There has been a lot of noise after the recent AIS 189 updates from ARAI. Instead of adding to the confusion, I thought it would be more useful to step back and look at AIS 189 from a practical engineering and compliance perspective. For OEMs, Tier-1 suppliers, partners, and leadership teams, the real question is not whether AIS 189 creates more work. It does. The better question is: How much of this work can be built on top of an existing ISO/SAE 21434 cybersecurity engineering framework? That is the approach I have taken in this article. The intent is to break down AIS 189 in a way that helps organisations understand what can be reused, what needs to be updated, and what needs to be built specifically for the Indian type-approval context. If your organisation has already invested in ISO/SAE 21434, you are not starting from zero. But you do need to understand the regulatory delta clearly especially around CSMS certification, annual reporting, supplier dependencies, cryptographic justification, forensic logging, modification control, and evidence retention. I would be very interested in feedback from OEMs, Tier-1s, testing agencies, cybersecurity teams, and compliance leaders working through this transition. Have a look and share your thoughts. https://sumitchouhan.com/articles/iso-21434-ais-189 #AIS189 #ISO21434 #AutomotiveCybersecurity #CSMS #TARA #VehicleCybersecurity #ConnectedVehicles #TypeApproval #ARAI #IndiaAutomotive #CyberSecurity