GRVA-25-31
UN R155: Proposal for amendments
Source(s)
Date
18 May 2026
Status
Informal GR review
Subject
Impact
Original text | Supplement 4
Meeting(s)

Proposal to amend UN R155 regarding cyber security assessment and approval procedures:

  • Amend para. 5.3.2. to require approval authorities to notify other approval authorities of methods and criteria used to assess measures taken in accordance with the Regulation
  • Insert new para. 8.2. to exclude equipment with negligible intrinsic cyber security risk from further assessment where installation does not impinge on the cyber security management system and is connected exclusively via an approved interface
  • Insert new para. 8.3. to exclude standard domestic, business or industrial equipment connected only for power from further assessment where the equipment is unmodified and complies with applicable regional and national cyber security requirements
  • Amend Annex 1 to include any equipment excluded from assessment pursuant to paras. 8.2. and 8.3.

UNECE server
Excerpts from session reports
GRVA | Session 25 | 18-22 May

32. During the consultations, the experts reviewed informal document GRVA-25-07, which proposed that the Certificates of Compliance issued under UN Regulations Nos. 155 and 156, as well as any subsequent type approvals, be granted by the same Type Approval Authority. Experts from CLEPA, EME and OICA presented an alternative proposal (GRVA-25-41). The expert from the United Kingdom of Great Britain and Northern Ireland, Co-Chair of the IWG on Cyber Security and Software Updates, then presented the group’s status report (GRVA-25-35), including ongoing considerations regarding the multi-stage approval of vehicles under UN Regulation No. 155, amendments to the interpretation document (GRVA-25-32), the use of separate technical services and component approval under UN Regulation No. 155, and the integration of software identification provisions into the relevant UN Regulations under the purview of GRVA (GRVA-25-30). He recalled that the group’s mandate would expire in November 2026 and proposed revising its Terms of Reference in September 2026. He also presented GRVA-25-31, containing a proposal originally developed during the workshop on the implementation of UN Regulations Nos. 155 and 156, aimed at clarifying the scope of UN Regulation No. 155 by excluding certain equipment installed in vehicles where such equipment does not pose a cyber security risk.

33. GRVA endorsed the status report of the IWG on CS/OTA (GRVA-25-35).

34. GRVA requested the secretariat to distribute GRVA-25-07, GRVA-25-30, GRVA-25-31 and GRVA-25-32 with official symbols at the September 2026 GRVA session.