to software updates on smartphones. The technology enables manufacturers to deliver feature enhancements, bug fixes and system improvements without requiring customers to visit a dealership.

Officials said vehicle manufacturers need to strengthen the security of software code used in critical systems, including battery management systems, which monitor and manage the operation and health of battery packs.