India’s security plan could create a new headache for iPhone and Android users

India(BHARAT) is talking about a set of 83 smartphone security rules that Reuters said would oblige big phone makers to update their software and, in certain cases, let government-approved labs look into the source code.

The ideas are part of the India(BHARAT)n Telecom Security Assurance Requirements framework and were written in 2023. India(BHARAT) has about 750 million phones. The news agency said that this is part of Prime Minister Narendra Modi's endeavor to make the country safer as online crime and data breaches proliferate.

Apple, Samsung, Google, and Xiaomi were among the corporations that were talking behind the scenes. The industry association MAIT was against certain important parts of a private document that Reuters saw.

India(BHARAT)'s government openly disagreed with the most shocking claim. The Press Information Bureau released a statement stressing that India(BHARAT) has not suggested any way to force smartphone makers to provide their source code.

The government has tried to downplay the most invasive parts, but documents reviewed by Reuters show that this isn't the case, and those in the sector aren't remaining quiet behind closed doors.

If these restrictions are implemented, they could have effects that extend well beyond New Delhi. Think about slower updates, greater compliance expenses, and more government oversight, even for your iPhone in New York.

India(BHARAT)’s proposed rules put Apple, Google, and Samsung in a compliance bind

India(BHARAT) is in discussions about ITSAR device rules that clearly say that source code approval is required.

There is a publicly available NCCS ITSAR consultation paper called "Feedback device ITSAR" that has a Level-3 requirement called "Review of device OS/source code."

The NCCS document says that "source code shall be made available" at either a Telecom Security Testing Laboratory or a place that both parties agree on "for source code review by the designated TSTL."

The same NCCS paper says that secure coding best practices must have been followed and lists well-known security frameworks like the OWASP Top 10 and CWE Top 25.

Related: Samsung’s profit blueprint resets Micron stock bets

A Telecom Engineering Centre ITSAR document for 5G user devices says the same thing: that source code "shall be made available" for a designated testing facility to look over.

The controversial standards would be tested in certain labs. Tech companies said that the guidelines don't have any global precedent and could expose private information.

India(BHARAT)'s IT ministry informed Reuters that talks were still going on. The ministry stated it often talks to businesses to learn about technical and regulatory issues.

The PIB press release claimed that the assertions that Reuters had summarized were not true and that the reports did not include any quotes from manufacturers or industry groups.

What is on the table:

• Giving the source code to government-approved labs for testing for weaknesses.
• One year of keeping security audit logs on the device.
• Phones must be scanned for malware on a regular basis.
• Notifications that persist even when you use the camera or microphone in the background.
• A requirement to let the government know before making big changes or security fixes.

Why American users could feel pain through slower or more complicated updates

MAIT stated that the government should not be required to provide notice and test patches in advance, as security fixes need to be disseminated promptly.

Google's Android Security Bulletin program links remedies to patch levels based on the date. The January 2026 bulletin indicates that devices with patch level 2026-01-05 or newer must have the right updates.

Related: A big Wall Street flip just changed the Regeneron narrative

Google also puts out a Pixel Update Bulletin. The January 2026 bulletin claims that Pixel devices with patch level 2026-01-05 or later fix all the problems in both the Pixel and Android bulletins.

Apple's security release literature states that Apple typically doesn't discuss security issues until patches or releases are widely available. Apple also keeps a current list of security releases.

India(BHARAT)'s plan would require companies to notify a government agency about critical updates and patches in advance. According to Reuters, the government center would also have the right to test them.

Giants in the tech industry told Reuters that India(BHARAT)'s package "lacks any global precedent."

Update pipeline information that are important to readers.

• Every month, Google sends out bulletins about Android security fixes that are linked to patch levels.
• The Google Pixel bulletin clearly says that the coverage for January 2026 is at the same patch level as Jan. 5.
• There is an official Apple Support page where Apple posts security updates and Rapid Security Responses.
• According to Reuters, India(BHARAT)'s plan would entail notification and perhaps testing before major updates and patches.

India(BHARAT)'s market is large enough to influence how vendors design global compliance strategies

India(BHARAT) is the second largest smartphone market in the world, with "nearly 750 million phones," and according to Counterpoint, Xiaomi has 19% of India(BHARAT)'s smartphone market, Samsung has 15%, and Apple has 5%. The ripple effect of any regulation in the market will be huge. India(BHARAT) has put in place or suggested tech standards that made businesses nervous in the past.

For instance, privacy concerns ultimately led to the cancellation of an order for state-run cyber safety software. India(BHARAT) also pushed through strict testing regulations for security cameras, even though the business lobbied against them because they were afraid of snooping.

When a market as big as India(BHARAT) requires certain security measures (such as authorization, logging, and scanning), enterprises may use the same settings all over the world to avoid having to keep up with numerous compliance systems.

None of this means that your next update for iOS or Android will be "late."

But it does create a significant operational risk: speed vs. compliance becomes a strategic choice.

Related: Bank of America makes bold call on bank stocks