Intelligent Connected Vehicle Market Access Management

Intelligent connected vehicle (ICV) access management refers to a regulatory framework where governing authorities, such as the Ministry of Industry and Information Technology (MIIT), review and grant market approval to ICV manufacturers and products in accordance with statutory regulations and technical standards. Under this regime, carmakers must fulfil stringent access audit requirements across research and development (R&D), manufacturing, and safety management systems. Meanwhile, vehicles must pass technical evaluations covering functional safety, safety of the intended functionality (SOTIF), cybersecurity, data security, and software update safety before being granted market access approval.

Regulatory Framework and Core Approach

China's ICV access management is guided by the overarching principle of "balancing development and safety, with safety as the top priority", establishing an end-to-end regulatory ecosystem spanning from new vehicle type approval to in-use vehicle recalls, and from manufacturer capability verification to full vehicle lifecycle governance. The core logic of this framework revolves around a "three horizontals, two verticals" structure: "Three Horizontals" represents universal baseline safety competencies across cybersecurity, data security, and software update safety; "Two Verticals" covers dedicated, tier-based governance for Level 2 combined driver assistance systems and Level 3/Level 4 automated driving technologies.

In terms of execution, the regulatory rollout follows a phased "targeted entry, conditional implementation" strategy — gathering practical insights via pilot programmes before refining formal policies. In November 2023, four Chinese government bodies, led by MIIT, jointly launched pilot programmes for ICV market access and public road operations. By December 2025, two models from Changan Automobile and BAIC BluePark Magna equipped with Level 3 conditional automated driving capabilities officially received access approval, marking the pilot’s transition into real-world on-road operations.

Manufacturer Access Audit Requirements

On 21 January 2026, MIIT gazetted the revised "Requirements for Road Motor Vehicle Manufacturing Enterprise Access Audits", slated to take effect on 1 January 2027. Spanning four key sections and 163 clauses, the core revisions highlight several major updates:

Comprehensive elevation of ICV capability standards. For the first time, the new regulations systematically integrate cybersecurity, data security, over-the-air (OTA) software updates, combined driver assistance, and automated driving competencies as mandatory entry criteria for manufacturers. On the cybersecurity front, carmakers must establish an end-to-end management mechanism covering risk mitigation, vulnerability handling, emergency response, and real-name registration for automotive SIM/eSIM cards. In terms of data security, the mandate highlights full-lifecycle governance, stipulating clear guidelines on data classification, domestic on-shore storage, and cross-border data transfer assessments.

Reinforcing New Energy Vehicle (NEV) safety systems. The framework further details capability-building requirements for NEV safety frameworks, securing baseline safety at the corporate level. Automakers producing vehicles equipped with combined driver assistance or automated driving systems must possess dedicated R&D teams along with proven functional safety and SOTIF assurance capabilities. They are also required to establish a multi-tier validation system encompassing computer simulations, closed testing grounds, and actual on-road evaluations, alongside end-of-line quality verification capabilities.

Optimising manufacturer resource allocation. Eligible corporate groups are permitted to share R&D, procurement, sales, and select manufacturing resources, empowering industry leaders to scale up and enhance operational efficiency. At the same time, requirements for certain plant tooling, equipment, and R&D facilities have been calibrated to maximise overall resource utilisation.

Vehicle Product Access Audit Requirements

The "Product Access Audit Requirements" introduced concurrently in January 2026 set out more granular evaluation benchmarks at the vehicle level:

Tightening safety and quality baselines. Traditional vehicle durability and reliability test standards are now integrated into the access audit to minimise quality risks stemming from inadequate validation. Technical parameters concerning combined driver assistance systems and OTA update protocols have been incorporated into product access and Conformity of Production (CoP) governance. These must also be filed with the State Administration for Market Regulation (SAMR) to facilitate defect investigations and vehicle recall management.

Elevating technical parameter audits. During product access applications, manufacturers must declare comprehensive and precise technical parameters for driver assist suites and OTA updates. Items affecting vehicle functions and performance require accredited inspection and testing reports. For test items without corresponding national standards yet, carmakers are permitted to submit self-validation reports based on their internal technical specifications.

Fostering innovation through balanced, prudent regulation. Operating under a "firm safety baseline + flexible regulatory room" approach, the policy creates institutional pathways for cutting-edge technologies like autonomous driving and vehicle-to-everything (V2X) integration, while maintaining uncompromising safety standards.

Synergy Between Access and Recall Governance

In February 2025, MIIT and SAMR jointly issued the "Notice on Further Strengthening the Management of Product Access, Recalls, and Over-The-Air Software Updates for Intelligent Connected Vehicles", establishing a closed-loop regulatory lifecycle encompassing "pre-market access prevention, in-market operational supervision, and post-incident traceability and accountability".

Regulatory sandbox mechanism: Upon securing vehicle access approval, manufacturers are required to submit comprehensive testing protocols for their driver assistance systems to SAMR, conducting in-depth validation and defect identification under a safety regulatory sandbox.

Incident and accident reporting protocol: Carmakers must promptly report to governing authorities whenever system failures in combined driver assistance suites trigger sudden disengagements, crashes, or other traffic mishaps. MIIT will actively analyse and assess these reports to continuously fine-tune access requirements and technical standards.

Tiered OTA update management: Routine OTA updates that do not alter key vehicle technical specifications can be deployed post-filing. Updates involving technical parameter modifications require prior product variation approvals, whereas OTA deployments involving automated driving functionalities must obtain full regulatory clearance under access management rules.

Technical Validation for Level 3/Level 4 Autonomous Access

In rolling out access approvals for Level 3/Level 4 automated driving vehicles, a "multi-pillar" testing and validation methodology has been established: evaluating complex traffic scenario coverage via simulation testing; assessing edge-case limits on closed proving grounds; validating operational stability and environmental adaptability through real-world road trials; and establishing a closed-loop incident monitoring and optimisation system to continuously refine vehicle software using recorded anomaly data.

Underpinning Technical Standards

The National Technical Committee of Auto Standardization (NTCAS) has initiated the drafting of over 160 national and automotive industry standards for ICVs. Among the 16 core standards supporting the pilot initiatives, 12 have already been gazetted or submitted for approval. These include mandatory national standards such as GB 44495-2024 "Cybersecurity Requirements for Road Vehicles", GB 44496-2024 "General Technical Requirements for Vehicle Software Updates", and GB 44497-2024 "Intelligent and Connected Vehicles — Data Storage System for Automated Driving", alongside the upcoming mandatory standard "Intelligent and Connected Vehicles — Safety Requirements for Automated Driving Systems". This establishes a virtuous cycle where "standards support real-world pilot rollouts, and pilot insights drive standard evolution".