With a series of automotive cybersecurity laws and regulations formally taking effect, Korea has fully implemented mandatory automotive cybersecurity supervision from 14 August. The move makes Korea one of the few countries with systematic regulation of the cybersecurity of intelligent connected vehicles.

Core regulations

The framework now in force comprises six key documents:

- the Automobile Management Act (No. 20298), the basic law providing the legislative basis;

- the Enforcement Decree of the Automobile Management Act (No. 35703), setting specific implementation requirements;

- the Enforcement Rules of the Automobile Management Act (No. 1519), setting operating procedures;

- the Regulation on Performance and Safety Standards for Automobiles and Parts (No. 1520), establishing technical specifications;

- the Regulation on Certification and Inspection of Automobiles and Parts (Notice No. 2025-444), completing the certification system;

- the Regulation on Materials Submitted for Software Updates (Notice No. 2025-445), standardising OTA update processes.

The rules require all intelligent connected vehicles sold in Korea to meet strict cybersecurity standards, including a lifecycle cybersecurity protection system, vulnerability management, and secure encrypted data transmission and storage. Manufacturers must also submit a detailed security assessment report to the competent authority before a software update. The implementation reflects the Korean government's attention to security risks in the digital transformation of vehicles and provides an important practical reference for automotive cybersecurity regulation worldwide.