The United Nations’ vehicle cybersecurity rules — UN R155 (cybersecurity management) and UN R156 (software‑update management) — are no longer academic: they are now prerequisites for EU type approval and for many national registrations, and they are reshaping engineering, testing and aftersales in Germany and Austria. That matters to drivers, dealers and suppliers because manufacturers must now prove organised, audited processes for secure software and updates before a new vehicle type can be placed on the market.
How the rules bite and when
The regulations were adopted under the UNECE WP.29 framework (R155/R156) and were folded into the EU type‑approval timetable: R155 requirements for new whole‑vehicle types began in July 2022 and extended to wider registrations in mid‑2024; R156 (software‑update management) follows a staged rollout, reaching many new complete vehicles in July 2026. In practice this means manufacturers and their supply chains must operate a certified Cybersecurity Management System (CSMS) and a Software Update Management System (SUMS) to secure type approval.
UNECE working documents now push a further change: several proposals require that the Certificate of Compliance for the CSMS or SUMS be issued by the same approval authority that grants the vehicle type approval — a move that narrows the previous flexibility to cross‑recognise certificates between different authorities. That change increases the coordination work for multistage manufacturers (bodies, trailers and conversions) and for suppliers whose components now have to be explicitly traceable into the type‑approval package.
Regulators and test houses are already translating rules into deadlines. TÜV SÜD and technical services told industry observers that trailer and auxiliary‑equipment makers needed to deliver update‑management evidence by July 2026 — a hard milestone for many small suppliers and coachbuilders. At the same time, CSMS certificates are limited in validity (audit cycles and renewal obligations mean certificates typically last up to three years), turning certification into an ongoing cycle rather than a one‑off box to tick.
What this means for the market
First, suppliers and software teams face extra cost and headcount: security engineering, secure‑by‑design evidence, supplier‑to‑OEM contractual flows and repeat audits are now part of the product bill. Second, test and certification capacity is commercially valuable — German and Austrian labs (and private test houses) are expanding R155/R156 test rigs and service offers to serve OEMs and Tier‑1s. Third, workshops and independent repairers must adapt: industry groups have already warned that ending update support prematurely (a VDA proposal to define an “End of Cybersecurity Support”) would leave vehicles vulnerable, triggering pushback from garage and mobility associations. The debate underlines a new equilibrium between manufacturers’ cost control and the responsibility to keep cars secure in service.
Finally, national authorities and homologation offices in Germany and Austria are tightening processes: proposals to link CSMS certificates tightly to the issuing approval authority will slow some approval pathways for conversions and multistage builds unless administrative procedures are harmonised quickly. That will favour larger OEMs and certified suppliers that already run process‑assurance systems and will pressure smaller specialists to use certified test houses.
For drivers and fleets the immediate effect is indirect but concrete: safer update channels and monitored cyber‑support should reduce high‑risk incidents that can cascade from cloud or telematics into physical vehicle functions — but they also make it more likely that older, unsupported types will be constrained in registration or resale if manufacturers stop issuing required evidence.
WorldTrader24 B2B-Fahrzeugmarkt: Händler-Angebote einsehen →
Sources: UNECE, Vehicle Certification Agency (VCA), TÜV SÜD, VDA, kfzgewerbe
