Strengthen the access management of intelligent connected vehicle production enterprises and products, maintain the safety of citizens' lives, property, and public safety, and promote the healthy and sustainable development of the intelligent connected vehicle industry.

Opinions of the Ministry of Industry and Information Technology on Strengthening the Access Management of Intelligent Connected Vehicle Production Enterprises and Products

Ministry of Industry and Information Technology Tongzhuang [2021] No. 103

The competent departments of industry and information technology in each province, autonomous region, municipality directly under the central government, and Xinjiang Production and Construction Corps, the communication management bureaus of each province, autonomous region, municipality directly under the central government, and relevant automobile production enterprises:

In order to strengthen the access management of intelligent connected vehicle production enterprises and products, maintain the safety of citizens' lives, property and public safety, and promote the healthy and sustainable development of the intelligent connected vehicle industry, in accordance with the provisions of the Road Traffic Safety Law of the People's Republic of China, the Cybersecurity Law of the People's Republic of China, the Data Security Law of the People's Republic of China, and the Measures for the Access Management of Road Motor Vehicle Production Enterprises and Products, the following opinions are proposed.

1、 Overall requirements

Adhere to the guidance of Xi Jinping Thought on Socialism with Chinese Characteristics for a New Era, thoroughly implement the spirit of the 19th National Congress of the Communist Party of China and the Second, Third, Fourth, and Fifth Plenary Sessions of the 19th Central Committee, implement the requirements of focusing on the new development stage, implementing the new development concept, constructing a new development pattern, and promoting high-quality development, strengthen the main responsibility of enterprises, strengthen the management of automotive data security, network security, software upgrades, functional safety, and expected functional safety, ensure product quality and production consistency, and promote the high-quality development of the intelligent connected vehicle industry.

2、 Strengthen data and network security management

（1） Strengthen data security management capabilities. Enterprises should establish and improve the management system for automotive data security, fulfill their data security protection obligations in accordance with the law, and clarify the responsible departments and individuals. Establish a data asset management ledger, implement data classification and grading management, and strengthen the protection of personal information and important data. Establish technical measures for data security protection to ensure that data remains effectively protected and legally utilized, and implement requirements such as data security risk assessment and data security incident reporting in accordance with laws and regulations. Personal information and important data collected and generated during operations within the territory of the People's Republic of China shall be stored in accordance with relevant laws and regulations. If data needs to be provided overseas, it should undergo a data export security assessment.

（2） Strengthen the ability to ensure network security. Enterprises should establish an automobile network security management system, implement the network security level protection system and the requirements for real name registration management of vehicle networking cards in accordance with the law, and clarify the responsible departments and persons for network security. Having technical measures to protect automotive electronic and electrical systems, components, and functions from network threats, possessing technical conditions for automotive network security risk monitoring, network security defects and vulnerabilities discovery and disposal, ensuring that vehicles and their functions are in a protected state, and guaranteeing the safe operation of vehicles. Implement the requirements for reporting and handling cybersecurity incidents in accordance with laws and regulations.

3、 Standardize software online upgrade

（3） Strengthen enterprise management capabilities. Enterprises producing automotive products with online upgrade (also known as OTA upgrade) functions should establish management capabilities that are compatible with the automotive products and upgrade activities, and have the ability to conduct online upgrade safety impact assessments, testing and verification, implementation process assurance, information recording, etc., to ensure that vehicles are in a safe state during online upgrades, and inform vehicle users of the purpose, content, required time, precautions, upgrade results, and other information of online upgrades.

（4） Ensure consistency in product production. Before implementing online upgrade activities, enterprises should ensure that their automotive products comply with relevant requirements such as national laws and regulations, technical standards, and technical specifications, and register with the Ministry of Industry and Information Technology. If there are changes in technical parameters related to safety, energy conservation, environmental protection, theft prevention, etc., they should report to the Ministry of Industry and Information Technology in advance to ensure the consistency of automotive product production. Without approval, it is not allowed to add or update car autonomous driving functions through online software upgrades or other means.

4、 Strengthen product management

（5） Strictly fulfill the obligation of disclosure. Enterprises producing automotive products with driving assistance and autonomous driving functions shall clearly disclose information such as vehicle functions and performance limitations, driver responsibilities, human-machine interaction device instructions, methods and conditions for activating and exiting functions.

（6） Strengthen the safety management of combined driving assistance products. Enterprises producing automotive products with combined driving assistance functions should adopt technical measures such as hand off detection to ensure that drivers are always performing corresponding dynamic driving tasks. The combined driving assistance function refers to the continuous execution of vehicle lateral and longitudinal motion control by the driving automation system under its designed operating conditions, and has corresponding target and event detection and response capabilities.

（7） Strengthen the safety management of autonomous driving function products. Enterprises producing automotive products with autonomous driving capabilities shall ensure that the automotive products meet at least the following requirements:

1. It shall be able to automatically identify the failure of the auto drive system and whether it continuously meets the design operating conditions, and take risk mitigation measures to achieve the minimum risk state.

2. It shall have human-computer interaction function to display the operation status of auto drive system. If the driver is required to perform dynamic driving tasks under specific conditions, it should have the ability to recognize the driver's ability to perform dynamic driving tasks. Vehicles should be able to interact with other road users through the reasonable use of light signals, sounds, and other means in accordance with laws and regulations.

3. It should have an event data recording system and an autonomous driving data recording system that meet relevant functional, performance, and safety requirements for accident reconstruction, responsibility determination, and cause analysis. Among them, the data recorded by the automatic driving data recording system shall include the basic information of vehicle and system, vehicle status and dynamic information, auto drive system operation information, driving environment information, driver and passenger operation and status information, fault information, etc.

4. It should meet the requirements of process assurance such as functional safety, expected functional safety, and network security, as well as testing requirements such as simulation, enclosed spaces, actual roads, network security, software upgrades, and data recording, to avoid foreseeable and preventable safety accidents that may occur within the designed operating conditions of the vehicle.

（8） Ensure reliable spatiotemporal information services. Enterprises should ensure that their automotive products have safe and reliable satellite positioning and timing functions, which can effectively provide information such as location, speed, and time, and should meet relevant requirements. Encourage and support the acceptance of signals from the Beidou satellite navigation system.

5、 Guarantee measures

（9） Establish a self inspection mechanism. Enterprises should strengthen self-examination. If serious problems such as data security, network security, online upgrade security, driving assistance, and autonomous driving safety are found in the production and sales of automotive products, they should immediately stop the production and sales of related products in accordance with laws and regulations, take measures for rectification, and promptly report to the Ministry of Industry and Information Technology and the local industrial and information technology and telecommunications regulatory authorities.

（10） Strengthen supervision and implementation. The Ministry of Industry and Information Technology guides relevant institutions to carry out technical reviews for the admission of intelligent connected vehicle production enterprises and products. The competent departments of industry, information technology, and telecommunications in various regions should cooperate with relevant departments to supervise and inspect the implementation of this opinion in accordance with the relevant requirements of the "Management Measures for the Access of Road Motor Vehicle Production Enterprises and Products".

（11） Consolidate basic abilities. The Ministry of Industry and Information Technology, together with relevant departments and enterprises in various regions, will further improve the construction of the standard system for intelligent connected vehicles, accelerate the revision of standards and specifications for automotive data security, network security, online upgrades, driving assistance, autonomous driving, etc. Encourage third-party service providers and enterprises to strengthen their testing, verification, and inspection capabilities, and continuously improve the technology, network security, and data security levels related to intelligent connected vehicles.

Ministry of Industry and Information Technology

July 30, 2021