India’s Ministry of Road Transport and Highways (MoRTH) has proposed draft amendments to the Central Motor Vehicles Rules mandating Cyber Security Management System (CSMS) compliance under AIS-189 and Software Update Management System (SUMS) compliance under AIS-190 for connected and automated vehicles.
What Happened
MoRTH published the draft Central Motor Vehicles (Amendment) Rules, 2026 for public comment, proposing new Rule provisions requiring CSMS certification under AIS-189 for vehicles in categories M, N, and T fitted with at least one Electronic Control Unit (ECU), plus L7 vehicles with Level 3+ automated driving. A new Rule 125-U proposes mandatory SUMS requirements under AIS-190 for categories M, N, T, A, and C.
What’s New
- Mandatory CSMS certification under AIS-189 for M, N, T category vehicles with at least one ECU, and L7 vehicles with SAE Level 3+ automation.
- New Rule 125-U mandates SUMS compliance under AIS-190 for categories M, N, T, A, and C.
- Phased rollout based on vehicle risk profile; Level 3+ automated vehicles comply first.
- AIS-189/AIS-190 govern until BIS notifies corresponding national standards, after which BIS specifications replace them.
Key Dates & Compliance Deadlines
MoRTH published draft rules; public comment window opened.
Proposed compliance start for new vehicle models.
Proposed compliance start for existing models.
Affected Industries
Automotive OEMs; connected-vehicle and ECU suppliers; Tier 1/Tier 2 automotive electronics suppliers; telematics and software-update platform providers.
Who Is Affected
Vehicle manufacturers and ECU/software suppliers for categories M, N, T, A, C, and L7 (Level 3+) vehicles sold in India.
Substances / Products in Scope
Not a chemical regulation — covers cybersecurity (CSMS) and software-update management (SUMS) governance for connected/automated vehicles under AIS-189/AIS-190.
Prohibitions, Restrictions & Exemptions
No prohibitions; this is a compliance-certification mandate. Vehicles in scope without AIS-189 CSMS or AIS-190 SUMS certification would not meet type-approval requirements once the rule is finalized and phased in.
What Companies Should Do
- Review current CSMS and SUMS governance maturity against AIS-189/AIS-190 requirements.
- Prepare for phased compliance beginning with Level 3+ automated models (October 2026 target for new models).
- Monitor for BIS national standards that will eventually supersede AIS-189/AIS-190.
- Submit comments during the public consultation window if applicable.
This is a significant forthcoming compliance obligation for OEMs and Tier 1 suppliers with connected or automated vehicle programs in India; the phased approach gives some lead time, but cybersecurity and software-update governance structures should be built out well ahead of the October 2026 target for new models.
Reach out to our regulation experts on chemical and product regulatory compliances
