UN R155 Supplement 3 (00 series) · UNECE Regulation No. 155 (ECE R155) — Uniform provisions concerning the approval of vehicles with regards to cyber security and cyber security management system.
UN R155 — Supplement 3 to the 00 series of amendments
Supplement 2 → 3
- What changed
- The Regulation now applies to vehicles of Categories L, M, N and O, if fitted with at least one electronic control unit.
- Former paragraph 1.2. on Categories L6 and L7 with automated driving functionalities from level 3 onwards is deleted.
- In paragraphs 7.3.1. and 7.3.4., the date for type approvals first issued before 1 July 2024 is now 1 July 2029 for Category L.
- Why
- In earlier sessions of GRVA and its informal working group, no technical argument was put forward to exclude Category L vehicles from the scope.
- Category L manufacturers need an adequate lead time, as was granted to Categories M and N in the original Regulation. This is for vehicle types whose development phase started before the manufacturer’s Cyber Security Management System was implemented.
Q1What changed6 changes
Vehicle categories covered (para. 1.1.) and deleted para. 1.2.
The Regulation now applies to vehicles of Categories L, M, N and O, if fitted with at least one electronic control unit. Before this supplement, paragraph 1.1. named Categories M and N, and Category O if fitted with at least one electronic control unit. Former paragraph 1.2. applied the Regulation to Categories L6 and L7 if equipped with automated driving functionalities from level 3 onwards. This supplement deletes that paragraph.
Paragraphs 1.3. and 1.4. renumbered as 1.2. and 1.3.
Former paragraphs 1.3. and 1.4. are now paragraphs 1.2. and 1.3. Their text does not change.
Category L type approvals first issued before 1 July 2029 (paras. 7.3.1. and 7.3.4.)
Paragraphs 7.3.1. and 7.3.4. now refer to type approvals of vehicles of Categories M, N and O first issued before 1 July 2024. They also refer to type approvals of vehicles of Category L first issued before 1 July 2029, and to each extension thereof. Before this supplement, the two paragraphs referred to type approvals first issued before 1 July 2024 and named no vehicle category.
Q2Why it changed
- Proposed by
- Experts from France, Italy, the United Kingdom of Great Britain and Northern Ireland, and the International Motorcycle Manufacturers' Association
- Working party
- GRVA, 18th session (January 2024)
Reasons
The purpose of UN Regulation No. 155 is to offer an international framework for the type approval of road vehicles with regard to cyber security. For this reason, GRVA should strive to offer the broadest scope possible to its Contracting Parties.
Sources (2)
“The purpose of UN Regulation No. 155 is to offer an international framework for the type approval of road vehicles with regard to cyber security.”
“Therefore, GRVA should strive to offer the broadest scope possible to its Contracting Parties, and to allow manufacturers of vehicles of any relevant category to apply for a type approval.”
In earlier sessions of GRVA and its informal working group, no technical argument was put forward to exclude Category L vehicles from the scope. Not including this category forces Contracting Parties and regional organisations to use national or regional laws on cyber security for this category.
Sources (2)
“During the previous sessions of GRVA and of its informal working group on cyber security and software updates, no technical argument was put forward to justify the exclusion of vehicles of Category L”
“Not including this category thus forces Contracting Parties and regional organisations to use national or regional laws on cyber security for this category of vehicles.”
This could lead to unique requirements and a level of divergence that could be onerous on the industry.
Source
“This could lead to unique requirements and a level of divergence that could be onerous on the industry.”
Category L manufacturers need an adequate lead time, as was granted to Categories M and N in the original Regulation (paragraphs 7.3.1. and 7.3.4.). The lead time is for vehicle types whose development phase started before the implementation of the manufacturer's Cyber Security Management System.
Sources (2)
“Similarly to what was granted to Categories M and N in the original version of the Regulation (paragraphs 7.3.1. and 7.3.4.), an adequate lead time is necessary for manufacturers of vehicles of the category introduced in this proposal”
“for the approval of vehicle types whose development phase started prior to the implementation of the manufacturer’s Cyber Security Management System.”
Category L vehicles that were already in the scope are included in this lead time. The aim is to simplify the drafting and remove the reference to levels of automation.
Source
“Category L vehicles that were already in scope of the Regulation have been included in this lead time to simplify the drafting and remove reference to levels of automation.”
Document trail
- 2023-11ProposalECE/TRANS/WP.29/GRVA/2024/4Proposal to extend the scope to all vehicles of Category L
- —Working party adoptsECE/TRANS/WP.29/GRVA/18Session report, para. 53
- 2024-04Sent to WP.29ECE/TRANS/WP.29/2024/55Text that GRVA sent to WP.29 and AC.1
- 2024-06WP.29 adoptsECE/TRANS/WP.29/1179Adopted at the 193rd session (session report, para. 162)
- 2025-01-10In forceC.N.63.2025.TREATIES-XI.B.16.155UN depositary notification
Q3Who is affected
Vehicle manufacturer
- Check which of your Category L vehicle types are fitted with at least one electronic control unit.
- For Category L type approvals first issued before 1 July 2029, and their extensions, check the CSMS and mitigation provisions.
- Update documents that cite former paragraphs 1.3. or 1.4. to the new numbers 1.2. and 1.3.
Component supplier
- For Category L vehicles fitted with at least one electronic control unit, expect manufacturers to identify and manage supplier-related risks.
Technical service / Approval authority
- Be ready to assess Category L vehicle types fitted with at least one electronic control unit under this Regulation.
- For Category L approvals first issued before 1 July 2029, be ready for technical feasibility assessments of Annex 5 mitigations.
See every change side by side
RegVault customers compare every version of UN regulations, read the consolidated text and download the PDF.
ⓘ This report gives advice only. It is not legal or type-approval advice.