The government has set October 1, 2026 as the first compliance date for India’s new vehicle cybersecurity rules, but the deadline applies to zero cars currently sold here, because no Level 3 autonomous vehicle is homologated for the Indian market yet. If you drive a Tata Nexon EV, a Sierra EV or an MG Hector Tomahawk, the date that actually matters for the over-the-air (OTA) updates your car already receives is April 2028, not this October.
MoRTH issued a draft notification on June 22, 2026 proposing two new provisions in the Central Motor Vehicles Rules, 1989: Rule 125-T for cybersecurity and Rule 125-U for software updates. The 30-day comment window has closed, but MoRTH has not yet issued a final gazette notification, so these remain proposed rules with a proposed timeline, not settled law. Autocar Professional, Outlook Business and AutoGuideIndia have all reported the same draft text and dates independently.
What Rules 125-T and 125-U Actually Require
Strip the acronyms and this is simple. A Cyber Security Management System (CSMS) is a documented process a manufacturer must run across a vehicle’s entire life, covering how it finds security flaws in a car’s onboard computers, how fast it patches them, and how it proves that to a regulator. A Software Update Management System (SUMS) is the equivalent process for the updates themselves: how an update gets tested, signed off and tracked before it reaches your car’s battery management system or infotainment unit.
| Rule | Standard | What it covers | Applies to |
| 125-T | AIS-189 (CSMS) | Ongoing risk management for a vehicle’s electronic control units (ECUs) | Category M (cars), N (goods vehicles), T (tractors) with at least one ECU, plus L7 vehicles with Level 3+ automation |
| 125-U | AIS-190 (SUMS) | How software updates, including OTA, are tested and tracked before release | Categories M, N, T and select specialised categories |
Both standards are India’s versions of the UN R155 and R156 frameworks already enforced for new vehicle type-approval in the European Union, Japan and South Korea. MoRTH is explicit that this is about catching up to that global baseline, not inventing something India-specific.
The Phased Timeline, and Why the October Date Is Mostly Symbolic
The draft rolls out in three stages, prioritised by how much risk a vehicle carries. Autocar Professional and AutoGuideIndia both list the same three-phase breakdown.
| Phase | New models | Existing models | Who it actually hits |
| 1 | 1 Oct 2026 | 1 Apr 2027 | Level 3+ autonomous vehicles, of which none are sold in India today |
| 2 | 1 Apr 2028 | 1 Oct 2028 | OTA-capable vehicles, which includes most connected EVs on sale now |
| 3 | – | 1 Oct 2029 | Every other vehicle with any software-update capability |
No car sold in India today has Level 3 autonomy. The highest driver-assistance level on the market is Level 2, in cars like the Volvo XC90, Mercedes-Benz S-Class and select Tata and MG models, which still require the driver’s hands and eyes on the job. So Phase 1’s October 2026 deadline is a regulatory marker with no live product behind it right now. Phase 2, arriving in 2028, is the one worth tracking, because it covers exactly the kind of car India already sells in large numbers.
Which Cars In India Are Actually Covered By the 2028 Deadline
Tata Motors confirmed in April 2026 that its OTA and remote-diagnostics platform, built with supplier Excelfore, would debut on the Tata Sierra EV. MG, which brought OTA updates to Indian cars first with the Hector, still pushes them to the ZS EV and Hector Tomahawk range. On two wheels, Ather has shipped more than a dozen OTA updates to the 450X, and Ola Electric’s MoveOS updates touch the motor controller, battery management system and instrument cluster on its S1 range. None of it ships with a government-mandated CSMS or SUMS process behind it today. From 2028, it will.
The rule that will genuinely change how your EV gets updated is two years away. The one making headlines this October changes nothing you can buy today.
Why This Matters If You Own or Are Buying a Connected EV
Once Phase 2 lands, an OTA update to your Nexon EV or ZS EV will have to pass through a certified, audited software-update process before it reaches your car, the same discipline EU, Japanese and South Korean buyers have had since UN R156 took effect. The upside: fewer botched updates bricking a battery management system, and a paper trail if a manufacturer needs to prove it patched a known flaw. The likely downside, based on how EU manufacturers responded to R155/R156, is slower update cycles, since every update now clears an internal certification step before release instead of shipping the moment engineering signs off.
Which Variant of “Compliance” Should Worry You
None of this requires you to take your car anywhere. There is no recall, no dealer visit, and no owner action tied to Rules 125-T or 125-U. The compliance burden sits entirely with manufacturers building and certifying their update pipelines. What is worth watching, once the rules are finalised, is whether a smaller EV maker without an established software team can absorb the certification cost as easily as a Tata or an MG, since that cost eventually shows up somewhere in the price of the car. See how two OTA-capable EVs from established players compare today: Tata Sierra EV vs MG Hector Tomahawk EV on the Compare tool.
Do the new cybersecurity rules mean my EV needs a service or recall right now?
No. Rules 125-T and 125-U govern how manufacturers build and certify future software and OTA updates. They place no obligation on current owners, and no Indian regulator has ordered any recall tied to this draft.
Which cars sold in India today have Level 3 autonomous driving?
None. The highest ADAS level available in the Indian market is Level 2, found on select Volvo, Mercedes-Benz, Tata and MG models, which still require constant driver attention. This is why the October 2026 Phase 1 deadline has no live product to apply to yet.
Are these rules the same as Europe’s UN R155 and R156 cybersecurity standards?
They’re modelled on the same UN framework already mandatory for type-approval in the EU, Japan and South Korea, but India’s version (AIS-189 and AIS-190) is still a draft notification. The public comment window closed in July 2026, and MoRTH has not yet issued a final gazette notification as of this article.
