UN Regulation No. 155 (UN R155) establishes binding cybersecurity requirements for vehicle manufacturers across categories L, M, N and O, transforming cybersecurity from an optional engineering practice into a mandatory type-approval condition for vehicles equipped with at least one electronic control unit. The regulation, which entered into force in January 2021 and became mandatory in the EU from July 2022 for new vehicle types, requires manufacturers to maintain a certified Cyber Security Management System covering development, production and post-production phases, and to continuously monitor vehicles after first registration for emerging threats and vulnerabilities.

Key Takeaways

• UN R155 applies to motorcycles, passenger vehicles, trucks and trailers (categories L, M, N and O) fitted with at least one ECU, requiring manufacturers to obtain and maintain a CSMS Certificate of Compliance
• Manufacturers must implement lifecycle cybersecurity management across three distinct phases—development, production and post-production—with continuous monitoring extending beyond vehicle production
• The regulation mandates supply-chain risk management, requiring vehicle manufacturers to identify and manage cybersecurity risks from suppliers, service providers and third-party components
• Compliance demands both organizational governance (a certified CSMS) and vehicle-level technical controls, verified through documentation reviews and security testing before type approval
• UN R155 differs from ISO/SAE 21434 and UN R156—it's a legal type-approval regulation focused on CSMS certification and vehicle approval, not an engineering standard or software-update framework

What UN R155 Is and Why It Matters for Connected Vehicles

UN Regulation No. 155 is a United Nations Economic Commission for Europe (UNECE) regulation establishing uniform requirements for vehicle cybersecurity and the manufacturer's Cyber Security Management System. Formally titled "Uniform provisions concerning the approval of vehicles with regard to cyber security and cyber security management system," the regulation was adopted under the 1958 Agreement framework for international vehicle type approval in 2020. UNECE published UN R155 with the regulation entering into force in January 2021.

The central purpose is to ensure cybersecurity is managed throughout a vehicle's entire lifecycle rather than addressed only through isolated technical controls applied during design. UN R155 uses a risk-based approach requiring manufacturers to identify cyber threats, evaluate risks, apply mitigations, test their effectiveness, and continuously monitor relevant threats and vulnerabilities. This regulation fundamentally changes cybersecurity from a voluntary engineering priority into a formal market-access and type-approval consideration in jurisdictions applying the regulation.

Which Vehicles Must Comply and When

The regulation applies to vehicles in categories L, M, N and O fitted with at least one electronic control unit. Category L covers motorcycles, mopeds and other powered two- and three-wheel vehicles. Category M includes passenger vehicles and buses, while Category N encompasses vehicles designed primarily for transporting goods, including vans and trucks. Category O addresses trailers and semi-trailers.

The scope extends far beyond passenger cars. It includes commercial vehicles, motorcycles and trailers when relevant electronic systems are present. UN R155 regulates vehicle approval with regard to cybersecurity, not general cybersecurity certification for every product or organization. The regulation is relevant to ECUs, telematics, connectivity, wireless interfaces, backend systems, mobile applications, diagnostic systems and software-dependent vehicle functions.

The timeline for implementation proceeded as follows:

• 2020: UN R155 adopted
• January 2021: International entry into force
• July 2022: Mandatory for new vehicle types in the EU
• July 2024: Mandatory for existing vehicle types in the EU

The European Union incorporated UN R155 through Regulation (EU) 2019/2144, commonly referred to as the General Safety Regulation. The current consolidated European text is UN Regulation No. 155 [2025/5], incorporating Supplement 3, which entered into force on 10 January 2025.

Understanding the Cyber Security Management System (CSMS)

A Cyber Security Management System is a systematic, risk-based approach establishing organizational processes, responsibilities and governance for managing cyber threats to vehicles and protecting them from cyberattacks. UN R155 requires vehicle manufacturers to have a valid Certificate of Compliance for the CSMS relevant to the vehicle type being approved. This certificate represents formal recognition that the manufacturer has implemented the necessary organizational structures and procedures.

The CSMS must cover three distinct lifecycle phases: development phase, production phase, and post-production phase. I can't stress enough that the CSMS is an organizational and governance requirement, not merely a penetration-testing document or technical product checklist. The system must demonstrate how cybersecurity is embedded into business processes across the entire organization.

Required CSMS elements include:

• Defined cybersecurity responsibilities and ownership
• Processes for identifying vehicle cyber risks
• Threat assessment and risk categorization
• Risk treatment and mitigation planning
• Verification that identified risks are properly managed
• Vehicle cybersecurity testing protocols
• Processes for keeping risk assessments current
• Continuous monitoring for threats, vulnerabilities and attacks
• Management of supplier and service-provider dependencies

Manufacturers must demonstrate these processes to an Approval Authority or its Technical Service. ISO/SAE 21434 provides a widely used engineering framework for automotive cybersecurity, while UN R155 is a regulatory type-approval requirement centered on the manufacturer's CSMS and vehicle approval. These instruments are complementary but not identical or interchangeable—one provides engineering guidance while the other establishes legal market-access conditions.

Manufacturer Responsibilities and Supply-Chain Risk Management

Vehicle manufacturers must apply cybersecurity processes across development, production and post-production activities. They must identify risks associated with each vehicle type, including threats listed in Annex 5 and other relevant threats. Manufacturers must assess, categorize and treat identified risks, demonstrating that risks are mitigated within a reasonable timeframe when a response is required.

Maintaining a valid CSMS Certificate of Compliance for the relevant vehicle type approval isn't optional—it's a prerequisite for market access. Manufacturers must ensure cybersecurity information is collected and verified through the supply chain so that supplier-related risks are identified and managed. This creates a documentary trail linking vehicle-level security to supplier capabilities and commitments.

Required documentation includes:

• Cybersecurity risk assessments
• Security testing results
• Implemented mitigations
• Design information supporting risk assessment
• Evidence of attack detection and response capability
• Logging and forensic capabilities

Responsibility remains with the vehicle manufacturer even when systems, ECUs, software or services are supplied by third parties. Manufacturers must manage cybersecurity dependencies involving contracted suppliers, service providers and manufacturer sub-organizations. Supplier-related risks must be identified and managed for each vehicle type seeking approval.

Typical supply-chain participants include ECU suppliers, semiconductor manufacturers, infotainment providers, telematics providers, cloud-service providers, mobile application developers, diagnostic-tool suppliers, software and firmware providers, charging-infrastructure providers, and connectivity and telecommunications providers. Supplier compliance evidence does not automatically transfer regulatory responsibility away from the vehicle manufacturer.

Supplier requirements typically encompass:

• Security requirements documentation
• Vulnerability disclosure processes
• Software bill of materials practices
• Security testing evidence
• Incident-notification obligations
• Secure-development controls
• Patch and update responsibilities

Vehicle-Level Cybersecurity, Threat Assessment and Annex 5

For each vehicle type, manufacturers must implement appropriate cybersecurity measures in vehicle design. They must perform sufficient testing before type approval to verify that security measures are effective. The Approval Authority or Technical Service verifies compliance through document checks, review of cybersecurity processes, review of risk assessments and mitigations, and vehicle testing to confirm that documented measures have been implemented.

Vehicle-level controls should address unauthorized access to vehicle systems, protection of in-vehicle communications, security of wireless interfaces, secure diagnostics, protection of externally connected devices, secure software and firmware updates, protection of backend and cloud connections, access control and authentication, data integrity and confidentiality, and attack detection and response. The regulation requires measures to detect and prevent cyberattacks against vehicles of the approved type.

Vehicles must support the manufacturer's monitoring capability for threats, vulnerabilities and attacks relevant to that vehicle type. They must also provide data-forensic capability to support analysis of attempted or successful cyberattacks. This means vehicles need appropriate logging, data collection and analysis interfaces to enable security operations.

UN R155 requires manufacturers to consider threats and corresponding mitigations identified in Annex 5. This annex serves as a structured reference for vehicle cybersecurity threats and mitigation expectations. Threat categories include servers and backend infrastructure, communication channels, connected devices, vehicle systems, vehicle-access interfaces, software and update mechanisms, and human factors, misuse or unauthorized access.

Manufacturers must also consider other relevant threats beyond the examples expressly listed in the regulation. Risk assessment must remain current as technologies, threats, vulnerabilities and vehicle configurations change. The threat landscape evolves continuously, requiring periodic reassessment rather than one-time analysis during initial development.

Continuous Monitoring and Post-Production Cybersecurity Obligations

UN R155 requires continuous monitoring of threats, vulnerabilities and cyberattacks relevant to the vehicle type. This monitoring must include vehicles after their first registration, meaning manufacturers can't treat cybersecurity as complete once a vehicle enters service. Manufacturers must have the capability to analyze and detect cyber threats, vulnerabilities and cyberattacks using vehicle data and vehicle logs.

The post-production phase includes monitoring the vehicle fleet, monitoring relevant backend infrastructure, receiving and assessing vulnerability information, detecting attempted or successful attacks, evaluating whether existing mitigations remain effective, responding to newly identified cybersecurity