UN R155

Nothing changed in the last 90 days. Sign in to read further back.

1. 2029-07-01 in 965 days Category L: transitional relief in paragraphs 7.3.1 and 7.3.4 covers only type approvals first issued before this date
2. 2025-01-10 Supplement 3 to the original version of UN R155 enters into force
3. 2024-07-07 EU: registration of new vehicles that do not meet the cyberattack protection requirement (UN R155) is prohibited
4. 2024-07-01 Categories M, N and O: transitional relief in paragraphs 7.3.1 and 7.3.4 covers only type approvals first issued before this date
5. 2022-07-06 EU: type approval is refused for new vehicle types that do not meet the cyberattack protection requirement (UN R155)

1. 2025-01-10
   UN Regulation No 155, original version incorporating Supplement 3 AmendmentCurrent text

   Consolidated text published in the Official Journal of the EU incorporating all valid text up to Supplement 3 to the original version, which entered into force on 10 January 2025. source

   More

   • The scope covers Categories L, M, N and O fitted with at least one electronic control unit; the 2021 text covered M and N, O with an ECU, and L6 and L7 only with level 3+ automated driving.
   • Transitional relief from developing the vehicle type under the CSMS applies to M, N and O type approvals first issued before 1 July 2024 and to Category L type approvals first issued before 1 July 2029.
   • Authentic texts: ECE/TRANS/WP.29/2020/79 (as amended), ECE/TRANS/WP.29/2022/54, ECE/TRANS/WP.29/2023/70 and ECE/TRANS/WP.29/2024/55.
2. 2021-01-22
   UN Regulation No 155, original version Major version

   First version: approval of vehicles with regard to cybersecurity and a cybersecurity management system; entered into force on 22 January 2021 and was published in OJ L 82 on 9 March 2021. source

Vehicle manufacturers seeking type approval for L, M, N and O category vehicles with an ECU; in the EU it is mandatory for M and N type approval under Regulation (EU) 2019/2144.

Vehicles in scope

Vehicles of Categories L, M, N and O, with regard to cyber security, if fitted with at least one electronic control unit. source

CSMS certificate

The manufacturer must have a valid Certificate of Compliance for the Cyber Security Management System relevant to the vehicle type being approved. source

Vehicle type risk

For each vehicle type the manufacturer identifies critical elements, performs an exhaustive risk assessment considering the threats in Annex 5 Part A, and implements the relevant mitigations in Annex 5 Parts B and C. source

Supplier risks

The manufacturer must identify and manage supplier-related risks for the vehicle type. source

EU, mandatory

Regulation (EU) 2019/2144 lists UN Regulation No 155 (protection of vehicle against cyberattacks) as a requirement for EU type approval of categories M1, M2, M3, N1, N2 and N3 (Annex II, row D4). source

Legal effect

Only the original UN/ECE texts have legal effect under international public law; the OJ text is a documentation tool. source

An Approval Authority certifies the manufacturer's CSMS for up to three years and grants type approval per vehicle type; the manufacturer reports monitoring results at least once a year.

CSMS certificate

Approval Authorities assess the manufacturer and issue a Certificate of Compliance for CSMS, valid for a maximum of three years unless withdrawn. source

Renewal

The manufacturer applies in time for a new or extended certificate; after a positive assessment the Approval Authority issues a new certificate or extends the existing one. source

Yearly monitoring report

The manufacturer reports at least once a year, or more often if relevant, the outcome of its monitoring activities, including relevant information on new cyber-attacks. source

Refusal of approval

Type approval is refused if the Approval Authority or Technical Service has not received sufficient information to assess the cyber security of the vehicle type. source

Production checks

The Approval Authority may verify conformity control methods in each production facility at any time; the normal frequency is once every three years. source

Approval can be refused or withdrawn, and in the EU non-compliant new vehicles could not be registered from 7 July 2024.

Withdrawal of approval

A type approval may be withdrawn if the requirements of the Regulation are not complied with or if sample vehicles fail to comply. source

EU registration ban

Under Regulation (EU) 2019/2144, EU type approval is refused from 6 July 2022 and registration of non-compliant vehicles prohibited from 7 July 2024. source

1. Law text UN Regulation No 155, incorporating Supplement 3 (OJ L, 2025/5)
2. Law text UN Regulation No 155, original version (OJ L 82, 9.3.2021)
3. Law text Regulation (EU) 2019/2144 on vehicle general safety (consolidated)

1. UN R156

   UN R156 is the companion regulation on software updates and the Software Update Management System; UN R155 covers cyber security and the CSMS.

2. ISO/SAE 21434

   ISO/SAE 21434 is a voluntary engineering standard for vehicle cybersecurity processes; UN R155 is the type-approval regulation, and it cites 21434 as relevant assessor knowledge.

3. CRA

   The EU Cyber Resilience Act sets cybersecurity rules for products with digital elements; UN R155 sets them for vehicle types through type approval.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 20 September 2026. Subscribe to UN R155 (RSS)