Committee publication · Correspondence · 3 June 2026
Letter from the Secretary of State for Transport relating to connected buses, dated 22 May 2026
From: Transport Committee
Summary
The Secretary of State for Transport updates the Transport Committee on connected buses and cybersecurity risks associated with Yutong buses. She confirms that Yutong manufactures approximately 2% of England's buses (600 of 30,000), asserts the risk is managed based on assessments by the Vehicle Certification Agency and Confederation of Passenger Transport, and outlines UK government cybersecurity safeguards including newly incorporated UNECE regulations on vehicle software updates.
Key findings
- Yutong manufactures approximately 600 buses in England, representing about 2 per cent of the ~30,000 buses operating in the country
- The UK's Vehicle Certification Agency has assessed that Yutong buses in the UK have software update protocols compliant with government cybersecurity expectations and the NCSC Software Security Code of Practice
- Software updates for these buses are not undertaken remotely but implemented in workshop/garage environments to ensure safety and security
- The government recently incorporated two UNECE Regulations (UNR 155 and UNR 156) into domestic law requiring manufacturers to strengthen cyber protections, manage software updates, and establish incident monitoring procedures
- The Confederation of Passenger Transport has advised there is no cause for passenger concern and vehicles continue to operate safely
Tone
FactualTopics
Key actors
Heidi Alexander MP, Ruth Cadbury MP, Vehicle Certification Agency, Confederation of Passengers Transport, Yutong, NCSC
Notable line
“Officials assess that these buses in the UK have software update protocols which are in line with HMG's security expectations on From the Secretary …”
Key Quotes
“Of those 5,000 electric buses, just over 600 are manufactured by Yutong – representing about 2 per cent of buses operating in England.”
“Based on those dialogues and assessments from the Vehicle Certification Agency (the UK's vehicle type approval authority) …”
“This requires that such updates are not undertaken remotely and are implemented safely and securely in a workshop/garage environment.”
“Recently we incorporated two UNECE Regulations (UNR 155 and UNR 156) into domestic law on vehicle approvals to further strengthen our robust toolkit.”
Source · parliament.uk record ↗