A vehicle no longer needs to visit a workshop to receive a fix or a new feature — it receives it over the air, wherever it happens to be parked. That capability doesn’t recognize borders, and neither does the engineering discipline built to govern it: ISO 24089, published in 2023.
Like ISO/SAE 21434 did for cybersecurity, ISO 24089 — “Road vehicles — Software update engineering” — turns a fast-moving technical capability into a structured process. And like that standard, it applies everywhere a connected vehicle is sold or supplied to, not to a single region.
From Recalls to Remote Engineering
For most of the industry’s history, a software problem in a vehicle was handled the same way as a mechanical one: a recall notice, a scheduled visit, a technician connecting a diagnostic tool at the dealership. That model assumed updates were rare, local, and supervised in person.
Over-the-air capability breaks all three assumptions at once. Updates can now be frequent instead of rare, remote instead of local, and unsupervised instead of technician-led. That is a much larger engineering responsibility than it sounds — a flawed update pushed to a fleet doesn’t affect one car in one workshop, it can affect thousands of vehicles simultaneously, across multiple countries, with no technician present to catch a problem before it reaches the driver. ISO 24089 exists because the old recall-based safety net doesn’t cover this new reality.
What ISO 24089 Actually Requires
ISO 24089 specifies requirements and recommendations for engineering software updates across two levels: the organization and the individual project.
At the organizational level, it expects a company to have defined policies, roles, and processes for software update engineering before any specific update is built. This includes assigning clear responsibility for update decisions, maintaining competence within the teams involved, and having a process for sharing update-relevant information across the organization and its partners.
At the project level, the standard covers the full path an update takes: planning what the update will do and which systems it touches, developing and verifying the update package, packaging and distributing it, and confirming successful installation on the vehicle — including what happens if an installation fails partway through. It also requires the ability to roll an update back or otherwise recover a vehicle safely if something goes wrong after deployment.
Underlying all of it is traceability: an organization must be able to show, for any vehicle at any point in its life, exactly which software versions are installed, when and how they got there, and what update history preceded the current state. The standard does not prescribe a specific technology or update mechanism for achieving any of this — it sets the engineering bar an organization must clear, leaving the implementation to each organization’s own capability.
Why This Is a Global Requirement, Not a Regional One
Three realities make ISO 24089 relevant across every market at once:
- Connectivity is arriving everywhere at the same time. Vehicles capable of receiving software updates over the air are being sold across every major automotive market, at a pace that no longer tracks a single region ahead of the rest.
- The requirement travels with the platform. A component or module built anywhere in a globally sourced vehicle program inherits the same update-engineering expectations as one built anywhere else on that program. The vehicle platform doesn’t recognize borders; neither does the standard it was engineered against.
- It is inseparable from cybersecurity. Every update channel is also a potential attack surface. ISO 24089 and ISO/SAE 21434 were designed to work together — a software update mechanism that isn’t engineered securely undermines the cybersecurity work built everywhere else in the vehicle.
For a Tier 1 or Tier 2 supplier anywhere in the world, the practical question is no longer “does my local market require this?” but “does my customer’s global program require this?” — and for any supplier touching connected vehicle systems, the answer is increasingly yes.
The Risk of Getting This Wrong
The cost of a weak software update process isn’t only technical. A failed or poorly managed update can strand vehicles, degrade safety-relevant functions, or open a security gap — any of which becomes a liability, reputational, and contractual problem well beyond the engineering team that built the update. For suppliers, the more immediate risk is commercial: global OEMs increasingly use conformance with standards like ISO 24089 as a qualifying criterion before a supplier is even invited to quote on a connected-vehicle program. Arriving at that conversation without a demonstrable process doesn’t just slow things down — it can remove a supplier from consideration before technical discussions begin.
How It Fits Alongside Other Standards
Organizations already working on cybersecurity engineering under ISO/SAE 21434 are best placed to absorb ISO 24089, because the disciplines overlap directly: both demand traceability, both demand evidence of risk management, and both are strongest when built as part of one coherent integrated management system rather than three separate compliance projects running in parallel. Treating update engineering, cybersecurity, and information security as one connected system — rather than three audits handled by three disconnected teams — is consistently what separates organizations that pass supplier assessments smoothly from those that struggle to reconcile conflicting documentation under pressure.
Who Should Be Paying Attention Now
ISO 24089 applies to any organization involved in engineering software updates for road vehicles — manufacturers, suppliers, and their subsidiaries or partners, regardless of where they operate. It is closely aligned with UN Regulation No. 156, which several major vehicle-approval markets already require for type approval, meaning the standard’s influence is spreading through supply chains even faster than formal adoption timelines suggest. An organization that waits for a local mandate before acting is, in effect, choosing to be the last one ready when a global customer asks the question.
The Bottom Line
Software updates stopped being an occasional workshop visit and became a continuous, remote engineering responsibility — and that responsibility now follows global vehicle platforms into every market they reach. Understanding what ISO 24089 requires, and how it connects to cybersecurity and information security work already underway, is what separates suppliers who are ready for the next RFQ from suppliers who are scrambling to catch up on it.
