Cybersecurity. Smart cars and invisible surveillance. What will Europe do?

Smart cars? The first association is most likely Tesla. The American brand is an unquestionably European marketplace leader. However, competition for her position comes from the east – Chinese vehicles, which increasingly appear on our streets. Can they besides pose a real threat to their users and even to countries? What do “smartphones on wheels” know about us?

When Tesla loses its shares in Europe, sales of Chinese brands are increasing dynamically. The reason is simply a large choice and a better offer for a akin price. However, during the increasing unrest in the world, the emergence of especially east intelligent cars (ICV – Intelligent & Connected Vehicles) in our marketplace creates uncertainty, especially among politicians.

Concerns about ICV, which can be encountered most often, include mass surveillance of the public, information diversion or sabotage, for example, of car software. These are the reasons why OSH published Paulina Uznańska's study in December 2025.Smartphones on wheels. Smart cars from China and Europe's cybersecurityIt’s okay. ” This is the first Polish study describing Chinese regulations and hazard assessment of intelligent cars. This information can be a valuable starting point for future regulations in European countries.

Week of civilian Affairs

Since 2020 we have been discovering uncomfortable truths and announcing stories that have the power to change Poland.

Donate and become our contributor

Intelligent cars for China's technological future?

The People's Republic of China is simply a state which has 1 of the most developed and developed systems of regulation and control of intelligent cars. But where is your interest in “smartphones on wheels” coming from?

The automotive manufacture in China is considered a strategical pillar of the state's technological future.

Authorities have been investing in intelligent vehicles since 2015, moreover, in the flagship concept "Made in China 2025" they have been recognised as an crucial part of industrial modernisation. This plan, in short, was intended to comprehensively modernise Chinese manufacture and economy. The increase in marketplace share of this sector was besides 1 of the assumptions of the late completed 14th 5 Year Plan of the PRC for the period 2020-2025. The fresh 15th five-year plan of March 2026 assumes the key function of the Artificial Intelligence+ programme, which suggests that ICV will besides be part of it.

→ Data is currency. Are they spying on you, too? •Berenika Serwatka

Research initiatives linking the civilian and military sectors are not amazing given the ongoing 4th technological revolution. For China, it is no different – intelligent cars are besides part of the construction of the military power of the state. According to the report's author, it's Xi Jinping's policy to make the world's most advanced army.

In this context, it is crucial for China to connect an intelligent vehicle to GNSS, a global satellite navigation system. Cars are automatically connected to the Chinese navigation strategy BeiDou, more specifically to its 3rd generation – BeiDou-3, which has global coverage. However, this strategy is not only a precise navigation strategy for drivers, but besides a key component in possible military operations.

The ICV are so not only to build technological potential, but besides to support the integration of the civilian manufacture sector into military and the improvement of the BeaDou satellite navigation strategy itself.

What is the Chinese threat assessment for cybersecurity?

The wide usage and promotion of intelligent car technology of producers outside the country has been explicitly recognised by the Chinese government as a threat to state security. State papers pay peculiar attention to increased vulnerability to cyber attacks (such as a disruption of driving that exposes the driver to road accident or even total, distant acquisition of control of the car) and vulnerability to intelligence analysis, due to the immense amount of delicate data collected from the environment. This information, in the incorrect hands, could pose a threat to national security. In addition, there is simply a hazard of State secrets being leaked – which the PRC considers high-precision geospatial data to be, for example, images of the actual location of the car.

→ Overseen society – the West will pursuit China away? •Anna Turner, David Lyon, Katarzyna Szymielewicz

→ Who's watching you? •Rafał Górski

The foundation for strict control of intelligent cars in China is 2 laws: Cybersecurity (2017) and Data safety (2021). Among the many obligations which they impose on vehicle manufacturers are:

• storing key data only in China (making it available abroad requires state approval);
• categorisation of collected data by importance and carrying out assessments and reports on cyber attacks risk.

Smart cars are equipped with a number of transmission channels that increase their susceptibility to possible cyber attacks.

Therefore, the maker must implement a cybersecurity strategy which includes monitoring possible risks, recognition and hazard assessment and consequence procedures. However, the Chinese state authorities feel that the ICV is specified a breakthrough technology that they require constant reflection and continuous updating of the regulatory framework, as well as strengthening the supervision of the management of this automotive sector. Therefore, these regulations are supplemented by a strategy of tests and certificates.

What data do “smartphones on wheels” collect?

ICVs are equipped with AI technology, motion sensors or already mentioned global navigation satellite systems (GNSS). They observe, registry and analyse not only the planet around the vehicle, but besides the interior with the driver. Among individual data collected by them are as trivial information as the weather, but much more is delicate to the user.

Their possible leak could seriously undermine the safety and comfort of the driver, including information: recognition (ID, driving license), biometrics (e.g. fingerprints, voice pattern or palm), individual property information (e.g. bank account number or payment history), individual communication and contacts or online activity.

On the another hand, delicate data collected by ICV are critical for national security.

These include both the dimensions of the vehicle, method data and weather conditions, as well as high-weight information specified as logistics flows, external recordings containing facial photos and car registrations.

→ Chinese public evaluation system. Orwell and Huxley in practice •Alicja Bachulska, Rafał Górski

In China, as mentioned earlier, all of these data must be stored in the country and their possible transfer abroad requires a safety assessment and approval from the National Cyberspace Administration.

What does the study say about the possible offensive operation of the PRC?

As the study argues, China utilizing intelligent cars can take offensive action in the future. However, these are not fears without coverage.

Indeed, Article 7 of the National Intelligence Act of the PRC gives the anticipation to require Chinese car producers to supply the government with data collected abroad. This makes it possible that data collected in Europe can be utilized for intelligence purposes, e.g. to track people, to decision goods and to survey patterns of movement. It would besides be possible to train artificial intelligence for military purposes. According to media reports in the past, China had already utilized vehicles for spy purposes erstwhile in 2023 in cars belonging to the British government the name detected Chinese tracking devices.

The issue of possible offensive is peculiarly crucial for the east flank of NATO due to the deepening relation between China and Russia.

The study indicates the hazard of transmission to the Russian Federation of data collected by Chinese intelligent cars driving on European roads. However, it inactive needs to be borne in head that, regardless of the country of the manufacturer, all intelligent cars are susceptible to cyber attacks and usage for intelligence or diversion.

What rules apply to ICVs in the EU?

The European Union aims to guarantee that the car manufacture has a defined, predictable and safe framework. As you can see in the current regulations, not only those EU, but besides the individual countries – Poland besides – do not yet be comprehensive rules that would let 100% assurance in intelligent cars, especially those Chinese ones. This is primarily about cyclical, independent and documented assessments of vehicle safety verification and data protection that they collect.

What sharpens does the study mention? This is, for example, the introduction of 17-35% of customs duties (+10 EU Common Tariff) for electrical cars from China. These duties are anti-subsidy in order to aid level the playing field between European producers and Chinese sellers. The European Commission is besides conducting an assessment of the cybersecurity risks of these vehicles within the framework of NIS-2 Directive, to keep the level of safety in sectors applicable to the functioning of the associate States and the EU itself. It will be the basis for further action and recommendations to its members.

NIS-2 is peculiarly crucial in the context of the ICV to safeguard networks and information systems. It qualifies operators of intelligent transport systems as a critical sector, including hazard management, cybersecurity responsibility, operational preparedness and cooperation.

Date Act Regulation identify vehicles as 1 of the key categories of goods to be transported, i.e. those which acquire, evidence and process data on their usage and the environment itself. It introduces rules on access to these data, including restrictions on making them available to government administrations of 3rd countries. Article 32 prohibits the transmission or making available of specified data to abroad authorities where this is contrary to Union or associate State law.

In addition, manufacturers of smart cars entering the EU marketplace are required to comply with the requirements for the construction of vehicles and organisational cybersecurity measures specified as the monitoring of risks and incidents after the introduction of the car for sale or to have plans in the event of a hacker attack.

There are besides another regulations which were not created with the ICV in head and yet control them.

An example is the EU GDPR Act, which besides includes individual data collected by intelligent cars. Another specified paper is the AI Act, which sets out the first legal framework for artificial intelligence – a decisive step towards safer usage of this technology.

Welcome to internships, internships and volunteering!

Join us!

Polish government on ICV

Poland does not have comprehensive rules on intelligent vehicles. However, this does not mean that their improvement is not taken into account and that cybersecurity is not implemented.

An example of this is the ban on the usage of Chinese cars in protected military facilities, which was introduced by the General Staff in February 2026. It does not only concern vehicles from the east, but besides vehicles that are not ‘intelligent’ but are equipped with integral or additional devices that evidence position, image and sound.

A government amendment of the Act on Traffic Law of 1997 from June 2025 is besides of interest. It makes it possible to test autonomous cars that usage automatic driving and control systems on public roads. The amendment concerns only research, and not only completely autonomous vehicles are included in it, but besides those equipped with advanced support systems, specified as a lane assistant or active tempo. Its aim is to adapt Polish law to the dynamic improvement of automotive in the issue of modern technologies, and the vehicle investigating permits themselves will be issued for no more than a year. The first tests could be starting this year.

The future of ICV on our roads – what are the conclusions for Europe?

Comparing EU government with Chinese legislation, there is simply a request in Europe to make a smart car standards system.

A closer regulatory framework becomes a necessity due to the gradual growth of Chinese vehicles on the EU market.

Europe is 1 of the most attractive markets for them, and their imports as well as local production will increase importantly in the coming years. The attractiveness of the marketplace is confirmed by the fact that 7-35.3% plus 10% of the Common Customs Tariff on Chinese electrical vehicles are comparatively low compared to trade policy against another countries specified as the USA and Canada, where customs rates are 100%.

The study warns that the later the EU changes and tightens the ICV regulation, the greater consumer opposition to fresh standards, which will besides increase the political cost.

The EU rules imposing a safety certificate on car manufacturers, especially from 3rd countries, could be an optimal solution.

As a result, not only would Europe's security, but besides technology, as the deployment of smart cars in Europe would increase.

The study besides proposes to make a coalition of countries ready to implement solutions to enhance safety and control of ICV, accompanied by a single set of regulatory standards at EU level, e.g. in the form of a package of solutions suggested by the European Commission. This would increase safety and technological resilience and make the European Union marketplace more uniform, without any differences in laws between countries.

Echo report

Paulina Uznańska's work was considered a serious informing about cyber threats associated with intelligent cars.

As indicated by the Ministry of Digital Affairs in consequence to raised media questions, the amendment of the National Cybersecurity strategy Act introduced from 3 April 2026 is intended to defend against possible threats.

The government stresses that it is aware of the problem, and the possible intelligence risks associated with Chinese products have been discussed in the context of electrical public transport purchased by cities and the equipment that supplies various state services. The study was besides most likely 1 of the factors, if not the only 1 that influenced the decisions of the MON on the designation of protected military premises. The cybersecurity of intelligent cars is simply a developmental and besides burning issue, and regulation will grow in the close future and analyses specified as this study play an crucial function in shaping future legal standards.