
Could your next electric vehicle be remotely shut down – from another country?
Norwegian researchers from Lion Cage spent two and a half years monitoring what a Chinese-built electric car actually sends over the internet. They found that 90% of the data went to servers in China; 70% was encrypted with a protocol they couldn’t even identify; one bus manufacturer had the technical ability to remotely disable the vehicle from anywhere in the world.
And if electric vehicles are already constantly ‘talking’ to servers outside our borders, that question becomes even more pressing once we’re talking about autonomous transport – where it’s not a person making decisions on the street, but a system.
This is where Hamburg shows what a thoughtful approach looks like. As part of the ALIKE project, the HOLON urban shuttle is already running test drives on city streets: 15 passenger seats, fully electric, with an automatic ramp and a secured wheelchair space – one of the first vehicles in the world built to automotive standards.
So where does that leave Europe today? Where’s the technology already working, where’s the regulation still catching up, and where do the open questions about security and trust remain?
That’s what our new article digs into.
A van is driving through Hamburg and the vehicle system is fully performing the driving task. It stops at traffic lights, gives way to cyclists, and pulls up at the kerb – all on its own.
This is not a description of a demo video. Since July 2026, residents of Hamburg have been booking rides in autonomous vehicles with a safety driver on board through an app – the first autonomous ride pooling service to carry passengers in Hamburg’s normal city traffic.
So, does that mean Europe is ready for self-driving vehicles? Not quite. One city is not the same as a continent prepared for autonomous transport. Europe has 27 different sets of national rules, thousands of towns with wildly different road standards, and a public that is still deciding whether it trusts a vehicle without a driver. There is also a security question that most people have not heard about yet – and it is arguably the most urgent one of all.
Here is where things stand.
Not all self-driving is the same. The industry uses a scale from 0 to 5, and knowing roughly where the levels sit makes the rest of this much easier to follow.

Image Credit: www.ptolemus.com
Most cars on European roads today are at Level 2. The car can steer and control its speed, but you must keep your hands near the wheel and your eyes on the road. Level 3 means the car takes over completely in certain situations – motorway driving, for example – and you can genuinely stop paying attention.
Level 4 is where things get interesting. The vehicle drives itself entirely within a defined area and with the help of a technical supervision in the background, with no safety driver needed. This is what the Hamburg project is working towards. Level 5 – a vehicle that drives itself anywhere, in any conditions – does not exist yet outside laboratories.
So, when someone says “self-driving cars are already here”, they usually mean Level 4 in a controlled area. That is a real achievement. It is also a long way from a car that drives you anywhere you want to go.

Image Credit: www.pexels.com
The EU has built the legal foundation. Its General Safety Regulation (EU 2019/2144) created the first EU-wide type-approval system for fully driverless vehicles, with requirements taking effect for new vehicle types in July 2022 and applying to all new vehicle registrations from July 2024. The European Commission has also set technical rules covering safety testing, cybersecurity, and data recording.
But there is a significant catch. A manufacturer can only get approval for the production of a limited number of vehicles of one type per year – 1,500 across the whole EU. That is fine for pilot projects. It is nowhere near enough for a commercial fleet.
The Commission originally promised to lift that limit by July 2024. It missed that deadline, then missed a follow-up target in 2025. The first real movement came in March 2026, when new legislation introduced dedicated technical and validation requirements for one narrow use case, automated valet parking, where a car parks itself inside a car park, and opened the path to full type approval. Everything else, including driverless shuttles like the ones in Hamburg, is still capped.
In June 2026, the UNECE adopted the world’s first global technical regulation for Automated Driving Systems, creating the technical basis for full, large-series type approval of driverless vehicles. The blueprint now exists. What is missing is the European step: the EU must transpose it and update its own type-approval framework so that driverless shuttles can be approved and produced at scale.
Then there is the patchwork problem. Many countries still lack a comprehensive legislative framework covering both autonomous vehicle type approval and operations. For testing, almost every EU country has its own rules for self-driving vehicles – different permits, different safety driver requirements, different liability rules. The Draghi report on European competitiveness pointed out that traffic rules and vehicle standards diverge widely across the EU, and some member states have banned hands-free driving outright. Road signs are inconsistent, sometimes even between neighbouring municipalities.
For a company trying to launch a service in more than one country, that is a serious obstacle. A vehicle approved in Germany may not be allowed to operate in the country next door.

Image Credit: www.hochbahn.de
Germany has moved fastest. Its national law allows Level 4 vehicles to operate in defined areas since 2021. These may sound like legal details, but they are exactly what makes real projects possible.
The Hamburg service mentioned at the start is part of a project called ALIKE. It uses two vehicle types: One is Volkswagen’s autonomous ID. Buzz, operated by ride-pooling service MOIA. The other is the HOLON urban, built by HOLON, a company within the BENTELER Group. The HOLON urban is five metres long and fully electric; in its series version it will carry up to 15 passengers at up to 60 km/h. It has an automatic ramp, a secured wheelchair space, and audio and visual assistance for passengers who need it.
The HOLON vehicle arrived in Hamburg in August 2025 for first driving tests. In November 2025 it received a testing approval for its autonomous driving functions while a purpose-built depot for autonomous shuttles, the AD Hub operated by Hochbahn, was completed in Barmbek and taken into use at the start of 2026.
The ALIKE project brings together six partners: Hochbahn as consortium lead and local public transport operator, MOIA, HOLON, Volkswagen Commercial Vehicles, the Karlsruhe Institute of Technology and the Hamburg Authority for Transport and Mobility Transition, backed by EUR 26 million in federal funding.
The first passengers came in July 2026, in the ID. Buzz vehicles. Pre-registered Hamburg residents can now book a ride through an app. Passenger journeys in the larger HOLON urban are planned for 2027.
It is worth being clear about the scale. This is a pilot running in a 37 km² operating area reaching from the Stadtpark to the Elbe and from Schlump to Wandsbek, with a handful of vehicles and an invited group of users. The ambition is much bigger – the City of Hamburg is aiming for up to 10,000 autonomous vehicles by 2030 – but the gap between a supervised pilot and a city-wide service is still substantial.

Image Credit: www.pexels.com
Here is something that changes how you think about all of this.
A modern electric vehicle is not really a machine with a computer in it. It is a computer that happens to have wheels. It contains up to 300 individual processors, connects to the internet constantly, and receives software updates remotely from its manufacturer – the same way your phone does.
Which raises a question that has nothing to do with engineering: who is sending those updates, and what else can they do?
Norway is a useful place to look for the answer, because Norway is further down this road than anyone. In April 2025, 98% of new cars sold there were electric. Nearly a third were Chinese brands. Norway already has 660 Chinese electric buses in service, with 1 200 more ordered. By 2030, every bus in the country will be electric and roughly 80% will be Chinese made.
Image Credit: The Lion Cage Project
Tor Indstøy, who leads risk management and threat intelligence at telecoms group Telenor, and Arild Tjomsland from the University of Southeast Norway decided to find out what these vehicles were doing. Their work is called the Lion Cage Project.
They started with a car – a NIO ES8, a Chinese-built electric SUV that Indstøy owned and drove daily. Over two and a half years, a team of around ten specialists monitored everything the vehicle sent and received.
The car was talking constantly. Data flowed in and out at all hours, even when the vehicle appeared to be switched off. Around 70% of that data was heavily encrypted using a protocol the researchers could not identify. And 90% of it was being sent to servers in China. The car’s own privacy documentation confirmed that data went to company entities inside the People’s Republic of China.
Then they moved on to buses.

Image Credit: The Lion Cage Project
The bus tests were commissioned and published by Oslo’s public transport operator Ruter, which examined two electric buses side by side: one built by Dutch manufacturer VDL, one by Chinese manufacturer Yutong.
On the VDL bus, the critical systems – motor, battery, controls – were physically separated from anything connected to the internet. Even if someone gained access remotely, they could not touch the parts that make the bus move or stop.
On the Yutong, they were not. Critical functions were online, with direct digital access for software updates and diagnostics. In plain terms: the manufacturer had the technical ability to remotely disable the bus from anywhere in the world.
Ruter did not take the buses out of service. It announced stricter security requirements for future contracts, internal firewalls and the isolation of the vehicles from external cloud systems. Around 850 Yutong buses run in Norway, roughly 300 of them in Oslo. The story travelled fast – Denmark opened its own investigation, and the findings were briefed to Norway’s national security authority, police security service, defence research establishment, and transport ministry. Yutong stated that the SIM cards serve remote software updates and technical troubleshooting.
The researchers’ own conclusion was blunt: what manufacturers say about their own products cannot simply be taken at face value. It must be independently tested.

Image Credit: The Lion Cage Project
Here is the part that matters most for autonomous transport. Today’s buses can still, in some cases, keep their critical systems separate from their internet connection. That is only possible because the systems are relatively simple.
A self-driving vehicle cannot work that way. Its cameras have to talk to its steering. Its sensors have to talk to its brakes. Everything must be connected to everything else, and all of it has to be reachable for software updates. Physical isolation alone stops being an option, so the problem moves to redundancy, secure gateways and certified update paths.
As the Lion Cage researchers put it: an autonomous bus is essentially a drone.
That is a dimension of readiness the EU’s current rules do not really address. The regulations cover safety testing, technical performance, and type approval. They are far less clear on a different question: who controls the software running a vehicle full of passengers, and what happens if the country that company answers to has different interests than the country the bus is driving in?
Reuter’s new procurement rules are tightening the definition of what a bus is allowed to do – but defining the rules is the easy part. The harder question is verification: how do you actually confirm, after the fact, that a producer has honoured the limits it agreed to?
There is one more piece of the readiness puzzle, and it gets much less attention than the vehicles themselves.
A self-driving vehicle reads road signs, follows lane markings, and increasingly exchanges information with traffic lights and roadside sensors. A shuttle that handles Hamburg perfectly might struggle on a rural road where the lane markings have faded, the signs are non-standard, or the nearest weather station has been broken for a fortnight.
Three things matter here.
Consistent signs and markings. Self-driving systems are trained on standard road layouts. Faded lines and unusual local signage create exactly the situations they handle worst. This is why the EU’s push for harmonised road standards is not just bureaucracy.
Live road information. Ice, flooding, an accident round the next bend – an autonomous vehicle drives more safely if it knows about conditions before it reaches them. That requires sensors that work and keep working.
Vehicles talking to infrastructure. A traffic light that can tell an approaching vehicle when it will turn green makes for smoother, safer, more efficient driving. But only if that traffic light is connected, maintained, and speaking a standard language.

Image Credit: www.fitstraffic.com
This is the layer where Fits Traffic works. Developed by dots., with 20 years of experience in transport systems, the platform connects the roadside equipment that self-driving vehicles – and the authorities managing them – depend on.
Fits Hub brings traffic lights, variable message signs, weather stations, cameras, and traffic counters together into one system. Four things about that matter for autonomous transport.
It notices when equipment breaks. A weather station that has quietly stopped reporting creates a blind spot no self-driving system can fill. Fits Hub spots faults automatically and flags them for repair. In Latvia, where it monitors over 200 roadside sensors nationally, faster fault response was one of the documented benefits.
It turns existing cameras into data. Fits Vision uses computer vision to count and classify traffic from cameras that are already installed – no need to dig up roads to fit sensors. That data can feed the route planning that autonomous fleets rely on.
It works across borders. Fits Hub supports Datex II, the European standard for sharing traffic data between control centres. The SMART E67 project connected road infrastructure across Latvia and Estonia into a single platform – exactly the kind of cross-border co-ordination autonomous corridors will need.
It spots trouble early. Fits Vision detects stopped vehicles, building queues, and unusual movement automatically. On roads where self-driving and human-driven vehicles mix, catching problems early protects everyone.

Image Credit: www.pexels.com
Technology and regulation are only two thirds of the answer. The last third is whether people will actually get in.
Industry forecasts suggest more than half of new cars sold in the EU by 2030 will have advanced driver assistance, and a smaller share may be fully autonomous. But that only happens if people trust a system they cannot see and do not understand.
The Hamburg project is designed with this in mind. It is not only testing whether the vehicles work – it is testing whether people accept them. A small group of volunteers rides first, and their feedback shapes what happens next.
It is worth noting that acceptance varies a lot by context. A shared shuttle on a fixed route tends to make people far more comfortable than a driverless private car in city traffic. For cities struggling with driver shortages and rising costs, a reliable autonomous shuttle is an easier sell than most people expect.
Not yet. But closer than most people think.
The technology works in controlled conditions. The legal framework is being built, slowly and with gaps, but with real momentum. Germany has proved that clear national rules unlock real projects. Hamburg shows how transport operators, manufacturers, and city authorities can collaborate to bring autonomous mobility into public transport across Europe.
What is missing is less visible: roads with consistent markings, sensors that report reliably, traffic lights that can communicate, and management systems that catch faults before anyone notices. Plus, a serious answer to the security question Norway has forced into the open.
Europe will not be ready the day the first driverless shuttle opens its doors to passengers. It will be ready when the roads those shuttles travel on are as intelligent, as reliable, and as trustworthy as the vehicles themselves.
European Commission. (2024). Vehicle safety and automated/connected vehicles. https://single-market-economy.ec.europa.eu/sectors/automotive-industry/vehicle-safety-and-automatedconnected-vehicles_en
European Commission. (2025, March 5). Automotive Action Plan. COM(2025) 95 final. https://transport.ec.europa.eu/document/download/89b3143e-09b6-4ae6-a826-932b90ed0816_en
European Commission. (2026, March 3). Commission Implementing Regulation (EU) 2026/481 amending Implementing Regulation (EU) 2022/1426 on type-approval of automated driving systems. Official Journal, 4.3.2026. https://eur-lex.europa.eu/eli/reg_impl/2026/481/oj/eng
DIGITALEUROPE. (2025). Embracing the future of mobility: A strategy for autonomous driving in the EU. https://cdn.digitaleurope.org/uploads/2025/05/Embracing-the-future-of-mobility-DIGITALEUROPE.pdf
Taylor Wessing. (2026, February). Legal frameworks for autonomous driving and teledriving in the EU and Germany. https://www.taylorwessing.com/en/insights-and-events/insights/2026/02/legal-frameworks-for-autonomous-driving-and-teledriving
PAVE Europe. (2025). European Autonomous Vehicle Regulatory Landscape. https://pavecampaign.org/europe/activities/european-autonomous-vehicle-regulatory-landscape/
BENTELER / HOLON. (2025, August 19). HOLON urban arrives in Hamburg. https://www.benteler.com/en/press-media/latest-news/holon-urban-arrives-in-hamburg/
BENTELER / HOLON. (2025, November 13). Milestone for mobility: HOLON receives approval for autonomous testing on German roads. https://www.benteler.com/en/press-media/latest-news/milestone-for-mobility-holon-receives-approval-for-autonomous-testing-on-german-roads/
Sustainable Bus. (2026, July 17). MOIA starts autonomous passenger operations in Hamburg with self-driving ID. Buzz fleet. https://www.sustainable-bus.com/news/moia-autonomous-bus-service-hamburg-start/
Sustainable Bus. (2024, April 10). Holon – RMV cooperation in Germany. https://www.sustainable-bus.com/news/holon-rmv-autonomous-shuttle-cooperation-driverless/
Indstøy, T., & Tjomsland, A. (2025). Lion Cage: Investigating the security dilemmas of connected vehicles. The Lion Cage Project, Telenor Group and University of Southeast Norway.
Fits Traffic. Traffic and Infrastructure Management; Computer Vision Solutions. https://fitstraffic.com/en/
Note: HOLON information is drawn from official press releases and project communications, reviewed and confirmed with HOLON representatives. Lion Cage findings are based on the publicly released (TLP:CLEAR) presentation by Tor Indstøy and Arild Tjomsland, and have been confirmed with the Lion Cage team.