A connected-vehicle, an automobile equipped with internet access, onboard sensors, and telematics systems that enable it to continuously share and receive data with cloud platforms, external devices, road infrastructure, or other vehicles, risk’s often becomes visible when a new platform reaches homologation, i.e., official regulatory approval, and an auditor asks for evidence that the manufacturer cannot produce. Production then pauses while technology, procurement and legal teams reconstruct a supply chain they never completely mapped. Regulatory audits rarely create commercial risk; they expose commercial assumptions that already existed. Manufacturing systems were built around physical quality, while connected platforms require continuous access to information over code, suppliers and updates.
The Ministry of Heavy Industries, together with CERT-In, has directed automobile manufacturers to conduct mandatory cybersecurity audits covering connected-vehicle software, telematics units, Battery Management Systems (BMS) and Firmware-Over-The-Air (FOTA) update channels.
This shift reflects a larger change in the product itself. A vehicle can now change after leaving the factory through firmware updates, telemetry connections and third-party software dependencies. Engineering teams may see a patching cycle, while an experienced lawyer sees an ongoing allocation of responsibility across the company. The commercial relationship with a supplier therefore continues throughout the vehicle’s operating life, rather than ending with component delivery.
When Code Becomes Balance-Sheet Risk
Procurement teams see profits when purchasing a connected component and often miss out on the fact that the purchase is thee beginning of a long software liability chain whose consequences may emerge years later. A INR15,000 unit may sit beneath a conventional price-based liability cap, yet vulnerable third-party code can produce a fleet-wide recall costing many crores. Suppliers may create the vulnerability, but the contract determines where the resulting liability ultimately settles.
The same pattern appears when an audit requests a complete Software Bill of Materials or threat assessment. A Tier-1 supplier may invoke trade secrecy, proprietary code or restrictions imposed by upstream vendors. The company sees an uncooperative supplier whereas the Counsel sees an OEM that never purchased sufficient access to information about its own platform. Software provenance is becoming as commercially significant as title to physical assets because both determine whether the product can be controlled, transferred and defended.
These information gaps increasingly reshape supplier negotiations. OEMs need information reaching beyond the Tier-1 relationship, while suppliers need legitimate protections for intellectual property embedded across multiple tiers. The more revealing question is not whether disclosure is commercially sensitive, but whether the supply chain can provide verifiable evidence without destroying that sensitivity. Cross-border manufacturing relationships increasingly depend on resolving this tension before platform integration reduces each party’s alternatives.
Investors interpret the same structure differently. During a capital raise, financing or joint venture review, diligence teams examine whether recall costs can travel towards the source of failure. Hardware certificates offer limited comfort when software exposure remains unquantified and trapped on the OEM’s balance sheet. Investors generally price uncertainty more aggressively than known risk, making incomplete information about suppliers a valuation issue rather than a technical footnote.
Where Commercial Options Disappear
The negotiation has often shifted long before an audit notice reaches the board. It moves when sourcing approves a hardware-style purchase order and accepts liability cap linked to unit price. Tooling, integration and supplier dependence then make broader software protections progressively more expensive to secure. The contract signed at sourcing therefore determines whether future regulatory exposure becomes a supplier negotiation or a capital loss for the OEM.
The commercial position changes again when milestone payments are released against physical delivery and functional testing alone. If SBOM and TARA materials arrive only at type approval, the supplier has already received much of the programme’s value. A later refusal can then halt homologation without producing an equivalent financial consequence upstream. An experienced lawyer sees payment milestones not merely as payment terms, but as the point where information rights become commercially enforceable.
Some difficulty remains irreducibly technical. Mapping open-source libraries across Tier-2 and Tier-3 suppliers requires reconciling forensic transparency with legitimate intellectual-property protections. Deploying a FOTA patch across constrained control units may corrupt firmware or disable vehicles. What this often conceals is a procurement question: supplier concentration, supplier lock-in and code access determine whether engineering has one solution or several.
The Record Behind the Platform
The record receives a second test when regulators, external counsel or transaction teams examine the platform. The company may present quality certificates, functional benchmarks and standard supplier assurances created for physical manufacturing. Evaluators look for traceable code origins, risk assessments, escalation histories and credible allocation of recall losses. Due diligence increasingly looks at how information is organised and maintained rather than documentation volume because reliable information supports approvals, valuation and negotiating confidence.
The weakness becomes most visible during a live telemetry incident. The OEM faces a six-hour CERT-In reporting window, while its supplier may operate under a 24-to-48-hour service commitment. Internal teams see a delayed technical response; the outside counsel sees an organisation whose internal information cannot move at regulatory speed. Boards are discovering that managing the platform means how quickly evidence, responsibility and decisions travel across functions and supplier boundaries.
Manufacturers responding well begin to integrate their commercial functions during the first 30 to 60 days of sourcing or audit preparation. Technology, information security, legal and procurement evaluate connected units as parts of one regulated platform. Disclosure materials become linked to payment, while software recalls are separated from ordinary physical-defect liability. The real exposure lies in allowing each function to optimise its own decision while leaving the combined company risk unowned.
Their contracts increasingly support the platform throughout its lifecycle. SBOM and TARA delivery create upstream visibility, targeted recall provisions allocate financial consequence, and two-hour supplier alerts preserve time within the CERT-In window. These terms also change market behaviour by distinguishing suppliers through transparency, responsiveness and risk capacity, rather than unit price alone. Contracting becomes part of the product, not an administrative step following technical selection.
Software-defined products are changing how industrial businesses allocate risk. Manufacturers increasingly compete through both engineering capability and the contracts supporting it. Businesses that treat software provenance, oversight and supplier accountability as core business processes are better positioned for investment, cross-border partnerships and long-term resilience. Competitive advantage is moving beyond what a company can manufacture towards how confidently its entire commercial ecosystem can understand, manage and support that product.
COMMERCIAL LAW BLOG 
Leave a comment