35. The expert from Japan, co-organizer (together with the secretariat) of workshops on the implementation of UN Regulation No. 155, reported on recent activities (GRVA-12-21). GRVA thanked Japan and the secretariat for these efforts to build capacity and support uniform application of the regulation.

36. The expert from China highlighted that his country, even though not Contracting Party to the 1958 Agreement, begun, following the entry into force of UN Regulation No. 155, the preparation of national standards on cyber security for whole vehicles, with references to concepts in UN Regulation No. 155. He reported however that they faced issued related to standard tests and verifications. He detailed that paragraph 5.3. contributed to the uniform application of the regulation as it required the Contracting Parties to upload their assessment method in the Database for the Exchange of Type Approval documentation (DETA). He explained that parties not signatory to UN Regulation No. 155 would face the same issue when drafting their own cyber security standards with reference to UN Regulation No. 155. He wondered how Contracting Parties to the 1998 Agreement could achieve consistency in the application and implementation of the requirements and inquired if an access to DETA could be organized for the Contracting Parties of the 1998 Agreement so that they can access to the methodology posted there according to the provisions under para. 5.3 of the regulations. The expert from the Russian Federation supported the expert from China and pointed at the IWG on DETA to check how to provide access. GRVA agreed to address this matter and to resume its consideration at its next session.

37. The expert from CEMA presented GRVA-12-05, recalling the CEMA position regarding UN Regulations Nos. 155 and 156. He also recalled the request of CEMA to remove the Categories S, R and T from the scope of UN Regulation No. 156. He claimed that the vehicles of these categories, even though similar, were different from other vehicle categories (such as trucks). He acknowledged that over-the-air software updates were performed by vehicle types of these three categories. He pointed at the case of all-terrain vehicles, that were either belonging to the Category L (and as such not being subject to UN Regulation No. 156), or to the Category T (and be subject to UN Regulation No. 156).

38. The expert from Germany mentioned that a market analysis exercise showed that vehicles of Categories S, R and T included automated driving systems on field; such equipment was mature and well developed. She noted that such vehicles were also driven on public roads and that, even though their maximum speed was lower than the one of other vehicles, they were characterized by their high torque and were therefore hard to stop. These vehicles, as such, were therefore posing a risk in traffic that could be addressed by that regulation. She supported the inclusion of these vehicle categories in the scope of UN Regulation No. 155 and to keep them in UN Regulation No. 156. She added that lead-time could be envisaged, and she suggested a transition period of five years.

39. The expert from Italy suggested to remove these three vehicle categories from the scope of UN Regulation No. 156, until appropriate work is conducted.

40. The expert from the European Commission confirmed that the European Union did not mandate the application of UN Regulation No. 156 and that this topic was not considered as a priority for the region. He recalled that the Category L was included in the scope of UN Regulation No. 155, but limited to automated vehicles.

41. The expert from United Kingdom of Great Britain and Northern Ireland recalled that vehicles of Category L were exempted because they were unlikely to be connected vehicles. He stressed that many new vehicles of the Category T were connected and automated. He therefore supported that they were subject to cyber security requirements. He added that he struggled to understand why Category T vehicle manufacturers would struggle to implement UN Regulation No. 156, as its provisions were primarily about software management. He assumed that reputable firms would already comply with such requirements.

42. The experts from Luxembourg and the Netherlands supported the experts from Germany and from the United Kingdom of Great Britain and Northern Ireland.

43. The expert from Denmark stated that he was not in the position to express any position on this matter as such matters would be relevant for another ministry in his country.

44. The expert from Spain agreed with the expert from Italy.

45. GRVA agreed to keep the three Categories S, R and T in the scope of UN Regulation No. 156 and to resume consideration of this item at the next session in order to develop a road map for their future inclusion in UN Regulation No. 155.

46. The expert from CLEPA presented GRVA-12-37 with corrections proposals to references to the standard ISO/SAE 21434. GRVA adopted the document GRVA-12-37 and requested the secretariat to submit it to WP.29 for consideration and vote at its June 2022 session.

47. The expert from Japan, Co-Chair of the IWG on Cyber Security and OTA issues, presented ECE/TRANS/WP.29/GRVA/2022/5, a proposal prepared by the group for recommendations on uniform provisions concerning cyber security and software updates, suitable for the Contracting Parties to the 1998 and/or 1958 Agreements. The experts from China, Italy and the United States of America supported the document. GRVA adopted it and requested the secretariat to submit it to WP.29 for consideration and vote at its June 2022 session.