SDV Insider - September 11, 2026
Welcome back to SDV Insider.
Two weeks ago we closed with two things to watch: whether Honda and Nissan would sign their shared vehicle OS agreement before August ran out, and whether connected-vehicle makers had built the reporting pipeline the EU Cyber Resilience Act would start testing on September 11. Both questions got answered inside this window. Honda and Nissan signed on August 31, one day inside their own deadline. And the CRA’s incident reporting obligations go live today, the day this issue publishes.
The pattern across this fortnight is consolidation under deadline pressure. Two Japanese rivals who could not agree on a merger agreed on a shared software foundation instead, because neither can afford to build main ECUs, zone ECUs, an operating system and middleware alone. Beijing converted a drafted plan into published national targets with dates attached. And in Europe, the regulatory machinery stopped being a future obligation: from today, a manufacturer that learns of an actively exploited vulnerability in any connected product on the EU market has 24 hours to say so.
The signal this week: the SDV era’s shared foundations and hard deadlines arrived in the same fortnight, and the companies that treated compliance and software infrastructure as the same investment are the ones not scrambling this morning.
🚀 Top Story
Honda and Nissan Sign the Joint Agreement to Standardize Core ECUs and the Vehicle OS
Nissan and Honda concluded a joint development agreement on August 31 to standardize multiple core ECUs for next-generation software-defined vehicles, along with the in-vehicle operating system, key parts of the middleware, and the vehicle control software that runs on them. The agreement covers the two computing tiers that define a modern E/E architecture: the high-performance main ECU, a central computer built around a system-on-chip, and the zone ECUs that oversee specific areas of the vehicle. The jointly developed architecture is planned for both companies’ next-generation SDVs from fiscal year 2029 onward.
This is the deal the failed merger could not deliver. The two companies walked away from holding-company talks in February 2025, then spent eighteen months studying where collaboration would actually pay. The answer they landed on is the least glamorous and most expensive layer of the SDV stack: the non-differentiating foundations where duplicated investment produces identical results twice. It is the same conclusion the European industry reached with Eclipse S-CORE, reached instead through a bilateral pact between two companies that combined still ship roughly seven million vehicles a year. If Mitsubishi, already in the broader partnership orbit, joins the architecture later, a meaningful share of Japanese output would sit on one software foundation.
Our Take: Standardizing the main ECU, zone ECUs, OS and middleware means standardizing everything those layers must do across a fifteen-year vehicle life: update orchestration, diagnostics, logging, security patching, and the evidence trail regulators increasingly demand. That work starts now, not in fiscal 2029, because common specifications for ECUs are also common specifications for how software gets onto them and how its behavior gets proven afterward. Watch two things. First, whose update and data infrastructure the shared architecture assumes, because a two-OEM standard is a procurement event for every supplier in the connectivity layer. Second, whether the partners publish anything about the software lifecycle model, since a shared OS with two separate update regimes would recreate the fragmentation the deal exists to eliminate. The industry keeps converging on the same lesson from different directions: the differentiating software is worth building alone, and everything underneath it is worth building once.
⚙️ Industry Pulse
The EU’s 24-Hour Cyber Reporting Clock Starts Today
As of today, September 11, manufacturers of any product with digital elements sold in the EU must report actively exploited vulnerabilities and severe security incidents through the CRA’s Single Reporting Platform: an early warning within 24 hours of becoming aware, a fuller notification within 72 hours, and a final report within 14 days of a fix for exploited vulnerabilities or a month for severe incidents. The obligation covers products already on the market, not just new ones, and it arrives more than a year before the rest of the CRA applies in December 2027. Penalties for reporting failures reach 15 million euros or 2.5 percent of global turnover. For connected-vehicle makers and their suppliers, this is the first hard operational test of whether the telemetry, triage and disclosure pipeline exists, because from this morning, knowing about an exploited vulnerability and sitting on it is a regulatory event.
China Publishes Its Five-Year Plan for Intelligent Connected Vehicles, With Targets Attached
MIIT and eight other ministries published the 15th Five-Year Plan for the intelligent connected NEV industry, dated September 9 and covering 2026 to 2030. The drafted plan our Week 35 issue flagged is now policy with numbers: NEVs are targeted to reach 70 percent of new passenger-car sales and 40 percent of commercial-vehicle sales by 2030, vehicles with autonomous driving capabilities are to be deployed at scale, and key cities and national highways get digital upgrades for vehicle-road-cloud integration. The plan also formalizes the discipline side: stricter capacity controls, tighter conditions for new NEV manufacturers, and state-encouraged consolidation. Read together with the market-entry validation crackdown and the autonomous-mode liability draft from late August, China now has a complete policy stack running from how vehicle software enters the market to who answers when it fails.
London Gets Its First Robotaxis as Wayve Launches on Uber
Uber and Wayve launched London’s first self-driving taxi service on September 3, beating Waymo and Baidu to market in the city with a fleet of 15 Ford Mustang Mach-Es running Wayve’s AI Driver. Riders hailing UberX, Comfort or Electric can be matched with one at standard fares, anywhere in London except the airports, and each vehicle still carries a TfL-licensed safety driver, with no timeline offered for removing them. Two weeks after Waymo picked Munich, Europe’s second-largest robotaxi market just opened with a homegrown champion whose backers include Microsoft, NVIDIA, Uber and three global OEMs. The continental pattern is now set: supervised launches first, evidence accumulation second, and driverless permits whenever the regulators are satisfied, which in London’s case is not this year.
Tesla Publishes a 100-Million-Kilometer Safety Case Ahead of the EU’s October 6 Vote
Tesla released its most detailed European FSD Supervised safety dataset yet, covering more than 100 million kilometers driven by over 70,000 customers across the five countries where the system is approved, and claiming vehicles on FSD were involved in 4.1 times fewer collisions than manually driven Teslas with Active Safety features on. Reuters independently verified the collision counts behind the headline ratio. The timing is the point: the EU’s Technical Committee on Motor Vehicles votes October 6 on extending the Dutch-issued approval to all 27 member states, which requires 15 states representing 65 percent of the EU population. Whatever the vote produces, the mechanism deserves attention: market access for advanced vehicle software in Europe is being decided on manufacturer-produced operational data, which makes the fleet’s data pipeline part of the product’s regulatory strategy.
📅 Upcoming Events
IAA Transportation, Hannover, September 15-20
The commercial vehicle industry’s main stage opens Monday, and this edition is shaping up as a software show: Bosch is presenting a software-defined truck portfolio spanning centralized architectures and automation sensing, and ZF is showcasing its own software-defined commercial vehicle technologies. Commercial fleets remain the segment where connected-vehicle economics are most measurable, so watch what the Tier 1s promise fleet operators about update and diagnostics infrastructure.
👋 That’s a Wrap
This week’s signal:
- Honda and Nissan signed the agreement to standardize main ECUs, zone ECUs, the vehicle OS and middleware for both companies’ SDVs from fiscal 2029, resolving the watch item from our last issue one day inside their own deadline.
- The EU Cyber Resilience Act’s incident reporting obligations went live today, putting every maker of connected products on a 24-hour clock for actively exploited vulnerabilities, including products already on the market.
- China published its five-year plan for intelligent connected NEVs with hard 2030 targets: 70 percent NEV share of passenger sales and autonomous vehicles deployed at scale, completing a policy stack that runs from market entry to liability.
- Wayve and Uber opened London’s robotaxi era with 15 supervised vehicles, giving Europe two live proving grounds in two weeks.
- Tesla staked its EU-wide FSD approval bid on a 100-million-kilometer operational dataset ahead of the October 6 vote, a preview of how software market access will be argued everywhere: with fleet data.
One date to circle: October 6, when the EU’s Technical Committee on Motor Vehicles votes on extending Tesla’s FSD Supervised approval bloc-wide. However it goes, it will be the first continent-scale ruling on advanced vehicle software argued from operational evidence, and every OEM software organization should read the outcome as a template.
- The SDV Insider Crew 🚗💨