ARAI Launches Full-Spectrum Vehicle Cybersecurity Testing in India

ARAI Launches Comprehensive Vehicle Cybersecurity Capability in India

The Automotive Research Association of India (ARAI) has introduced a full-spectrum vehicle cybersecurity capability, making it the first testing agency in India to bring testing, verification and validation, research and development, and homologation services together within one facility. The initiative addresses the growing cybersecurity requirements of vehicles incorporating connected systems and software-defined architectures. As automotive functions increasingly depend on software and electronic components, cybersecurity has become relevant to vehicle development as well as regulatory safety and approval processes. The new capability is designed to help vehicle manufacturers and suppliers evaluate security, conduct technical assessments, and address applicable automotive cybersecurity requirements through an integrated domestic service offering.

AIS-189 and AIS-190 Compliance Support for Manufacturers

ARAI's new capability supports manufacturers and suppliers working to demonstrate compliance with India's automotive cybersecurity standards AIS-189 and AIS-190. AIS-189 establishes requirements for Cyber Security Management Systems, while AIS-190 addresses Software Update Management Systems. The facility's assessment, testing, and homologation activities are structured to support compliance work associated with both standards. These requirements are increasingly significant as connected vehicle functions and software-defined architectures introduce additional cybersecurity considerations throughout development and approval. By bringing relevant services together in India, ARAI provides automotive businesses with a domestic facility for cybersecurity evaluation associated with the standards, without suggesting that using the facility alone automatically guarantees compliance or regulatory approval.

Vehicle Cybersecurity Testing, Research, and Technical Services

The facility offers services extending beyond standard compliance assessments. These include Vulnerability Assessment and Penetration Testing (VAPT), verification and validation of Threat Analysis and Risk Assessment (TARA) reports, and the development of Hardware Security Modules (HSM) and Software Security Modules (SSM). It also covers XiL-based cybersecurity evaluation, vehicle-to-everything (V2X) testing, and the tracking and maintenance of Common Vulnerabilities and Exposures (CVE) records. Together, these capabilities address different aspects of automotive cybersecurity, from identifying potential weaknesses and evaluating threat assessments to developing security modules and testing connected technologies. The service portfolio is intended to support cybersecurity assurance throughout the vehicle lifecycle, including development and post-market support.

Coverage Across Vehicles and Automotive Electronic Systems

ARAI's cybersecurity capability covers complete vehicles, electronic control units, connected systems, and other automotive electronic components. This scope enables manufacturers and suppliers to access relevant assessment and engineering services across different layers of a vehicle's electronic and software architecture. By consolidating testing, research and development, verification, validation, and homologation under one roof, ARAI positions the facility as a single point of access for organizations navigating cybersecurity requirements during vehicle development and approval. The integrated approach can help coordinate different evaluation activities within one domestic service environment. Its stated scope spans multiple automotive system categories rather than being limited to a single component or one cybersecurity testing method.

ARAI's Institutional Background and Accreditations

Established in 1966, the Automotive Research Association of India is affiliated with India's Ministry of Heavy Industries and is recognized by the Department of Scientific and Industrial Research. The organization also holds accreditation from the National Accreditation Board for Testing and Calibration Laboratories (NABL) and is certified under ISO 9001, ISO 14001, ISO 27001, and ISO 45001:2018. Across more than six decades, ARAI has provided testing, homologation, certification, and research and development services to the Indian automotive sector. This established institutional role provides context for its expansion into vehicle cybersecurity. The new capability adds specialized cybersecurity services to its broader automotive testing and engineering activities.

Domestic Cybersecurity Assessment Could Reduce Overseas Dependence

Before this capability was established, manufacturers seeking specialized vehicle cybersecurity assessments often had to rely on facilities outside India. ARAI's domestic offering creates the opportunity for a greater share of cybersecurity testing and development work to take place within the country. This could affect project costs and lead times for manufacturers and suppliers operating in the Indian market, although the announcement does not quantify potential savings or specify expected reductions in testing duration. Local access may also make it easier for automotive businesses to coordinate cybersecurity evaluation with other development and approval activities. The practical benefit will depend on individual project requirements, service availability, and the assessments each manufacturer needs to complete.

Automotive Cybersecurity and the Evolution of Vehicle Approval

The expansion reflects a wider shift in which cybersecurity is becoming more closely connected with automotive technology development and regulatory approval. As software assumes a larger role in vehicle functions, manufacturers must consider potential cyber threats alongside conventional engineering and safety requirements. India's AIS-189 and AIS-190 standards address cybersecurity management and software update management, respectively, while ARAI's new facility provides supporting assessment and homologation capabilities. Similar regulatory and technological developments are taking place across multiple global markets, according to the source article. By expanding domestic testing infrastructure, ARAI aligns its service offering with this direction and gives manufacturers in India a local resource for addressing evolving automotive cybersecurity requirements.

Industry Impact & Outlook

ARAI's integrated cybersecurity capability could strengthen India's automotive development ecosystem by making specialized testing, research, and homologation services more accessible to domestic manufacturers and suppliers. Local access may help reduce reliance on overseas facilities and could improve coordination between cybersecurity evaluation and vehicle approval, although the scale of any cost or timing benefits remains unquantified. The facility is particularly relevant as connected systems and software-defined vehicle architectures increase the importance of protecting electronic components, software updates, and vehicle-to-everything communications. Its longer-term value will depend on how manufacturers use the available services to address AIS-189 and AIS-190 requirements and maintain cybersecurity assurance throughout the vehicle lifecycle. The development also supports the broader integration of cybersecurity into automotive testing infrastructure.

Frequently Asked Questions

What has ARAI launched in India?
The Automotive Research Association of India has launched a full-spectrum vehicle cybersecurity capability that combines testing, verification and validation, research and development, and homologation within one facility. It is described as the first testing agency in India to offer these services together. The capability covers vehicles, electronic control units, connected systems, and other automotive electronic components. It is intended to support manufacturers and suppliers working on automotive cybersecurity assessments, regulatory requirements, and vehicle development, including activities associated with India's AIS-189 and AIS-190 standards.

What are AIS-189 and AIS-190?
AIS-189 and AIS-190 are Indian automotive industry standards addressing different aspects of vehicle cybersecurity management. AIS-189 sets out requirements for Cyber Security Management Systems, while AIS-190 covers Software Update Management Systems. ARAI's new facility is structured to support manufacturers and suppliers in demonstrating compliance through assessment, testing, and homologation activities. These standards are relevant as connected vehicle technologies and software-defined architectures increase the role of cybersecurity in vehicle development and approval. The facility provides technical services to support compliance work but does not, by its existence alone, guarantee that a vehicle meets every applicable requirement.

Which vehicle cybersecurity services does the ARAI facility provide?
The ARAI facility offers Vulnerability Assessment and Penetration Testing, verification and validation of Threat Analysis and Risk Assessment reports, and development of Hardware Security Modules and Software Security Modules. Its services also include XiL-based cybersecurity evaluation, V2X testing, and the tracking and maintenance of Common Vulnerabilities and Exposures records. These activities address different cybersecurity needs across automotive systems, from identifying vulnerabilities to evaluating risks and testing connected technologies. The facility combines these services with research and development, verification, validation, and homologation, supporting cybersecurity assurance during development and post-market operations.

Which automotive systems are covered by ARAI's cybersecurity capability?
ARAI's new capability covers vehicles, electronic control units, connected systems, and other automotive electronic components. This scope allows manufacturers and suppliers to seek cybersecurity assessment and engineering services for different parts of a vehicle's electronic and software architecture. The facility brings testing, research and development, verification, validation, and homologation together at one location. Its coverage is not restricted to one electronic component or a single testing method. The overall objective is to support cybersecurity assurance throughout the vehicle lifecycle, including development activities and post-market support for automotive products and systems.

How could domestic vehicle cybersecurity testing benefit Indian manufacturers?
Domestic vehicle cybersecurity testing could reduce the need for manufacturers to rely on facilities outside India for specialized assessments. Before ARAI introduced its new capability, companies requiring such services often had to use overseas facilities. Conducting a greater share of testing and development work within India could influence project costs and lead times and help coordinate cybersecurity assessments with other development activities. However, the source announcement does not quantify expected savings or confirm specific reductions in testing duration. The actual benefits will depend on each manufacturer's requirements and use of the available services.

What credentials does the Automotive Research Association of India hold?
Established in 1966, the Automotive Research Association of India is affiliated with India's Ministry of Heavy Industries and recognized by the Department of Scientific and Industrial Research. It holds accreditation from the National Accreditation Board for Testing and Calibration Laboratories and is certified under ISO 9001, ISO 14001, ISO 27001, and ISO 45001:2018. ARAI has provided testing, homologation, certification, and research and development services across the Indian automotive sector for more than six decades. These credentials and its established industry role provide context for its expansion into specialized vehicle cybersecurity services.

Why is cybersecurity becoming more important in automotive development?
Cybersecurity is becoming more important because vehicles increasingly use connected systems and software-defined architectures that expand the potential attack surface for cyber threats. These developments make security relevant not only during vehicle design and engineering but also within regulatory frameworks governing safety and approval. India's AIS-189 and AIS-190 standards address cybersecurity management and software update management, respectively. ARAI's facility provides testing and assessment services intended to support manufacturers working with these requirements. As software becomes more central to vehicle functions, cybersecurity evaluation is increasingly connected with vehicle development, approval, and post-market support.