Who approves the OTA update that lands on your car in India: AIS 189 and AIS 190, explained

Short answer: nobody inspects each individual update file the way a lab inspects a crash test car. What gets approved is the system the carmaker uses to build, test, sign and deliver updates. India is adding two such approvals to the Central Motor Vehicles Rules through draft rules 125-T and 125-U, which call up two standards, AIS 189 for a Cyber Security Management System and AIS 190 for a Software Update Management System. Once those are in force, a carmaker without the certificate cannot legally sell a vehicle that takes software updates.

Autocar Professional reported that the draft rules apply to vehicle categories M, N and T fitted with at least one electronic control unit, plus L7 quadricycles with Level 3 automation, and that the notification was open for public comment for 30 days. In October 2026, Hyundai Motor India Engineering and Kia India received Confirmation of Compliance certificates from ARAI for both standards, with ARAI Director Reji Mathai handing over the Hyundai certificates on 13 October and Kia announcing its own on 14 October.

What the two standards actually check

AIS 189 is India's derivation of UN Regulation 155 and AIS 190 of UN Regulation 156. AIS 189 looks at governance: does the company run threat and risk assessments, does it have incident management, does it monitor new vulnerabilities after the car is sold, does it train its people and audit itself. AIS 190 looks at the update pipeline: planning, validation, deployment, protection of the over-the-air package, and traceability of which software version is on which vehicle.

The traceability part is the piece owners rarely hear about. Under R156, a vehicle type carries an identifier called RXSWIN that pins down the software configuration relevant to its type approval. The carmaker has to show which software versions map to that RXSWIN and has to assess, for every update, whether the change touches an approved system. If it does, the approval has to be revisited before the update goes out. That is why some updates arrive in weeks and others take months.

For over-the-air updates specifically, R156 adds safety conditions. The update must not compromise vehicle safety while it is being carried out, a failed update must leave the vehicle in a safe state, and the user has to be told the purpose of the update and what it changes. Europe has lived with this since July 2022 for new vehicle types and July 2024 for all newly produced vehicles.

When it bites in India

The draft phases the requirement in by capability rather than by model year alone. Level 3 automation comes first, over-the-air capable vehicles next, and everything else that can take a software update last.

Where the work is being done

Most of this engineering is bought in, and a large share of it is written in India. Tata Elxsi showed its AVENIR software-defined vehicle suite at CES 2026 alongside a partnership with Chinese cockpit platform firm Autolink, and the suite is pitched on containerisation for over-the-air updates, cloud-native validation and subscription-based features for ADAS and EV functions. Containers matter here because they let a carmaker replace one application without reflashing a whole control unit, which shortens the window where a failed update could leave a car stranded.

For an owner, the practical effect is modest but real. You should get told what an update does, your car should not be bricked by a half-finished install, and the version on your car should be a number the maker can account for to a regulator. That is a lower bar than it sounds, and it is more than Indian buyers have today.

Sources

• India Drafts Mandatory Cybersecurity, Software-Update Rules for Connected and Autonomous Vehicles
• Hyundai Motor India Engineering earns ARAI cybersecurity and software update certifications
• Kia India receives AIS 189 and AIS 190 certifications from ARAI
• itemis: What is UNECE R156 (UN Regulation No. 156, Software Updates)?
• CES 2026: Autolink partners with Tata Elxsi to accelerate software defined vehicle adoption for global OEMs