Twenty-four hours. That's the clock the EU has put on cyber incident disclosure, and it lands squarely on Indian automotive suppliers who feed European OEM programs.

The rule, flagged by Autocar Professional, sets a 24-hour notification window for affected entities once a cyber breach is detected. For Indian tier-1 and tier-2 suppliers exporting components, wiring harnesses, electronics and software services into EU-bound vehicle programs, the binding question isn't whether the rule applies to them. It's whether their internal escalation chains can move fast enough to meet it.

What does this change for India-based suppliers?

In practice, it compresses the timeline between detection and disclosure. Most large Indian suppliers already run some form of security operations monitoring. Fewer have rehearsed a disclosure drill that gets from plant-floor anomaly to legal notification to the relevant EU authority inside a single day.

Suppliers with EU subsidiaries or contractual data-processing relationships are the most exposed. OEM contracts increasingly push cyber-compliance obligations down the supply chain, so the 24-hour duty will likely arrive via procurement clauses before it arrives via regulators. Tier-2s with no direct EU presence may still inherit the deadline contractually from the tier-1s above them.

The exposure is real for a sector that has become a genuine export engine. Indian components makers supply electronics, forged parts and engineering services to European OEMs across multiple vehicle lines, and connected-vehicle content keeps rising. More software in the bill of materials means more attack surface, and more reasons for European customers to audit their Indian vendors.

Where the burden falls hardest

Three pressure points stand out:

• Detection speed. A 24-hour disclosure clock is only beatable if internal detection is measured in minutes, not days. Smaller tier-2 plants running lean IT teams are the weak link.
• Escalation governance. Someone must own the decision to notify — legal, IT security and plant management need a rehearsed handoff, not an ad-hoc conference call.
• Contractual pass-through. OEM-supplier agreements will be rewritten. Suppliers should expect audit rights, breach-notification clauses and possibly penalties tied to the EU window.

What to watch next

Watch how Indian supplier bodies and large tier-1s respond over the coming quarters — expect compliance frameworks, disclosure playbooks and possibly certification pushes aimed at smaller vendors. Watch too whether European OEMs start making demonstrated incident-response capability a precondition for new program awards. The suppliers that treat the 24-hour clock as an engineering requirement, not a legal footnote, will keep their EU business. The ones that discover it during a live breach won't.

Grace Kim