SDV Insider - August 28, 2026
Welcome back to SDV Insider.
A lot happened this week, and it all tells one story from three directions. The robotaxi race arrived in Germany, on the home turf of the companies that invented the automobile. A German sports car maker concluded that industrializing AI across its operations is a job for an outside partner, not a wholly owned subsidiary. And the world’s largest vehicle software market started writing rules that treat under-validated software as a market-access problem, not a quality footnote.
The common thread is accountability. Waymo enters Munich carrying 350 million autonomous miles of evidence because German regulators will ask for it. Beijing is proposing that the automaker, not the driver, answers for what a fully autonomous vehicle does at an intersection. And the first documented head-unit malware campaign worked precisely because an update pipeline shipped without integrity controls. The vehicle software conversation keeps converging on the same question: when the software acts, who can prove what happened and who answers for it?
The signal this week: the software-defined vehicle race went fully global in one fortnight, and every new entrant, rule and exploit raises the bar on the same capability, which is proving what your vehicle software did and controlling what it does next.
🚀 Top Story
Waymo Picks Munich for Its First EU Market and Puts a 2027 Date on It
Waymo announced on August 25 that its vehicles will appear on Munich streets in the coming weeks, driven manually at first to build high-definition maps and validate the Waymo Driver against local conditions, with commercial ride-hailing targeted for the end of 2027. Munich becomes Waymo’s third international city after London and Tokyo, and Germany becomes its first EU country. The company has registered a German subsidiary, says it will invest in local fleet operations, and is working through approvals with the Federal Motor Transport Authority alongside Bavarian and municipal officials.
The choice of venue is the story. Germany was the first EU country to create a legal framework specifically for Level 4 driverless operation on public roads, and that framework is now doing exactly what it was built to do: attracting deployments. Waymo does not yet hold the KBA permit it needs, but the queue at that office is getting crowded. Mobileye and Volkswagen already hold German AV testing permits, Momenta secured a Germany-wide Level 4 test approval in late July, and Uber plans to put Momenta-powered robotaxis on Munich streets this year under a partnership announced last September. Munich, home of BMW and a short drive from Audi and Mercedes-Benz territory, is about to host a live comparison between American, Chinese and domestic autonomy stacks.
Our Take: The framing to resist is Waymo versus the German OEMs, because that is not the competition that matters this decade. What matters is that a Level 4 fleet is the most demanding connected-vehicle operation that exists. Every vehicle in it must be mapped, monitored, remotely diagnosed, updated on a validated schedule, and able to produce an evidence trail a regulator will accept, in a jurisdiction with the strictest type-approval culture in the world. That is not an autonomy stack problem; that is a vehicle software operations problem, and it is the same problem every OEM faces at lower intensity as R155, R156 and the EU software regulatory stack tighten. Watch what the KBA asks Waymo to prove. Whatever evidence bar gets set for driverless operation in Germany will drift downhill into expectations for every connected fleet operating there. The companies that instrumented for evidence, not just capability, will find that bar familiar. Everyone else will find it expensive.
⚙️ Industry Pulse
Beijing Moves to Bar Under-Tested Vehicle Software From the Market
MIIT Vice Minister Xin Guobin said Wednesday that China will tighten market-entry reviews and testing and validation requirements for innovative vehicle designs, and will bar products that have not been adequately validated, citing aggressive designs installed in vehicles before proper testing and public attention on autonomous-driving safety incidents. He also confirmed the ministry has drafted the Fifteenth Five-Year Plan for the intelligent connected NEV industry covering 2026 to 2030, spanning product quality, industry governance and international cooperation, with continued pilots for market entry, road testing and vehicle-road-cloud integration. The market that shipped vehicle software fastest is now formalizing the gate on how it ships.
China Proposes That Automakers Answer for Violations in Fully Autonomous Mode
A draft provision published this week would make automakers responsible for handling traffic violations committed while a vehicle operates in fully autonomous mode. It lands on top of GB 44721-2026, the mandatory L3 and L4 safety standard taking effect July 1, 2027, which requires autonomous systems to be at least as safe as a competent, attentive driver and requires L3 systems to monitor whether the driver can actually take over. China granted its first L3 market-access approvals in December 2025. Liability following the software up the stack is the strongest possible incentive for OEMs to know, with evidence, exactly which software version was driving.
First Documented Head-Unit Malware Rode the Car’s Own Update Channel
Kaspersky researchers documented the first malware campaign with an infection chain built specifically for automotive head units. The attackers abused TWCore, the legitimate updater inside Android-based head units running firmware from Chinese supplier DoFun, which claims more than 30 million vehicle owners. A message broker instructed the updater to install a three-stage downloader that turned infotainment systems into ad-fraud and proxy-botnet nodes, attributed with high confidence to a group tied to the BADBOX botnet. DoFun says the issue is fixed after disclosure, and there is no indication the malware reached CAN or safety-critical systems. The lesson is uncomfortable anyway: the update pipeline is the attack surface, and an updater without signing, allow-listing and integrity verification is a distribution network waiting for a customer.
The Question Nobody Has Answered: How Long Does a Software-Defined Car Last?
CNBC put a spotlight on the unresolved lifecycle question hanging over the SDV transition: what happens to vehicles built on proprietary software platforms as they age out of OEM support? Servicing them requires specialized tools, skills and access to vehicle data that the independent aftermarket largely does not have, and nobody has a settled model for maintaining a fifteen-year-old vehicle whose core functions depend on a platform its maker may have moved past. For an industry selling vehicles on the promise of continuous improvement, the end-of-life story is the least developed chapter, and it is a regulatory invitation waiting to be accepted.
💼 Company Moves & Partnerships
Porsche Sells MHP to TCS and Signs a Five-Year AI Partnership
Porsche and Tata Consultancy Services announced a five-year strategic partnership on August 24 under which TCS will stand up a dedicated AI Mobility Centre of Excellence for Porsche, targeting AI deployment across manufacturing, engineering, operations and customer experience. As part of the deal, TCS will acquire 100 percent of MHP, Porsche’s Ludwigsburg-based management and IT consulting subsidiary with roughly 4,500 employees, at an enterprise value reported around 320 million euros, with MHP keeping its brand and operating independently inside the Tata group pending regulatory approvals. Porsche frames the divestiture as core-business focus under its Sportwagenschmiede 35 strategy. Read it the other way as well: a premium German OEM just concluded that industrializing AI at scale is something you buy from a global services firm rather than build inside the family. Expect other European OEMs facing the same software cost curves to study this structure closely.
Schaeffler and CATL Team Up on Battery Management Systems for European OEMs
Schaeffler and CATL signed an agreement on August 20 to jointly develop battery management systems tailored to European OEM requirements, plus X-in-1 Integrated PowerBox solutions that consolidate high-voltage electronics and electromechanical systems into single units. The collaboration builds on an already-secured customer project that neither company will name. Schaeffler brings BMS hardware and software, system integration, functional safety and European series production; CATL brings cell technology, battery system design and high-volume industrialization, and has flagged cloud computing and AI in battery management as areas the partners will explore. A BMS is one of the most software-intensive and safety-relevant ECUs in an EV, and this pairing puts a Chinese cell giant’s algorithms inside a German Tier 1’s functional-safety wrapper, aimed squarely at European programs. The supply chain localization story and the software story are becoming the same story.
📊 Market & Reports
One in Four New Cars in Europe Is Now Battery Electric
BEV registrations across 16 major European markets rose 13.6 percent year on year to 224,266 vehicles in July, a 25.7 percent share of new registrations, per data from E-Mobility Europe, New AutoMotive and Fier Automotive reported by Reuters. Nearly 1.5 million BEVs have been registered across Europe this year, up roughly 30 percent on 2025. France hit a 35 percent share with 44,378 registrations, Germany reached 29.3 percent with 78,609, Denmark leads at 80.1 percent, and Italy fell to 5.9 percent from 10.1 percent after incentives expired. For this audience the number underneath the number is the installed base: essentially every one of those vehicles ships with a connected, updatable software platform and a battery whose warranty economics depend on software. Europe is adding a million-plus vehicles a year to the population that OEM software organizations must monitor, update and support for the next decade and a half, whether or not the incentive schemes that sold them survive.
👋 That’s a Wrap
This week’s signal:
Waymo committed to commercial robotaxi service in Munich by the end of 2027, making Germany its first EU market and putting American, Chinese and domestic autonomy stacks on the same streets.
Beijing moved to bar inadequately validated vehicle software from market entry and proposed that automakers, not drivers, answer for violations in fully autonomous mode.
Researchers documented the first malware campaign purpose-built for car head units, delivered through the vehicle’s own update channel, which is the strongest argument yet that update-pipeline integrity is safety infrastructure.
Porsche handed its AI industrialization to TCS and sold MHP in the process, a structure other European OEMs under software cost pressure will study.
Schaeffler and CATL are pairing Chinese battery algorithms with German functional-safety engineering for European OEM programs, while one in four new European cars is now a connected battery-electric software platform.
Two things to watch. Honda and Nissan were targeting the end of August for the formal agreement on their shared vehicle OS built on Nissan’s technology; as of this writing nothing has been signed, and the month runs out Monday. And the EU Cyber Resilience Act’s incident reporting obligations arrive September 11, the first hard test of whether connected-vehicle makers built the reporting pipeline and not just the update pipeline.
- The SDV Insider Crew 🚗💨