logo
stripes
logo
stripes

Frequently Asked Questions – GB/T 44495 & 44496

This page provides brief answers to common questions about GB/T 44495 (cybersecurity) and GB/T 44496 (software updates) for road vehicles in China. It is for awareness and orientation only — always consult the official standards and local authorities for definitive guidance.

They are national Chinese standards providing guidance for automotive cybersecurity management and software update management. GB/T 44495 aligns conceptually with ISO/SAE 21434 and UNECE R155, while GB/T 44496 corresponds to ISO 24089 and UNECE R156.
GB/T standards are generally recommended (voluntary) but are often referenced by ministries, regulators, and certification bodies during market access, production licensing, and post-market supervision . Many OEMs treat them as de facto requirements for compliance readiness.
GB/T 44495 and 44496 are harmonized with international approaches: ISO/SAE 21434 (engineering) and UNECE R155 (organizational compliance) for cybersecurity, plus ISO 24089 and UNECE R156 for software updates. Most organizations reuse their global CSMS/SUMS frameworks and add China-specific governance, translation, and documentation.
  • Localization: bilingual documentation (EN/中文) for key artifacts.
  • Data residency: local storage of records and telemetry, with defined cross-border rules.
  • Evidence traceability: CN-specific evidence index with stable IDs and versioning.
  • Authority communication: readiness to provide bilingual evidence packs during inspections.
Suppliers are expected to provide traceable evidence for cybersecurity, updates, and software provenance. OEMs must flow down requirements, perform assessments, and retain signed evidence packs (SBOMs, TARA excerpts, test reports, CAPA).

Authorities or partners usually expect:

  • Organizational policies and RACI for CSMS/SUMS.
  • TARA results and derived requirements with verification links.
  • Update campaign dossiers, signing/PKI policy, validation reports.
  • Supplier assessments, SBOMs, CAPA records, and traceability matrix.
  • Retention, residency, and privacy documentation for CN market.
No specific tools are mandated. However, organizations are expected to use controlled, auditable systems for TARA, requirements, verification, updates, and evidence management. Templates and checklists should reference GB/T clauses and include CN labeling for bilingual audits.
Typically, per major release or update campaign, and at least annually during management reviews. Updates should also follow incidents, supplier changes, or regulatory revisions.
While no global certification scheme currently exists, Chinese authorities or accredited test organizations may perform conformance assessments during type approval or supervision. Some third-party audits (e.g., ISO 21434 readiness) can demonstrate alignment.

Reuse your ISO/UNECE-based CSMS/SUMS framework, then add:

  • A localized policy and evidence index for China.
  • Bilingual documentation for key procedures and training.
  • Data residency and privacy mapping.
  • Cross-team governance connecting global HQ and CN operations.

Reuse your ISO/UNECE-based CSMS/SUMS framework, then add:

  • A localized policy and evidence index for China.
  • Bilingual documentation for key procedures and training.
  • Data residency and privacy mapping.
  • Cross-team governance connecting global HQ and CN operations.
Disclaimer: These answers are provided for general informational purposes. For authoritative requirements, consult the official GB/T 44495 and 44496 standards and accredited experts in China.