On 17 November 2023 the Ministry of Industry and Information Technology, the Ministry of Public Security, the Ministry of Housing and Urban-Rural Development and the Ministry of Transport jointly issued a notice launching pilots for market access and road operation of intelligent connected vehicles (MIIT Lian Tong Zhuang [2023] No. 217).
Until then, intelligent connected vehicles were mainly at the road-testing and demonstration stage. The pilot’s significance is that it places three questions in one approval process: whether a product may be sold, whether a vehicle may operate on the road, and who is responsible after an accident.
What the pilot addresses
The notice requires pilot enterprises to pass product access testing and safety assessment and obtain the relevant qualifications before vehicles may operate in pilot areas. Compared with a testing permit, the access pilot is closer to a formal pre-production review.
The pilot covers not only vehicle performance but also manufacturer capability, safety mechanisms, data recording, cybersecurity and software update management. The object of review is a product plus a system, not a single technical indicator.
Focus of product access review
First, safety assessment: functional safety, safety of the intended functionality, cybersecurity and data security. Companies must explain system boundaries, failure modes, redundancy and risk mitigation.
Second, data recording: vehicle operation data, automated-driving system status and takeover records must be recorded and retained for accident reconstruction. Scope, format and retention period are frequent review questions.
Third, cybersecurity: remote update (OTA) security, vehicle-network communication security, key management and vulnerability response. Software-defined vehicles extend security obligations across the lifecycle.
Fourth, the road-operation plan: pilot area, operating scenarios, speed limits, remote monitoring and emergency response must be specified.
Practical impact
For vehicle manufacturers, the pilot requires an access documentation package in advance: technical description, safety assessment report, test and validation records, cybersecurity plan, data-recording specification and user notice. The package is not filed once; it must be updated during the pilot.
For component and software suppliers, the impact arrives through contracts. Manufacturers will write safety requirements, data interfaces, vulnerability notification and update cooperation into procurement agreements. Suppliers unable to provide safety evidence may be excluded at the nomination stage.
For operating platforms, liability boundaries matter more. The pilot involves safety officers, remote monitoring and incident response. Platforms must define when they intervene, how they keep records and how liability is shared with manufacturers.
Five preparations
First, define the pilot combination: vehicle, scenario, area and operator, avoiding frequent changes during application.
Second, build a safety case that addresses functional safety, intended functionality, cybersecurity and data security in one framework rather than separate, inconsistent volumes.
Third, design data recording: which fields, where stored, who may access, how long retained and how to support investigations.
Fourth, improve OTA management: pre-update validation, rollback during update and post-update notification should have procedures and records.
Fifth, allocate liability clearly in operating agreements, procurement contracts and user terms across product defects, system failure, improper operation and external attack.
For product access and licensing, see our business licensing service; for vehicle data and personal information, see data compliance; for cybersecurity and OTA management, see cybersecurity compliance.
This article is based on the Notice on Pilots for Market Access and Road Operation of Intelligent Connected Vehicles issued by four ministries on 17 November 2023. It is for reference only and does not constitute legal advice.