How the system works
A connected car can have cellular access, Bluetooth, Wi-Fi, onboard diagnostics, cameras and many safety-critical electronic controllers. These are interrelated but not one simple computer. UN Regulation 155 provides cybersecurity management requirements for covered type approval categories; Regulation 156 addresses software update management. The UK Vehicle Certification Agency explains their manufacturer process and audit dimensions. A compliant management process is not a promise that every individual connected vehicle can never be compromised.
What it can and cannot do
The security challenge spans suppliers, software builds, maintenance, external interfaces and the operating life of the car. NHTSA's 2022 voluntary cybersecurity guidance recommends a risk-based approach across the lifecycle of vehicle electronics. Good practices may include secure development, access control, vulnerability handling and authorized update paths. The presence of an encrypted connection or a gateway is only one part of the design and does not establish the absence of vulnerabilities.
What changes between vehicles
Owners can protect accounts by using unique credentials, enabling additional authentication where supported and checking which devices remain paired. On buying a used car, remove the previous owner's account access through the manufacturer's prescribed process, review privacy settings and install official software updates when appropriate. Unknown diagnostic dongles, unauthorized firmware and poorly documented aftermarket telematics can create additional uncertainty. Do not disable legally required emergency features in the name of privacy.
Buying and ownership implications
Some vehicles have frequent remote updates; others rely on workshop programming. Neither alone proves superior security. Ask how long the manufacturer maintains the model's software and cloud services, whether its connected service is supported in the destination region and whether outstanding campaigns appear on the vehicle's service history. A second-hand car can be physically sound yet unable to activate remote app functions when its account or modem is region-locked.
Regional and model-year caveats
Regulatory scope, implementation dates and cybersecurity testing vary globally. Do not copy European R155/R156 requirements onto an unrelated North American, Japanese, Indian or Chinese car without a relevant approval basis. This article describes responsible risk management and owner checks; it intentionally omits instructions for bypassing immobilizers, injecting network commands or compromising vehicle modules.