Browse
Log in / Register
Share
March 26, 2025 — India’s Ministry of Heavy Industries has directed all electric vehicle (EV) original equipment manufacturers (OEMs) to immediately audit battery communication systems for cyber vulnerabilities, with full compliance to new cybersecurity standards mandatory by October 1, 2026. The directive follows alarming reports that publicly available smartphone apps could remotely access and even disable the batteries of certain EVs by exploiting insecure Bluetooth-enabled Battery Management System (BMS) modules.
The move marks a critical shift in India’s approach to vehicle safety, expanding beyond traditional mechanical and battery performance to address digital threats. As EVs become increasingly software-defined—relying on over-the-air (OTA) updates, intelligent BMS, and cloud connectivity—the attack surface has grown exponentially. India’s fast-growing market for connected electric two-wheelers, three-wheelers, and domestically manufactured battery packs makes this regulatory push both timely and urgent.
The ministry has instructed OEMs to conduct comprehensive security reviews of battery communication interfaces, eliminate insecure default settings, strengthen authentication mechanisms, and secure OTA communication pathways. Automakers are also required to remove vulnerable third-party applications from their vehicles’ ecosystems and adopt internationally accepted cybersecurity practices.
The regulatory framework is built on two proposed standards: AIS-189 (Cyber Security Management Systems, CSMS) and AIS-190 (Software Update Management Systems, SUMS), introduced by the Ministry of Road Transport and Highways. These standards establish a lifecycle approach to cybersecurity, requiring manufacturers to integrate security from design through production and post-sale updates. They are modeled after international frameworks such as the UN Regulation No. 155 and No. 156, as well as the ISO/SAE 21434 standard.
The government’s urgency was sparked by investigations revealing that apps like BAT-BMS, Epoch Li-ion, and Lossigy could remotely access BMS modules via unsecured Bluetooth connections. In some cases, attackers could disable the battery pack, stranding the vehicle or causing safety hazards. The Ministry of Electronics and Information Technology (MeitY) reportedly asked Apple and Google to remove these apps from their app stores, though the companies have not publicly confirmed action.
Such incidents are not isolated to India. In the United States, the National Highway Traffic Safety Administration (NHTSA) has been issuing advisories since 2022 on the risks of unsecured BMS interfaces, and in 2024 released updated Cybersecurity Best Practices for Modern Vehicles that explicitly calls out battery management systems as a critical vulnerability point. Tesla has also disclosed multiple bug bounty reports related to third-party app interactions with its BMS.
India’s new rules carry significant weight for global automakers and suppliers. Many international EV brands, including Tesla, Hyundai, and Kia, manufacture or assemble vehicles in India or source battery packs from Indian suppliers. The October 2026 deadline gives them roughly 18 months to align their products with AIS-189/190.
For US-based automakers exporting to India or using Indian battery components, the mandate means they must ensure their BMS and OTA systems meet these standards. The Indian government has also written to the Society of Indian Automobile Manufacturers (SIAM) and the Automotive Component Manufacturers Association of India (ACMA) to enforce security reviews across the entire EV supply chain—from battery cell makers to software developers.
The US itself is accelerating EV adoption, with the Biden administration targeting 50% EV sales by 2030. However, cybersecurity regulation for EVs remains fragmented. While NHTSA issues voluntary best practices and the Federal Motor Vehicle Safety Standards (FMVSS) do not yet explicitly cover software security, the Indian mandate could become a de facto benchmark. US automakers selling globally may opt to implement AIS-189/190 compliance across their entire product lines to avoid separate certification processes.
Moreover, the vulnerabilities exposed in India are not region-specific. The same Bluetooth-enabled BMS modules are used in many EV models sold in the US. A 2024 study by the cybersecurity firm Upstream Security found that 40% of EV cyber incidents globally involved BMS or charging infrastructure, with annual incidents growing by 35% year-over-year.
India’s government acknowledges that no single standard can eliminate all risks, but AIS-189 and AIS-190 represent a significant step toward building a secure connected vehicle ecosystem. As Dr. Seema Javed, an environmentalist and climate communications professional, wrote in a recent analysis: “Cyber security is no longer an optional feature—it is becoming a fundamental pillar of the future of electric mobility.”
The timing aligns with India’s rapid growth in software-defined vehicles, remote diagnostics, and indigenous battery manufacturing. Consumer trust hinges on the ability to protect vehicles from digital attacks just as much as from physical crashes. For the US, India’s move offers a template—and a warning—that the next big challenge in the EV transition is not just charging infrastructure or battery costs, but digital security.
As the global EV market races toward electrification, regulators in both India and the US are recognizing that safety must be redefined for an era where vehicles are as much computers as they are cars. The industry’s ability to adapt
