Government Proposes Strict Cybersecurity Norms For Smart Vehicles In India

The Indian government has proposed new rules and regulations to mandate cybersecurity and over-the-air (OTA) software update compliance for connected vehicles in India. This move aims to align the country with global standards for autonomous and smart vehicles.

Government proposes New Cybersecurity and OTA Update Norms

The Ministry of Road Transport and Highways (MoRTH) has proposed new rules for cybersecurity and software update management systems for connected and autonomous vehicles. These regulations are already standard practice in regions such as the European Union, Japan, and South Korea.

According to the proposed rules, passenger vehicles, goods carriers, and tractors equipped with advanced ECUs will have to comply with India's new cybersecurity standards. These vehicles will be covered under Rule 125-T, which focuses on identifying and managing cybersecurity risks in vehicles.

Another proposed regulation, Rule 125-U, will apply across vehicle categories M, N, T, A, and C, and will track OTA updates through a dedicated software management system. This move brings India in line with countries like the EU, Japan, and South Korea, where cybersecurity compliance is already mandatory.

The implementation of these rules will become mandatory from October 1, 2026, while existing vehicles will need to comply from April 1, 2027. The second phase will cover OTA-capable ECUs, beginning from April 1, 2028, for new models and October 1, 2028, for existing vehicles.

These regulations will establish a structured framework to ensure cybersecurity, risk assessment, and continuous monitoring of OTA updates throughout a vehicle's lifecycle. Comments and objections are invited within 30 days from the publication of draft notification and after that these regulations will be finalized.

Many vehicles in India today are sold with connected features that require personal data for ownership and operation. However, there are currently no dedicated regulations to safeguard such sensitive data. These new rules are expected to strengthen cybersecurity protection and improve data safety for vehicle owners.