{"id":14804,"date":"2026-11-11T10:32:04","date_gmt":"2026-11-11T09:32:04","guid":{"rendered":"https:\/\/advancedfleetmanagementconsulting.com\/eng\/?p=14804"},"modified":"2026-11-11T10:32:04","modified_gmt":"2026-11-11T09:32:04","slug":"the-major-risk-posed-by-connected-cars-now-necessitating-new-prohibitions-and-regulations","status":"publish","type":"post","link":"https:\/\/advancedfleetmanagementconsulting.com\/eng\/2026\/11\/11\/the-major-risk-posed-by-connected-cars-now-necessitating-new-prohibitions-and-regulations\/","title":{"rendered":"The major risk posed by connected cars, now necessitating new prohibitions and regulations"},"content":{"rendered":"

The international study “Connected Car Innovation 2026” (CAM) describes modern vehicles as systems that are permanently networked, capable of continuously generating and transmitting information via cameras, sensors, and location data. Simultaneously, over-the-air (OTA)<\/strong><\/a> wireless updates allow manufacturers to update software remotely, thereby enabling the subsequent modification of vehicle functions.<\/p>\n

New gateways for hackers and cybercriminals.<\/strong><\/h4>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 In environments featuring a high number of interfaces for mobile communications, WLAN, or cloud services, new potential opportunities arise for hackers<\/strong><\/a> and criminals. CAM concludes that, with the increasing software-based control of vehicles, cybersecurity<\/strong><\/a> is no longer merely an IT issue; it directly impacts vehicle safety and the handling of vehicle data.<\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Furthermore, anyone involved in developing software, deploying updates, or processing data could, in theory, not only access that data but also intervene in systems critical to vehicle operation and safety. CAM explicitly links this discussion to the transition toward “software-defined vehicles,” in which artificial intelligence<\/strong><\/a> (AI), standardized software architectures, and regular updates are becoming increasingly significant.<\/p>\n

\"\"<\/p>\n

The case of Norway highlights a data-related issue.<\/strong><\/h4>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 The potential for connectivity to reach sensitive areas\u2014even those involving security\u2014is illustrated by an incident in Norway, which is addressed in the CAM presentation. According to information provided by CAM, during the “Hovedstad” military exercise in September, the movements of military personnel were tracked through the use of rental vehicles; additionally, security codes entered at the entrances to barracks were also captured.<\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Among other relevant details, it has been reported that vehicles from the brand Changan Deepal were affected. It is important to note that CAM does not explicitly mention any evidence of targeted “skimming.” However, the case presented demonstrates that the integration of sensor technology, vehicle input options, and potential data transmission can entail unintended risks, even in the absence of any proven misuse.<\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 The fundamental question raised by the CAM is as follows: To what extent is data generated, where is it processed, and who has access to it\u2014from both a technical and a legal standpoint? From the perspective of the Commission of the European Communities, this issue is particularly relevant for member states whose legal frameworks may require companies to cooperate with government agencies.<\/p>\n

Clear and verifiable standards for connected vehicles.<\/strong><\/h4>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 In this context, the CAM calls for “clear and verifiable standards” for connected vehicles. It highlights the need for transparent data flows, data storage within Europe, and independent testing of software and updates. Consequently, the study proposes a regulatory and testing framework that does not rely on case-by-case assessments, but rather serves as a standard for connected cars and over-the-air (OTA) updates. Stefan Br\u00e4tzel, director of the CAM, warns that a connected vehicle functions as a “mobile data center” with a permanent server connection. Therefore, if access to data and software is not sufficiently secured, it could potentially serve as a gateway for unauthorized access.<\/p>\n

\"\"<\/p>\n

Phased-in prohibitions in the U.S. for the 2027 model year.<\/strong><\/h4>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 In January 2025, the U.S. Department of Commerce\u2019s Bureau of Industry and Security (BIS) implemented regulations governing the import and commercialization of certain connected vehicle technologies, restricting them if there is a significant connection to China or Russia. The authority has based this measure on potential national security risks, such as the possibility of forced data transfer or unauthorized remote access.<\/p>\n

The BIS rule establishes phased-in prohibitions. Starting with the 2027 model year, the sale of certain connected vehicles will be prohibited if the manufacturers are under \u00a0 Chinese or Russian control, or if “covered software” from these countries is used. Regarding hardware components within the “Vehicle Connectivity Systems” category, the BIS identifies the 2030 model year as the next milestone, while for components not associated with a specific model year, the deadline is January 1, 2029. According to the BIS, the regulation in question entered into force on March 17, 2025.<\/p>\n

Current requirements in Europe. <\/strong><\/h4>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 In the European market, cybersecurity is a critical aspect, as it is intrinsically linked to the type-approval process. Within the European Union, manufacturers have been required to meet cybersecurity standards for new vehicle types since July 2022, in accordance with relevant regulations established by the UNECE (WP.29). As of July 2024, this requirement also applies to all newly sold vehicles in the European Union, according to testing service providers.<\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 These WP.29 regulations include UN R155, which concerns a Cybersecurity Management System (CSMS), and UN R156, which covers a Software Update Management System (SUMS). In practice, this goes beyond individual tests; it encompasses processes and testing throughout the entire lifecycle\u2014including incident detection and response, secure software updates, and a legal framework for over-the-air (OTA) updates.<\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 In short, this new study highlights the political dimension, as the race for connected cars is being decided by software architecture and OTA updates. At the same time, there is growing pressure to ensure transparency regarding data chains and updates, and to secure them in a way that can be independently verified. Within the context of alliances and ecosystems\u2014in which players such as Huawei HIMA also play a significant role\u2014issues surrounding access, supply chains, and regulation are becoming central to the debate on connected vehicles in Europe.<\/p>\n

Written by\u00a0Jos\u00e9 Miguel Fern\u00e1ndez G\u00f3mez.<\/b><\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

connected cars<\/p>\n","protected":false},"author":3,"featured_media":14805,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[18],"tags":[361],"_links":{"self":[{"href":"https:\/\/advancedfleetmanagementconsulting.com\/eng\/wp-json\/wp\/v2\/posts\/14804"}],"collection":[{"href":"https:\/\/advancedfleetmanagementconsulting.com\/eng\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/advancedfleetmanagementconsulting.com\/eng\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/advancedfleetmanagementconsulting.com\/eng\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/advancedfleetmanagementconsulting.com\/eng\/wp-json\/wp\/v2\/comments?post=14804"}],"version-history":[{"count":1,"href":"https:\/\/advancedfleetmanagementconsulting.com\/eng\/wp-json\/wp\/v2\/posts\/14804\/revisions"}],"predecessor-version":[{"id":14806,"href":"https:\/\/advancedfleetmanagementconsulting.com\/eng\/wp-json\/wp\/v2\/posts\/14804\/revisions\/14806"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/advancedfleetmanagementconsulting.com\/eng\/wp-json\/wp\/v2\/media\/14805"}],"wp:attachment":[{"href":"https:\/\/advancedfleetmanagementconsulting.com\/eng\/wp-json\/wp\/v2\/media?parent=14804"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/advancedfleetmanagementconsulting.com\/eng\/wp-json\/wp\/v2\/categories?post=14804"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/advancedfleetmanagementconsulting.com\/eng\/wp-json\/wp\/v2\/tags?post=14804"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}