51. The expert from UK, Co-Chair of the IWG on Cyber Security and Over the Air (CS/OTA) issues, presented GRVA-16-40 (status report). He clarified that the proposed Terms of Reference (ToR) did not explicitly mention AI (see ECE/TRANS/WP.29/GRVA/15, para. 11.) since the group did not identify AI-specific deliverables. He also introduced GRVA-16-15, proposing to align the recommendations on cyber security and software updates with recent amendments to UN Regulation No. 155.

52. GRVA adopted the updated Terms of Reference for the IWG on CS/OTA (GRVA-16-16), as reproduced in Annex III of the session report.

53. GRVA adopted GRVA-16-15, updating the guideline on cyber security and software updates and requested the secretariat to submit it to WP.29 for consideration and adoption at its November 2023 session.

54. GRVA resumed its discussion on the inclusion of the vehicle categories R, S ad T in UN Regulation No. 155. GRVA recalled the preference of CEMA to cover cyber security of agricultural vehicles through the European Union (EU) Cyber-Resilience Act (CRA). The expert from Germany introduced GRVA-16-26, comparing UN Regulation No. 155 and the CRA with regard to CS requirements on agricultural and forestry vehicles. He concluded that the CRA was not the right instrument for agricultural vehicles. He recalled that UN Regulation No. 155 even covered trailers (Category O) and found remarkable that vehicles of Category T were not in the scope of this regulation.

55. The expert from CEMA commented that the document prepared by Germany offered a fair comparison. He explained that some variant of their vehicles did not belong to the vehicle Category T and therefore some vehicle types would be subject to two different regulations. He urged GRVA to not make quick decisions on this topic.

56. The expert from CLEPA proposed that also all Category L vehicles should be included in the scope of the regulation.

57. The expert from UK explained that his country had a similar act to the European CRA, aimed to be applicable to consumer goods. He explained that such acts were not stringent enough for agricultural vehicles. He recalled that the issue dated back from the sixth session of GRVA in March 2020, when the Category T was in square brackets and removed at the last minute to achieve consensus and manage adoption in a short and extraordinary session organized in the beginning of the COVID-19 pandemic. He noted that CEMA did not explain the elements of concern in UN Regulation No. 155 that would pose a specific issue for Category T vehicles.

58. The expert from Italy noted that the comparison did not show huge differences in terms of stringency between the Regulation and the European CRA. He proposed to freeze the discussion until CRA is adopted in Europe.

59. The expert from Germany noted that freezing the discussion would lead to a de facto decision, due to the way CRA was drafted, as it stipulates that it would apply to all products that are otherwise not already regulated regarding cyber security.

60. GRVA discussed that adding vehicle categories in the scope of UN Regulation No. 155 would provide the flexibility that a general act cannot provide and would permit to address specificities of all vehicle categories. GRVA noted the fact that CRA was not applicable for contracting parties outside of the EU. GRVA accepted the Chair’s proposal to finalize the discussion in September 2023.