India just gave the connected car a rulebook: what AIS-189 and AIS-190 mean for your next OTA update

For most owners, a software update on a car is a small notification on the infotainment screen: "update available, tap to install." For the Indian automotive industry, it has just become a regulatory event. On 13 and 14 October 2026, the Automotive Research Association of India (ARAI) handed Hyundai Motor India Engineering and Kia India formal Confirmation of Compliance certificates for two new domestic standards — AIS-189, covering a Cyber Security Management System, and AIS-190, covering a Software Update Management System. In the same week, ARAI announced it had become the country's first test agency to offer testing, verification, R&D and homologation for vehicle cybersecurity under one roof, in Pune. Between them, these are the clearest signs yet that India is turning the software-defined vehicle from an engineering trend into a compliance requirement.

What the certificates actually say

AIS-189 and AIS-190 are India's own versions of two United Nations regulations, UN R155 and UN R156, that have governed type approval in the EU, Japan and South Korea for several years. They are unusual as motor-vehicle rules go, because they don't test a part or a crash outcome — they audit a process. A Cyber Security Management System, UN R155's text makes clear, has to cover risk identification, incident response and supply-chain oversight across the entire life of a vehicle programme, from the first ECU design through to the last car on the road. A Software Update Management System, per UN R156's own text, has to keep an auditable register of every update ever pushed to a vehicle type: what it changed, whether it touched a type-approved system, how its authenticity was verified, and — specifically for over-the-air updates — how the car protects itself if the update fails halfway through, including the ability to roll back to the last known-good version or put itself into a safe state until power and connectivity allow a retry.

Kia India's own statement on its certification spells out the practical intent: AIS 190 "covers software update planning, validation, deployment, over-the-air (OTA) package protection, traceability, monitoring and regulatory compliance," while AIS 189 "covers cybersecurity governance, risk assessment, incident management, organisational capabilities and continuous monitoring of cybersecurity risks across the vehicle lifecycle." Atul Sood, Kia India's Senior VP for Sales & Marketing, put it more plainly: "As vehicles become increasingly connected and software-driven, safeguarding the customer's connected mobility experience is as important as ensuring performance, quality and safety on the road."

The timeline nobody can ignore for long

None of this is voluntary for long. The Ministry of Road Transport and Highways published draft rules in June 2026 inserting two new provisions — Rule 125-T for cybersecurity and Rule 125-U for software updates — into the Central Motor Vehicles Rules, 1989. The rollout is phased by risk: vehicles with Level 3 automation or higher face the earliest deadlines (new models from October 2026, existing ones by April 2027); vehicles capable of receiving OTA updates follow, with deadlines running April to October 2028; and every other vehicle with any software-update capability at all — which today means almost every connected car sold in India — falls under an October 2029 deadline. Both AIS-189 and AIS-190 stay in force only until the Bureau of Indian Standards issues its own formal specifications, at which point those take over; the practical effect for a buyer is the same either way.

What a software-defined vehicle actually looks like on sale today

The clearest India-built example of what these systems are meant to govern is already on dealer floors: the new Tata Sierra, relaunched in November 2025 as the first internal-combustion car from an Indian manufacturer engineered from the start as a software-defined vehicle. Its OTA and remote-diagnostics layer, built by Excelfore on the eSync Alliance's open standard and run on AWS IoT Core, pushes updates to both legacy distributed ECUs and newer domain controllers through the vehicle's gateway, using UDS over DoIP across CAN and Ethernet networks. Excelfore's own account of the deployment lists exactly the capabilities a Software Update Management System has to prove it can do: secure end-to-end firmware delivery, delta (differential) updates rather than full re-flashes, rollback and recovery if an update is interrupted, and coordinated campaigns across multiple ECUs at once. The Sierra's iRA connected suite and its 5G telematics are the visible layer; the eSync platform underneath is the part a regulator will now want to audit.

This matters beyond one model. Every carmaker that wants to keep selling connected cars in India — which by 2029 will mean essentially every carmaker — is on the same clock Hyundai and Kia have just cleared. Expect a steady trickle of similar certification announcements through 2027 and 2028, the same way Bharat NCAP five-star announcements arrived in a trickle once crash testing became routine.

The Auto Grid angle

A software-defined vehicle's safety case runs through its sensors as much as its code, and those sensors live on and behind the bodywork we protect. A radar module behind a bumper, a camera behind the windscreen, an ultrasonic park sensor in a skirt — each is calibrated at the factory against a known panel, and a cybersecurity-audited diagnostic session can now, in principle, flag a mismatch if that calibration drifts after a repair. A respray with the wrong paint thickness, or a non-OEM part swapped in after a scrape, is exactly the kind of change that can throw that calibration out. Quality paint protection film changes none of it: it goes on over the factory panel and the factory sensor window without touching either, which is one more reason to protect the car from week one rather than repair it after the fact.

Where this goes next

The next milestone to watch is April 2027, when every Level 3+ vehicle already on India's roads — currently a theoretical category, since no mass-market Level 3 car is sold here yet — has to be retrofitted into compliance. Longer term, the October 2029 deadline means that by the end of this decade, an Indian car's software update history will be as auditable as its service record. For now, the two certificates ARAI handed out this month are the first concrete proof that the rule has teeth, and that the industry is moving to meet it well ahead of the clock.