The Ministry of Road Transport and Highways has issued a draft notification proposing a phased rollout of cybersecurity and cybersecurity management systems for Indian-made vehicles. Covering M, N and T categories and L7 vehicles with level 3 automation, the rules align with AIS-189, bringing India in line with global standards on vehicle cyber security and software lifecycle management.
The Road Transport Ministry has proposed a phased rollout of cybersecurity and management systems to enhance the safety quotient of automobiles made in the country.
The Ministry of Road Transport and Highways(MoRTH), in a draft notification issued on June 22, said the proposed regulations will apply across the vehicle categories M(passenger vehicles), N (goods carriers), and T (trailers).
1 June 2026
Get the latest issue of Outlook Business
Under the draft proposal, motor vehicles of category M, N, T, if fitted with at least one electronic control unit (ECU) and L7 with level 3 automation, as referred in the standard, shall meet requirements of cybersecurity and cybersecurity management systems (CSMS) as per AIS-189.
AIS-189 aligns India's regulatory framework with globally accepted practice on vehicle cyber security and software lifecycle management.
According to the draft notification, vehicles with automation level L3 and above that comply with cybersecurity and cybersecurity management systems will be mandatory from October 1, 2026 (new models) and April 1, 2027 (existing models).
In case of over-the-air (OTA) enabled vehicles, compliance will be mandatory from October 1, 2029, for all vehicles (new and existing models).
The ministry has invited comments and objections from stakeholders within 30 days.
