The major risk posed by connected cars, now necessitating new prohibitions and regulations
The international study "Connected Car Innovation 2026" (CAM) describes modern vehicles as systems that are permanently networked, capable of continuously generating and transmitting information via cameras, sensors, and location data. Simultaneously, over-the-air (OTA) wireless updates allow manufacturers to update software remotely, thereby enabling the subsequent modification of vehicle functions.
New gateways for hackers and cybercriminals.
In environments featuring a high number of interfaces for mobile communications, WLAN, or cloud services, new potential opportunities arise for hackers and criminals. CAM concludes that, with the increasing software-based control of vehicles, cybersecurity is no longer merely an IT issue; it directly impacts vehicle safety and the handling of vehicle data.
Furthermore, anyone involved in developing software, deploying updates, or processing data could, in theory, not only access that data but also intervene in systems critical to vehicle operation and safety. CAM explicitly links this discussion to the transition toward "software-defined vehicles," in which artificial intelligence (AI), standardized software architectures, and regular updates are becoming increasingly significant.
The case of Norway highlights a data-related issue.
The potential for connectivity to reach sensitive areas—even those involving security—is illustrated by an incident in Norway, which is addressed in the CAM presentation. According to information provided by CAM, during the "Hovedstad" military exercise in September, the movements of military personnel were tracked through the use of rental vehicles; additionally, security codes entered at the entrances to barracks were also captured.
Among other relevant details, it has been reported that vehicles from the brand Changan Deepal were affected. It is important to note that CAM does not explicitly mention any evidence of targeted "skimming." However, the case presented demonstrates that the integration of sensor technology, vehicle input options, and potential data transmission can entail unintended risks, even in the absence of any proven misuse.
The fundamental question raised by the CAM is as follows: To what extent is data generated, where is it processed, and who has access to it—from both a technical and a legal standpoint? From the perspective of the Commission of the European Communities, this issue is particularly relevant for member states whose legal frameworks may require companies to cooperate with government agencies.
Clear and verifiable standards for connected vehicles.
In this context, the CAM calls for "clear and verifiable standards" for connected vehicles. It highlights the need for transparent data flows, data storage within Europe, and independent testing of software and updates. Consequently, the study proposes a regulatory and testing framework that does not rely on case-by-case assessments, but rather serves as a standard for connected cars and over-the-air (OTA) updates. Stefan Brätzel, director of the CAM, warns that a connected vehicle functions as a "mobile data center" with a permanent server connection. Therefore, if access to data and software is not sufficiently secured, it could potentially serve as a gateway for unauthorized access.
Phased-in prohibitions in the U.S. for the 2027 model year.
In January 2025, the U.S. Department of Commerce’s Bureau of Industry and Security (BIS) implemented regulations governing the import and commercialization of certain connected vehicle technologies, restricting them if there is a significant connection to China or Russia. The authority has based this measure on potential national security risks, such as the possibility of forced data transfer or unauthorized remote access.
The BIS rule establishes phased-in prohibitions. Starting with the 2027 model year, the sale of certain connected vehicles will be prohibited if the manufacturers are under Chinese or Russian control, or if "covered software" from these countries is used. Regarding hardware components within the "Vehicle Connectivity Systems" category, the BIS identifies the 2030 model year as the next milestone, while for components not associated with a specific model year, the deadline is January 1, 2029. According to the BIS, the regulation in question entered into force on March 17, 2025.
Current requirements in Europe.
In the European market, cybersecurity is a critical aspect, as it is intrinsically linked to the type-approval process. Within the European Union, manufacturers have been required to meet cybersecurity standards for new vehicle types since July 2022, in accordance with relevant regulations established by the UNECE (WP.29). As of July 2024, this requirement also applies to all newly sold vehicles in the European Union, according to testing service providers.
These WP.29 regulations include UN R155, which concerns a Cybersecurity Management System (CSMS), and UN R156, which covers a Software Update Management System (SUMS). In practice, this goes beyond individual tests; it encompasses processes and testing throughout the entire lifecycle—including incident detection and response, secure software updates, and a legal framework for over-the-air (OTA) updates.
In short, this new study highlights the political dimension, as the race for connected cars is being decided by software architecture and OTA updates. At the same time, there is growing pressure to ensure transparency regarding data chains and updates, and to secure them in a way that can be independently verified. Within the context of alliances and ecosystems—in which players such as Huawei HIMA also play a significant role—issues surrounding access, supply chains, and regulation are becoming central to the debate on connected vehicles in Europe.
