Germany has pushed a consequential change to global vehicle cyber and update rules that matters to drivers, dealers and suppliers in both Germany and Austria. By proposing an amendment to UNECE Regulations R155 (cybersecurity) and R156 (software‑update management) Berlin aims to force a single, accountable approval route for the certificates that underpin over‑the‑air updates — a move that will speed audits but could slow type approvals if labs and technical services are not ready. This affects vehicle availability, aftermarket work and supplier contracts across DE and AT.

What changed at UNECE — and when

On 3 July 2026 Germany, jointly with France, Luxembourg, the Netherlands and the UK, filed GRVA/2026/30: a formal proposal to amend UN R155 and R156 so that type‑approval authorities must refuse a vehicle type approval if the Cybersecurity Management System (CSMS) or Software Update Management System (SUMS) certificate was not issued by the same authority that grants the vehicle approval. The measure was scheduled for discussion at GRVA session 26 (14–18 September 2026). The rationale in the submission is to eliminate fragmented, hard‑to‑enforce certification chains and to make a single authority accountable for end‑to‑end safety and security.

The regulatory calendar is already tight. UNECE R156’s staged obligations included a key milestone for trailers and certain vehicle types on 7 July 2026; manufacturers and second‑stage builders had to demonstrate SUMS evidence by that date. Industry suppliers warned that SUMS evidence and lifecycle traceability introduce new operational burdens.

How Germany and Austria are responding

In Germany the Kraftfahrt‑Bundesamt (KBA) is the designated type‑approval authority and has been central to national implementation of R155/R156; guidance and national procedures published through UNECE channels make KBA the key gateway for CSMS/SUMS evidence in Germany. At the same time the Federal Office for Information Security (BSI) has signalled deeper cooperation with KBA on automotive cyber matters, reflecting a shift from product spot‑checks to lifecycle oversight.

Industry and test bodies are reacting fast. ZF and other suppliers have launched SUMS suites and modular services to help trailer and component OEMs produce audit‑ready update evidence; ZF pointed to the 7 July 2026 milestone as a driver for its product push. Meanwhile testing and certification houses in Austria — notably TÜV Austria — have expanded training and SUMS/CSMS services, offering masterclasses and audit support aimed at Austrian suppliers and fleets preparing for stricter audits. That capacity build‑out matters for Austrian SMEs that supply regional OEMs or that act as second‑stage manufacturers.

What this means for the market

First, expect a short‑term bottleneck in type approvals and component acceptance where technical services or approval authorities are inconsistent: GRVA’s proposal would give approval authorities new grounds to refuse type approval when CSMS/SUMS certification chains are fragmented, increasing the premium on approved technical services.

Second, suppliers and trailer OEMs already feel the pressure to document update workflows, provenance and rollback processes — those that lack SUMS evidence face market exclusion or delayed registrations. ZF’s SUMS offering and the rise of new audit services mean suppliers can buy compliance support, but at extra cost.

Finally, for Germany and Austria the policy shift centralises responsibility — favouring national approval authorities such as KBA and accredited test houses — and turns certification capacity into a competitive asset. German regulators’ push and Austrian labs’ rapid upskilling will set who can certify, who can sell, and who can service modern vehicles across both markets.

WorldTrader24 B2B vehicle marketplace for dealers →

Sources: UNECE (GRVA/2026/30), ZF Friedrichshafen, Kraftfahrt‑Bundesamt (KBA), BSI, TÜV Austria