India's automotive cybersecurity timeline: the draft dates, and what's still open

The honest answer first

India has published the standards, and — as of the middle of 2026 — it has now proposed when they bite. AIS-189 (the CSMS standard, aligned to UN R155) and AIS-190 (the SUMS standard, aligned to UN R156) exist as documents published by ARAI for the AISC under the CMVR-TSC. On top of them, MoRTH has issued a draft amendment to the Central Motor Vehicles Rules — published in the Gazette of India as G.S.R. 503(E), dated 17 June 2026 (File No. RT-11036/91/2024-MVL) — inserting Rule 125-T to carry AIS-189 and Rule 125-U to carry AIS-190 into mandatory force, each with a phased timeline attached.

The one thing to hold on to is the word draft. G.S.R. 503(E) was put out for a 30-day public comment window (objections to [email protected]), and the rules state they "shall come into force on the date of their final publication in the Official Gazette." So the dates below are the planning baseline, and they are the most concrete India has offered — but they are not yet a fixed legal deadline, and they can change on finalisation. If you have seen "1 October 2025" quoted, that figure predates this draft and is not in it.

The proposed phased timeline

The cybersecurity rule (125-T) applies to categories M (passenger), N (goods) and T (trailers) fitted with at least one ECU, plus L7 vehicles with level-3 automation; the software-update rule (125-U) reaches a slightly broader set — categories M, N, T, A and C. Both phase the obligation by vehicle capability and by whether a model is new or already in production.

Phase	From	Applies to
1 — new	1 Oct 2026	New models with Level 3+ automated driving
1 — existing	1 Apr 2027	Existing models with Level 3+ automated driving
2 — new	1 Apr 2028	New models with OTA-capable ECUs (excl. infotainment and tracking)
2 — existing	1 Oct 2028	Existing OTA-capable models
3	1 Oct 2029	All other software-update-capable vehicles

That phasing is the useful part. The obligation does not land on the whole fleet at once — it starts with the highest-risk vehicles (Level-3+ automation), moves to OTA-capable vehicles, and only then reaches everything that can take a software update. Where an individual model sits in this table decides its clock.

What is settled, and what is still open

To plan sensibly you still need to separate the fixed parts from the movable ones.

Item	Status	Note
AIS-189 (CSMS) published	Settled	Aligned to UN R155; ARAI for AISC under CMVR-TSC
AIS-190 (SUMS) published	Settled	Aligned to UN R156
Rule 125-T / 125-U	Draft	The CMVR vehicle for mandatory force — out for public comment
Phased dates (Oct 2026 → Oct 2029)	Proposed	From the MoRTH draft; can change on finalisation
Transition to BIS standards	Open	AIS-189/190 apply until BIS notifies national standards
UN R155 EU dates (for context)	Settled	New types 6 Jul 2022; all new vehicles 7 Jul 2024

The EU row is there for contrast. In the EU the dates are already hard: UN R155 applied to new vehicle types from 6 July 2022 and to all new vehicles from 7 July 2024, via GSR (EU) 2019/2144. India's are now visible but not yet final — a step further along than "unnotified", and a real planning input rather than an absence of information.

Why a draft is enough to start on

It would be a mistake to read "draft, not final" as a reason to wait for the gazette. Three things point the other way.

First, the standards are published and the draft exists — a proposed date tends to become a real one; the question is the exact day, not whether. Second, the direction of travel is unambiguous: India runs its own regime aligned to R155/R156, and the ecosystem around it (test agencies, the competence requirements under AIS-189 clause 5.3.1, workshops) is already being built out. Third, an Indian OEM exporting to UNECE or EU markets is already inside the R155/R156 clock regardless of the Indian date, so the capability is needed anyway.

So the correct thing to say to a board is: the framework is now visible with dates, those dates are a draft, and the earliest of them — October 2026 for new Level-3+ models — is close enough that the sensible response is to be ready before finalisation, not after it.

Planning against capability, not a single date

The reason the exact final date matters less than it seems is that the work does not change with it. Getting a CSMS and SUMS to an assessable state follows the same sequence — scope, gap assessment, TARA, processes, evidence, dry-run — whether your model's clock starts in 2026 or 2029. That sequence is set out in our AIS-189/190 readiness checklist.

An OEM that plans on capability is insulated from wherever the finalised date lands. An OEM that plans on one headline number is exposed twice: it may sit in an earlier phase than it assumed, or it may mis-sequence its programme against a date that shifts in the final gazette. Capability is the stable thing to plan against; the phase table tells you how much runway you have.

There is also an institutional dimension that is already settled. The assessment venue for the cybersecurity file is clear: CIRT — a Testing & Certification agency notified under CMVR Rule 124 and Rule 126, functioning under MoRTH — is a type-approval authority for AIS-189 and AIS-190, holding the assessment competence AIS-189 clause 5.3.1 requires. The full picture is in Rule 124, Rule 126 and CIRT. That part of the regime is in place now, independent of any enforcement date.

What to watch

Watch the MoRTH notification and CMVR amendment stream, not secondary commentary. The primary document is MoRTH draft G.S.R. 503(E) (PDF) — the source for every date on this page. The proposed dates become law when the draft is finalised in the gazette, and the transition to BIS standards is a second thing to track. Until then the defensible statements are the ones above: the standards are published; Rules 125-T and 125-U are drafted with a phased timeline; those dates are proposed, not final. For the standards themselves, see AIS-189 explained and AIS-190 explained.

The AutoSifu view

AutoSifu works one route: compliance, solutioning, and CoC/VTA support, with the approval body in the room. Because we build to capability rather than to a single headline date, an OEM we work with is ready wherever the finalised phase table places it — and because we prepare the CSMS and SUMS alongside CIRT, the assessment is not a cliff-edge when the notification lands. We would rather an OEM be early and calm than on time and rushed.