UNECE R155 and R156

UNECE R155 and R156 are two UN vehicle regulations that make cybersecurity and software updates a condition of vehicle type approval. Both were adopted under the 1958 Agreement by the UNECE World Forum for Harmonization of Vehicle Regulations (WP.29) and entered into force in January 2021. UN Regulation No. 155 requires the manufacturer to hold a certificate for its cyber security management system (CSMS) and to show, for each vehicle type, that cyber risks were assessed and mitigated. UN Regulation No. 156 does the same for a software update management system (SUMS), including updates delivered over the air.

UN Regulations bind only where a contracting party applies them. The EU made both mandatory through its General Safety Regulation, Regulation (EU) 2019/2144: from 6 July 2022 for new vehicle types and from 7 July 2024 for all new vehicles.

That turns cybersecurity into approval evidence. The CSMS covers the manufacturer's processes across the vehicle lifecycle, including how it manages dependencies on suppliers, so makers of control units and software are drawn into the manufacturer's evidence, a form of third-party risk. Under R156, the software versions on each approved type are tracked with a regulation-specific software identification number (RXSWIN), so an update that touches a type-approved system has to be assessed before it ships.

Both regulations are amended through WP.29 sessions. The EU sets its voting position in Council decisions and publishes the adopted texts in the Official Journal, which makes them a standing item for regulatory horizon scanning in automotive and mobility. Interpretation documents and national type-approval practice can move the obligation as much as the regulation text does.

This entry is general information, not legal advice.