From 1 January 2026, vehicles sold in China must meet a mandatory national cybersecurity standard, GB 44495-2024, which sets both a manufacturer management system and specific, testable technical requirements for the vehicle itself. Manufacturers and suppliers with UN R155 programmes will recognise the structure, but GB 44495 goes further into concrete vehicle tests: open ports, remote command verification, command logs, interface access control, vehicle-to-cloud authentication and certificate checks. This guide explains scope, the main obligations, status, how conformity is assessed, and where machine identities, keys and certificates sit. It is for OEM and Tier 1 cybersecurity, homologation and product security teams.
Source note: the standard's status, dates and mandatory nature are confirmed from China's National Standards Information Public Service Platform (std.samr.gov.cn). The full official text could not be accessed when this guide was written (8 November 2026), so clause content is taken from secondary sources, named in each place: the published English translation preview of GB 44495-2024 on Chinese Standard (chinesestandard.net), a PwC Japan analysis, the EU-China SESEC project, and Chinese press reports of the MIIT announcement. Figures are included only where two independent sources agree. Confirm against the official text before relying on it.
Key takeaways
- Mandatory and in force. GB 44495-2024 is a mandatory national standard released on 23 August 2024 and implemented from 1 January 2026, and std.samr.gov.cn lists it as current.
- Broad vehicle scope. It covers category M (passenger) and N (goods) vehicles, and category O (trailers) fitted with at least one electronic control unit (ITHome, Jiemian, SESEC).
- Management system plus vehicle tests. Clause 5 sets the vehicle cybersecurity management system; clauses 6 and 7 set basic and technical requirements; clause 8 sets inspection and test methods (Chinese Standard translation).
- Identity is built into the tests. Vehicle-to-cloud identity verification, V2X certificate validation, remote control command verification and command logs kept for at least six months are explicit (Chinese Standard translation; PwC Japan on log retention).
- Related standards apply together. GB 44496-2024 covers software update requirements and GB/T 44464-2024 vehicle data; GB 44495 references both (Chinese Standard translation).
Scope: who and what is covered
The official record on the National Standards Information Public Service Platform gives the Chinese title 汽车整车信息安全技术要求 (technical requirements for whole-vehicle information security), standard number GB 44495-2024, nature mandatory, release date 23 August 2024 and implementation date 1 January 2026. ITHome reports that the Ministry of Industry and Information Technology (MIIT) organised drafting and that the State Administration for Market Regulation (SAMR) and the Standardization Administration of China (SAC) approved and issued it. Jiemian reports MIIT describing it, with two companion standards, as the first mandatory national standards in China's intelligent connected vehicle field.
| Item | What applies | Source |
|---|---|---|
| Vehicles | Category M and N vehicles; category O vehicles with at least one ECU | ITHome; Jiemian; SESEC |
| Who must comply | Vehicle manufacturers, with supplier risks managed through the manufacturer's system | Chinese Standard translation (clauses 5 and 6) |
| Lifecycle | Development, production and post-production phases | Chinese Standard translation (clause 5) |
| Companion standards | GB 44496-2024 (software update), GB/T 44464-2024 (vehicle data, recommended standard) | Chinese Standard translation (normative references) |
Suppliers are not directly regulated by the standard, but clause 6 requires manufacturers to identify and manage risks relating to suppliers, so Tier 1 and Tier 2 suppliers will see the requirements flow down through contracts and evidence requests.
Key obligations
The translated table of contents lists ten clauses: scope, normative references, terms and definitions, abbreviated terms, requirements for the vehicle cybersecurity management system (5), basic requirements for cybersecurity (6), technical requirements for cybersecurity (7), inspection and test methods (8), same type determination (9) and implementation of the standard (10).
Clause 5: management system
- Lifecycle coverage: a cybersecurity management system covering development, production and post-production (Chinese Standard translation).
- Risk process: processes to identify, assess, classify and handle risks, verify that risks are addressed, and keep risk assessments current (Chinese Standard translation). PwC Japan describes the standard's risk management as running from research and development through to disposal.
- Audit items: PwC Japan notes that where UN R155 relies on ISO/SAE 21434 for audit methods, GB 44495 sets out audit items in an annex.
Clause 6: basic requirements
- Develop products under the management system (Chinese Standard translation).
- Identify and manage risks from the vehicle and its suppliers, including key elements and external interactions, and verify measures by testing; where a measure is not relevant or is insufficient, explain why or add other measures (Chinese Standard translation).
- Protect dedicated environments for post-installed software and data, and provide attack identification, monitoring and forensic capability (Chinese Standard translation).
- Use public, validated cryptographic algorithms and modules that meet recognised standards, or justify exceptions (Chinese Standard translation; PwC Japan also lists encryption to existing standards as a requirement).
Clause 7: technical requirements
| Area | Requirement (as summarised from the translation) | What testers will look for |
|---|---|---|
| External connections (7.1) | No known high-risk vulnerabilities left unaddressed; unnecessary network ports closed | Vulnerability scan results and port scans of telematics and infotainment units |
| Remote control (7.1) | Verification of remote control commands, access control, and command logging retained for at least six months | Command signing or authentication, authorisation checks, log retention evidence |
| Third-party applications (7.1) | Verification of third-party apps and user prompts | App signature checks and permission prompts |
| Physical interfaces (7.1) | Access control for USB, SD card and diagnostic interfaces; virus checks on USB-connected devices | Diagnostic authentication and media scanning behaviour |
| Vehicle-cloud communication (7.2) | Identity verification between vehicle and the manufacturer's cloud platform | Mutual authentication with device certificates or keys |
| V2X (7.2) | Certificate validation for V2X communication | Certificate chain and validity checks |
| Wireless channels (7.2) | Integrity protection for external wireless channels (RFID and NFC excepted) | Message authentication on cellular, Wi-Fi and Bluetooth channels |
| Data operations (7.2) | Access control for data operation commands | Authorisation on commands that read or change vehicle data |
Software update and data security are covered through the companion standards rather than dedicated clauses in the translated excerpt. PwC Japan adds that automotive data processing must follow China's automotive data security rules, that vulnerability management must take account of the network product vulnerability rules, that security by default is expected, and that data may not be transferred across borders directly from the vehicle. Those points depend on other Chinese rules; confirm them with counsel.
Timeline and current status
| Date | Event | Source |
|---|---|---|
| 2019 | MIIT begins drafting the intelligent connected vehicle mandatory standards | Jiemian |
| 23 August 2024 | GB 44495-2024 released | std.samr.gov.cn; Chinese Standard |
| 4 September 2024 | MIIT announces the standard publicly | ITHome |
| 1 January 2026 | Implementation date | std.samr.gov.cn; ITHome; SESEC |
| 8 November 2026 | Status shown as current (现行) | std.samr.gov.cn |
Clause 10 sets how the standard applies to new vehicle types and to types already approved before implementation. PwC Japan describes a later date for already approved types than for new types; we could not confirm the exact transition period from a second source, so check clause 10 of the official text.
How GB 44495 relates to UN R155
SESEC reports that China developed the standard independently but that it was influenced by UN regulations R155, R156 and R157, and advises manufacturers to watch for technical differences. PwC Japan says GB 44495 references UN R155 and ISO/SAE 21434, so much of the management system work overlaps.
| Topic | UN R155 | GB 44495-2024 |
|---|---|---|
| Management system | CSMS certificate | Vehicle cybersecurity management system (clause 5) |
| Vehicle requirements | Risk-based, with threats and mitigations listed in its annex | Risk-based plus specific technical requirements and test methods (clauses 7 and 8) |
| Audit method | Relies on ISO/SAE 21434 practice (PwC Japan) | Audit items set in an annex (PwC Japan) |
| Logging | Monitoring and forensic capability | Remote command logs kept at least six months (Chinese Standard; PwC Japan) |
| Same type | Vehicle type definition in the regulation | Same type determination in clause 9 (E/E architecture, gateway, update system, cellular modules, interfaces, cloud endpoints) |
See the UNECE R155 Cyber Security Management System Guide for R155 itself; this page does not repeat it.
Enforcement and penalties
- No penalty figures in the standard: GB 44495 is a technical standard. Consequences arise through China's vehicle market access and type approval system, which applies mandatory standards.
- Two assessments: PwC Japan describes the regime as split into management system certification and vehicle type approval.
- Same type determination (clause 9): per the translation, vehicles can be treated as the same type when the management system is effective and the E/E architecture, security measures and key components (central gateway, update system, cellular modules, wireless protocols, external interfaces, cloud endpoints) are unchanged or reduced. Changed vehicles may need only targeted retesting, with approval. Plan engineering changes with this in mind.
The specific approval authority procedures and any sanctions for non-conforming vehicles sit in other Chinese regulations that we did not review. Confirm them with your homologation partner.
What it means for AI agents and non-human identities
A connected vehicle is a fleet of machine identities: ECUs, telematics units, back-end services and V2X stations, each authenticating with keys and certificates. GB 44495 turns several of these into tested requirements.
| Requirement | Machine identity involved | Practice to adopt |
|---|---|---|
| Vehicle-cloud identity verification (7.2) | Per-vehicle device certificate or key, and the cloud platform's server identity | Unique per-vehicle credentials in a hardware security element; mutual TLS; no shared fleet keys |
| V2X certificate validation (7.2) | V2X station certificates | Validate chain, validity and revocation status before trusting messages |
| Remote command verification and logs (7.1) | Mobile apps, back-end services and agents that issue commands | Sign commands at the back end; authorise per user and per service; keep at least six months of logs |
| Diagnostic access control (7.1) | Workshop tools and diagnostic service accounts | Authenticated diagnostic sessions with short-lived, role-scoped credentials |
| Cryptography (clause 6) | All keys and certificates | Recognised algorithms and modules; documented key lifecycle and rotation |
| Supplier risk (clause 6) | Supplier back-end and update service credentials | Inventory supplier access into vehicle and cloud systems and scope it tightly |
AI assistants that can issue remote vehicle commands, such as voice agents or fleet automation, are command issuers in the sense of 7.1. Give each its own identity and scope, and make sure its commands are verified and logged like any other. Our recommendation at NHI Mgmt Group: treat the back-end certificate authority and command signing keys as tier-zero assets. See the Connected and Autonomous Vehicle Security Guide and the Uptane and Vehicle OTA Security Guide.
Compliance steps
- Obtain the official text. Buy the official Chinese text and an authorised translation, including GB 44496 and GB/T 44464, and confirm the clause 10 transition rules.
- Gap-assess from R155. Map your existing CSMS and ISO/SAE 21434 artefacts to clause 5 and the annex audit items; record gaps. See the ISO/SAE 21434 Automotive Cybersecurity Engineering Guide.
- Build a clause 7 test matrix. For each vehicle type, list every external interface, port, remote command, wireless channel and data command, with the test method from clause 8.
- Fix identity and crypto first. Confirm unique per-vehicle credentials, mutual authentication with the cloud, V2X certificate validation and command signing. These are the hardest to change late.
- Set up logging. Implement remote command logging with at least six months of retention, and the monitoring and forensic capability clause 6 expects.
- Flow down to suppliers. Add GB 44495 evidence requirements to supplier contracts, especially for telematics, gateway and infotainment units.
- Pre-test. Run internal or third-party tests against the clause 8 methods before formal testing, and fix findings.
- Plan changes against clause 9. Track changes to E/E architecture, gateway, update system, cellular modules and cloud endpoints, since these can affect same type status.
- Keep data rules in view. Align data handling with China's automotive data rules and cross-border restrictions, with counsel.
Measuring readiness
- Share of clause 7 requirements with passing test evidence per vehicle type.
- Open high-risk vulnerabilities on external-facing units and median time to remediate.
- Share of vehicles with unique, hardware-protected cloud credentials.
- Remote command log retention verified at six months or more.
- Suppliers with GB 44495 evidence delivered on time.
Decision points
- Global OEM with R155 in place: reuse the CSMS and focus effort on the clause 7 vehicle tests and the annex audit items, which are where most new work sits.
- China-focused OEM or new entrant: build one management system that satisfies GB 44495 first, then map it to R155 if export is planned.
- Tier 1 supplier: prioritise telematics, gateway and infotainment evidence, since those units carry most of the external connection and communication requirements.
- Single platform or regional variants: a shared global architecture reduces test effort, but China-specific cloud endpoints and data localisation often justify a regional variant; weigh that against clause 9 same type rules.
Practitioner checklist
- Confirm each vehicle type in scope (M, N, or O with an ECU) and its approval timing under clause 10.
- Map the existing R155 CSMS and ISO/SAE 21434 work to clause 5 and the annex audit items.
- Close unnecessary ports and remediate known high-risk vulnerabilities on external interfaces.
- Verify and authorise every remote command and keep logs for at least six months.
- Use unique per-vehicle credentials and mutual authentication with the manufacturer cloud.
- Validate V2X certificates and protect integrity on external wireless channels.
- Control access to USB, SD card and diagnostic interfaces.
- Flow requirements and evidence requests down to suppliers.
- Track architecture changes against clause 9 same type rules.
Standards and references
- National Standards Information Public Service Platform (SAMR): GB 44495-2024 record
- Chinese Standard: GB 44495-2024 English translation (preview)
- ITHome: MIIT announcement of GB 44495-2024
- Jiemian: three mandatory intelligent connected vehicle standards
- SESEC: China issues vehicle cybersecurity standards
- PwC Japan: China vehicle cybersecurity standard analysis
Related NHI Mgmt Group resources: UNECE R155 Cyber Security Management System Guide · ISO/SAE 21434 Automotive Cybersecurity Engineering Guide · Automotive Cybersecurity Guide · US Connected Vehicles ICTS Rule Guide. This guide summarises GB 44495-2024 and is not legal advice.