China Seeks Comments on Mandatory Auto Cybersecurity Standard for Secure Startup and Software Updates

The Ministry of Industry and Information Technology has opened public consultation on the mandatory national standard "Technical Requirements for Automotive Cryptographic Technology." The ministry, through the National Technical Committee of Auto Standardization, has completed the drafting and revision of the standard. The draft was released for public comment on August 21, with a deadline of October 20, 2026. The standard specifies technical requirements for cryptographic applications in vehicles, criteria for conformity of identical types, and corresponding test methods.

One of the core requirements is the application of cryptography for secure startup. Vehicles must use cryptographic technology to ensure that software components loaded during power-on or restart are authentic, complete, and trustworthy, preventing firmware, bootloaders, operating systems, or critical application software from being tampered with, replaced, or forged before execution. At each power-on, the software system must verify the legitimacy of each layer of startup components sequentially; any tampered layer will be blocked. The test method requires testers to sequentially attempt to replace images of startup components—such as firmware, bootloaders, operating systems, and critical application software—then power on the vehicle to check whether the system performs a layer-by-layer secure startup verification process.

The standard also covers vehicle software update scenarios, requiring that when a vehicle uses its onboard software update system, cryptographic technology be employed to verify the authenticity and integrity of the update package, ensuring that malicious code is not injected during the update process. The standard is intended to guide and regulate the design, development, and testing of cryptographic applications in complete vehicles and components, covering overall framework, general requirements, and security requirements. Once the mandatory national standard is issued, all vehicle models sold in the Chinese market must comply with the cryptographic application technical requirements.