UNECE R155 compliance for vehicle programmes that clear type approval on evidence.

What it is

What are UNECE R155 and R156, and what are they used for?

UN Regulation No 155 and UN Regulation No 156 are vehicle regulations adopted under the UNECE 1958 Agreement, under which contracting parties recognise each other's type approvals. Both entered into force on 22 January 2021. R155 applies, with regard to cybersecurity, to passenger and goods vehicles of categories M and N, and to trailers of category O fitted with at least one electronic control unit. R156 applies to vehicles of categories M, N, O, R, S and T that permit software updates.

Each regulation works on two levels. The manufacturer first proves an organisational system, a cybersecurity management system (CSMS) under R155 or a software update management system (SUMS) under R156, and receives a Certificate of Compliance. The vehicle type is then approved against its own technical requirements. Annex 5 of R155 lists threats, from back-end servers to update procedures and physical access, with matching mitigations.

Current version. UN Regulations No 155 and No 156 in their original series, both in force since January 2021. Ask your approval authority which series and any supplements it applies to your application before you plan.

Who it is for

Who needs UNECE R155 compliance?

The legal duty sits with the vehicle manufacturer that applies for type approval. In practice it travels down the chain, because R155 requires the manufacturer to show how its CSMS manages dependencies with contracted suppliers, service providers and its own sub-organisations. Enquiries usually start from one of four places:

• A vehicle manufacturer writes the requirement into your contract. Suppliers are asked for risk analyses, vulnerability handling and update evidence for their parts.
• A new vehicle type is heading for approval in a regulated market. In the EU, type approval is refused to new vehicle types without cyberattack protection from 6 July 2022, and registration of non-compliant vehicles is prohibited from 7 July 2024.
• The approval authority or technical service raises findings. A CSMS certificate is valid for at most three years, and monitoring results must be reported at least once a year, so gaps surface between approvals too.
• A parent or sister company holds the certificate. Group entities that design or update vehicle systems join the parent's CSMS and SUMS.

Requirements

What are the main UNECE R155 requirements?

Paragraph 7 of R155 carries the specifications, and paragraph 7 of R156 does the same for software updates. The lines below stay at heading level; the authority assesses against the regulations themselves.

• R155, 7.2 Requirements for the CSMS: processes for managing cybersecurity internally, and for identifying, assessing, treating and verifying risks to vehicle types.
• R155, 7.2 continued: processes for testing vehicle cybersecurity, keeping risk assessments current, monitoring, detecting and responding to cyberattacks, and providing data to analyse attacks.
• R155, 7.3 Requirements for vehicle types: the critical elements identified, an exhaustive risk assessment, mitigations applied and testing before type approval.
• R155, 7.4 Reporting provisions: the outcome of monitoring reported to the approval authority or technical service at least once a year.
• R156, 7.1 Requirements for the SUMS: assessment of each update, recording and storage of update information, security of the update process and extra conditions for over-the-air updates.
• R156, 7.2 Requirements for the vehicle type: the RXSWIN identifier, software identification protected against unauthorised change, update authenticity and integrity, and safe execution of over-the-air updates.

Approval process

How do you achieve UNECE R155 compliance?

There is no voluntary certificate here. The approval authority appointed by a contracting party, with its technical service, assesses the system and then the vehicle type.

1. 01
   Fix the vehicle types, markets and your role.Confirm the types and markets in scope and whether you apply as manufacturer or contribute as supplier.
2. 02
   Gap analysis: test current processes against paragraph 7 of both regulations.We review your processes and one live vehicle programme, then agree actions, owners and dates.
3. 03
   Build the CSMS and SUMS and bring suppliers in.Processes, roles, risk methods, monitoring, incident response and update control, with supplier obligations in contracts.
4. 04
   Obtain the Certificates of Compliance.The approval authority or technical service assesses each system; findings are closed on evidence before the certificate is issued.
5. 05
   Approve the vehicle type and keep reporting.Risk assessment and testing per type, then annual monitoring reports and renewal before each certificate's three years run out.

Check the route before you sign. Only an approval authority appointed by a contracting party, or the technical service it designates, can issue a Certificate of Compliance or a type approval. Confirm with the authority which technical service it has designated for your application. A private "R155 certificate" approves nothing. The certification buyer's checklist

Cost

How much does UNECE R155 compliance cost?

Engineering drives the budget more than paperwork: risk assessment per vehicle type, security testing, the fixes it exposes and the monitoring behind annual reporting.

Timeline

How long does UNECE R155 compliance take?

The approval date usually sets the deadline, and the CSMS certificate must exist before the vehicle type can be approved. Pace depends on existing engineering practice, supplier readiness and the authority's calendar. As an estimate, most programmes take nine to fifteen months.

Your engagement

What your UNECE R155 engagement includes

Sterling OS™ runs every engagement, with each phase adapted to type approval. Sterling does not certify or approve: the approval authority and its technical service assess your systems and vehicle types and make every decision.

• Design™: guided support

  Your engineers and quality team build the CSMS and SUMS; a Sterling consultant sets the method, reviews each output and coaches owners.

• Drive™: managed support

  The alternative to Design™ when capacity is short: Sterling drafts processes, risk templates and supplier clauses with your owners and runs the programme to assessment.

• Sustain™: after approval

  Internal audits, monitoring reviews before each annual report, and preparation for renewal of both certificates.

• Automate™: Effivity

  Your management system records run in Effivity, included with the engagement at no additional cost.

• Training for your people

  Internal auditor training, as applicable to your standard, plus preferential Sterling Academy access with complimentary awareness training for your people as part of the engagement.

Approval decisions remain with the approval authority.

Often combined with

Standards organisations pair with UNECE R155 / R156

• ADHICS (Abu Dhabi)ADHICS compliance consulting for DoH-regulated healthcare entities in Abu Dhabi: patient information, systems and devices protected, with audit-ready evidence.
• AIAG core toolsAutomotive core tools implementation and training: APQP, Control Plan, PPAP, FMEA, MSA and SPC applied on your live parts.
• AQAP 2110AQAP 2110 compliance for defence suppliers: what the NATO contract requirement covers, AQAP 2105 quality plans, government quality assurance and an all-inclusive proposal.
• AS9100AS9100 certification consulting for aerospace and defence suppliers: ISO 9001 plus product safety, configuration and FAI, ready for an IAQG scheme audit.
• AS9110AS9110 certification for aviation maintenance organisations: the 9110 requirements, the IAQG audit route, cost and timeline factors, and Sterling's support.
• AS9120AS9120 certification for aerospace distributors and stockists: requirements, the IAQG audit route, OASIS listing, cost and timeline factors, with Sterling.