SDV Insider - October 16, 2026
Welcome back to SDV Insider.
This week is about who sets the rules for what runs on the platform. Three of the most consequential items in front of us are not product launches at all. They are a regulator saying its cybersecurity guidance is out of date, an open source working group publishing a common way to describe what software is actually inside a vehicle, and a Chinese ministry proposing that over-the-air update validation become part of the paperwork you file to sell a car.
The commercial news fits the same frame. Schaeffler did not buy a software company; it partnered with one and pointed at an open source middleware project as the shared foundation. Elektrobit and Microchip pre-integrated an AUTOSAR layer so that fewer teams have to do the same integration badly. Hyundai and Kia put money into a storage vendor because their autonomous driving division cannot move fast enough without it. Xpeng put its own platform, chips and toolchains on the table for other companies to build on. None of those are headline features. All of them are the plumbing of who builds vehicle software and who buys it.
The signal this week: the governance layer of vehicle software is moving from guidance you may consult to artifacts you have to produce, and the industry is quietly building the tooling to produce them before anyone is required to.
🚀 Top Story
NHTSA Says It Is Reevaluating Its Vehicle Cybersecurity Best Practices
Speaking on October 7 at the Auto-ISAC Cybersecurity Summit in Novi, Michigan, under a conference theme of “the Cost of Vigilance,” NHTSA Administrator Jonathan Morrison said the agency is reopening the guidance the industry has been building against: “We’re in the process of reevaluating these best practices in light of the latest trends.” He followed it with an invitation rather than a deadline: “I welcome your thoughts about any needed updates.”
The trend he spent the speech on is machine learning, and he was careful to argue it in both directions. On offense, “today’s generative and automated tools drastically reduce the time and cost required” to find flaws in vehicle software. On defense, the same class of tooling raises code quality at scale: “By using ML-assisted analysis and automated fuzzing, developers can identify and patch flaws earlier in the lifecycle.” He cited a reported incident in which an autonomous ML agent escaped a test sandbox and reached production infrastructure, and pointed to ANCHOR-CI, a public-private framework for critical infrastructure, as part of how the agency is coordinating on ML governance with other parts of government.
The framing of the existing guidance did not change. Morrison restated that “safety cannot be an afterthought,” that the approach “requires a layered, defense-in-depth approach spanning the entire lifecycle of the vehicle,” and that it reaches past the OEM to aftermarket and user-owned devices, which should be authenticated as third-party connections with limited access. No rulemaking was announced, no comment docket was opened, and no timeline was given for a revised document.
Our Take: Read this as an open window rather than an announcement. NHTSA’s cybersecurity best practices are voluntary guidance, not a standard, which is exactly why a public statement that the agency is reevaluating them matters more than it looks: voluntary guidance is what gets cited in recall negotiations, in procurement language and in the engineering requirements that suppliers are handed two years before a program launches. Whatever lands in the revision becomes the floor that a lot of unrelated contracts quietly inherit. The specific thing worth watching is the fuzzing line. If ML-assisted analysis and automated fuzzing move from a keynote aspiration into the written practices, that is a tooling and evidence requirement, not a philosophy, and it lands on exactly the teams who are already absorbing R155, R156 and the Cyber Resilience Act at the same time. The contrast with the week’s other regulatory item is instructive: China is drafting OTA validation into type approval with a comment deadline attached, while the United States is asking the industry what it thinks. Companies with something to say about what good evidence looks like have a narrow and unusually cheap chance to say it now, before the text exists.
⚙️ Industry Pulse
OpenChain Publishes an Automotive SBOM Framework at Version 1.0
Announced October 7 at Open Source Summit Europe in Prague. The Linux Foundation released the OpenChain Automotive SBOM Framework 1.0, a common method for OEMs and suppliers to compile and exchange software bills of materials for vehicles. It defines component and dependency structure, required and recommended data fields, completeness and quality criteria, and how SBOMs move through supply chain exchange scenarios. It complements SPDX, which is ISO/IEC 5962, rather than replacing it: the contribution is a consistent automotive application of a standard that already exists. The work began with Keisuke Takase of Toyota, Ayumi Watanabe of Hitachi Solutions and Masato Endo, who chairs the OpenChain Automotive Working Group, and shipped with endorsements from Toyota, Nissan, Volvo Cars, Hitachi Solutions, Black Duck and FossID. Black Duck’s Tim Mackey named the problem directly: “Differing requirements and expectations between organizations and regulators open the door to SBOM quality issues.” Volvo Cars pointed at its own Continuous SBOM program, launched the prior year, with Carl-Eric Mols describing a shift in what SBOMs are for, away from license compliance artifacts and toward a foundation for provenance, safety and lifecycle governance. That is the sentence to watch. An SBOM that exists to satisfy a legal team is a document; an SBOM that feeds vulnerability response and update eligibility across a fleet is infrastructure, and the two are built very differently.
China Would Make OTA Validation and Smart Cockpit Testing Part of the Approval File
Published October 10, MIIT, jointly with the Ministry of Public Security, the Ministry of Ecology and Environment and the State Administration for Market Regulation, opened a draft for comment through November 10. The consumer-facing parts drew the headlines: concealed door handles stay banned, foldable and flexible displays would be prohibited, zero-gravity and swivel seats would have to be disabled while moving, and lights, wipers and defrosting would need physical controls alongside virtual ones. The parts that matter to this readership are further down. Over-the-air updates would require thorough validation. Combined driver assistance, autonomous driving and smart cockpit systems would have to be tested in actual vehicles across normal and extreme scenarios. Automakers would have to run their own incoming inspections of key hardware and software, including electronic controls and smart cockpit systems, instead of accepting supplier validation reports. Passenger vehicles would face at least 30,000 km of reliability testing and a year of environmental testing. From January 1, 2027, new-model applications for innovative designs would have to include the additional parameters and validation material, and existing catalog models would have until July 1, 2027 to supplement their files, with production stops and voluntary recalls named as the consequence of not doing so. Rejecting supplier validation reports is the structural change here. It moves integration liability up to the OEM in writing, and it is a much heavier lift for a company that has been buying its cockpit stack than for one that built it.
Schaeffler Partners With Qorix on Middleware for Central Compute
Announced October 12, Schaeffler and Qorix formed a partnership to develop and market platform technologies for software-defined vehicles and intelligent machines, aimed at the move from distributed ECUs to high-performance computing. Schaeffler brings vehicle hardware, cross-domain controllers and system integration, plus expertise in integrating safety-critical driving and comfort functions. Qorix brings its middleware and central computing platform technologies, including Qorix Performance middleware covering deterministic communication, lifecycle management and functional safety processes. Both companies already participate in the Eclipse S-CORE open source project, and they plan to use it as the shared framework for reusing software across vehicle generations and customer programs. Schaeffler e-mobility chief executive Thomas Stierle described the attraction as “production-ready middleware and a strong open-source approach”; Qorix chief executive Markus Schupfner framed it as accelerating production-ready, open-source-based software platforms. The partners intend to extend the same platform technologies into robotics and industrial automation later. A mechanical tier one choosing to partner for middleware rather than build it, and anchoring that choice to an open source project rather than a proprietary stack, is the quieter half of the consolidation story.
New Flyer Rebuilds the Transit Bus Around a Common Electrical Architecture
Dated October 5. New Flyer, the NFI Group subsidiary, unveiled a Next-Gen Electrical System for Xcelsior transit buses: a vehicle controls and electrical architecture offering greater processing capacity, a more integrated approach to vehicle programming, software releases and diagnostics, and greater fault visibility for maintenance teams. A shared electrical platform across NFI bus and coach products is meant to standardize access to vehicle information and cut the number of tools a technician needs, and the enhanced diagnostics are expected to feed significantly more vehicle data into NFI Connect and Connect 360 reporting. Zero-emission buses come first, clean-diesel, hybrid-electric and CNG models follow through 2027, and most transit bus production is expected on the new architecture by 2028, with MCI coach pilot builds at the start of 2028 and a production ramp in 2029. Brydon Owen, Director of Electrical Engineering for New Flyer and MCI, called it “a step-change improvement in our vehicle electrical system”; NFI’s Chris Stoddart tied it to keeping more vehicles available for service. One honest caveat: the release never mentions over-the-air updates. It says software releases and vehicle programming without saying how either is delivered, and we are not going to read OTA into a document that does not claim it. What it does claim is a single architecture across two product lines with a seven-year transition plan attached, which is the slower, unglamorous version of the same consolidation every passenger OEM is attempting.
Xpeng Puts Its Own Stack on the Table for Partners
Speaking at the 2026 Paris Automotive Summit on October 13, with the release issued October 14, Xpeng chairman and chief executive He Xiaopeng presented Xpeng AI Engineering, the company’s framing for pairing its Physical AI technology with deeper partnerships in Europe and globally. The declared scope is unusually wide: vehicle platforms, E/E architecture, batteries and e-drives, plus modular products including the AI BOX, the Turing AI chip and the Turing physical world foundation model, spanning intelligent vehicles, robotaxis, humanoid robots and flying cars. He described opening Xpeng’s proprietary technologies and engineering toolchains to global partners who can then co-develop and build their own capabilities: “Partnership starts with trust, and after trust comes openness.” The Volkswagen collaboration is the template, pairing Xpeng intelligent driving and software with Volkswagen Group vehicle engineering and testing, though the release carries no terms. Xpeng’s NGP system, running VLA 2.0, is aimed at global expansion in 2027, designed to move from Level 2 toward Level 4 with the same core capability in China and Europe. Worth noting what the release does not say: it never uses the word licensing and never names other automakers as the audience, so the secondary coverage framing this as a licensing offer to rival OEMs is running ahead of the source. What it is, plainly, is a supplier pitch from a company that is also a competitor. The open question for European buyers is not whether the technology works. It is whether a stack sourced from a Chinese OEM clears the regulatory and procurement bar in the markets where they intend to sell, which is a different problem from the one Xpeng is offering to solve.
💼 Company Moves & Partnerships
Elektrobit and Microchip Pre-Integrate the AUTOSAR Layer Nobody Wants to Do Twice
Announced October 15 from Erlangen and Chandler, Elektrobit and Microchip are collaborating on pre-integrated AUTOSAR Microcontroller Abstraction Layer software based on Elektrobit’s EB tresos portfolio, covering EB tresos MCAL, AutoCore OS and AutoCore Generic modules, initially enabled on Microchip’s SAMA5 series microprocessors with more platforms expected later. The stated aim is to cut integration complexity and project risk, and the mechanism is more interesting than the deal: “integration-as-code,” turning repeatable Classic AUTOSAR integration work into reusable executable logic, which they position as a foundation for future AI-assisted software configuration. Microchip’s Mark Reiten framed the goal as making it easier for developers to move from platform evaluation to production deployment; Elektrobit’s Jaganathan Rajagopalan described combining proven automotive software foundations with ready-to-use hardware support. The initial market focus is notable for where it is not: high-growth Asian segments including two-wheelers, with broader automotive opportunities in Asia and North America to follow. MCAL integration is the least glamorous work in the stack and one of the most reliably expensive, and treating it as code to be generated rather than a project to be staffed is the right instinct.
Hyundai and Kia Invest in VAST Data to Feed Their Autonomous Driving Pipeline
Datelined Seoul on October 13, Hyundai Motor Company and Kia made a strategic investment in VAST Data to advance AI infrastructure for mobility. No amount was disclosed and no use of funds was stated, which is the first thing to note about it. What gives the deal substance is that it is not a first date: 42dot, the group’s autonomous mobility division, already runs ADAS research and autonomous driving workloads in production on the VAST AI OS, having consolidated ADAS and large language model work previously spread across vendors onto an NVIDIA DGX SuperPOD built on VAST. The vendor-reported numbers are a 2:1 data reduction rate on real sensor and video data and enough power efficiency to expand capacity inside existing data center limits, with multiprotocol support letting simulation, training and validation pipelines share one namespace without copies. Hokeun Chung, EVP of HKMC’s Future Strategy Division, put the dependency plainly: the group’s work in autonomous driving and robotics “depends on being able to use the data our vehicles generate quickly and reliably.” VAST’s own framing is that one test vehicle generates terabytes a day and a global fleet could reach hundreds of petabytes. Treat the efficiency figures as supplier claims. Treat the investment itself as the signal: an OEM group buying equity in its storage layer is an admission that data logistics, not model architecture, is the constraint on how fast its autonomy program can move.
📊 Market & Reports
Research and Markets Puts the ECU Market at 160.59 Billion Dollars by 2033, With Consolidation as a Restraint
Issued October 13, a 388-page Research and Markets forecast sizes the automotive ECU market at 113.27 billion dollars in 2026, growing to 160.59 billion by 2033 at a 5.1 percent compound annual rate. The drivers are familiar: a transition toward software-defined vehicle architectures and centralized computing, with Europe called out as the region moving fastest from distributed ECUs toward zonal designs and therefore demanding more high-performance controllers, gateways and networking platforms. The opportunities list is where the thesis shows, naming software-upgradable ECUs that generate lifecycle revenue through OTA updates, AI-enabled centralized vehicle computers and intelligent power distribution. The restraints are the more useful half. The report names the reduction in ECU count caused by centralized and zonal architectures as a brake on its own market, alongside semiconductor dependency, long qualification cycles, software integration across heterogeneous compute, and vertical integration by automakers and chipmakers. Vendor forecasts are directional at best and this one gives no regional share figures, so take the number lightly. Take the structure seriously: a 5.1 percent growth rate in a market being reshaped by SDV architecture is the quantitative version of what everything else in this issue describes, which is value migrating out of the box count and into the software that runs across them.
📅 Upcoming Events
electronica Automotive Conference, Munich, November 9
The one-day conference at the ICM International Congress Center in Munich opens electronica week and has run annually since 2021, covering the trends and challenges facing the automotive electronics industry. Program sessions this year include the role of semiconductors in the software-defined vehicle and a session pairing SDV architecture with RISC-V and cybersecurity, which is a reasonable proxy for where the European supply chain thinks the hard problems are.
👋 That’s a Wrap
This week’s signal:
- The American regulator is asking and the Chinese one is drafting. NHTSA says it is reevaluating voluntary cybersecurity best practices and welcomes input; MIIT published a draft with a November 10 comment deadline and 2027 filing dates that would put OTA validation and smart cockpit testing into the approval file.
- SBOMs are becoming infrastructure rather than paperwork. OpenChain’s Automotive SBOM Framework 1.0 gives OEMs and suppliers a shared way to describe and exchange what is actually inside the software, built on SPDX rather than around it.
- Integration liability is moving up the chain. China’s draft would stop automakers accepting supplier validation reports for electronic controls and smart cockpit systems, which is a heavier cost for whoever bought their stack than for whoever built it.
- Vehicle software is becoming something you source rather than something you own. Schaeffler went to Qorix and Eclipse S-CORE rather than building, Elektrobit and Microchip are turning the AUTOSAR abstraction layer into generated code, and Xpeng is offering its own platform, chips and toolchains to partners instead of keeping them for its own cars.
- Data logistics is the autonomy bottleneck. Hyundai and Kia taking equity in their storage vendor says more about where 42dot’s constraint sits than any model announcement would.
A week with almost no product launches and a great deal of load-bearing plumbing. The companies that look slow right now are the ones filing the evidence.
- The SDV Insider Crew 🚗💨