The UN IWG on Cyber Security and OTA issues held its 39th session on 3 September 2026. The provisional agenda (TFCS-38-01/Rev.3) and minutes from the 38th session (TFCS-38-13) were adopted. Regarding R155 amendments: multistage vehicle proposals (GRVA/2026/28, GRVA/2026/29, TFCS-39-08) will be submitted as informal documents with a merged paragraph; component approval proposals (TFCS-39-04) had STU references removed and discussion continues; remote operation for ADS proposals were not discussed but participants are invited to consider a general refresh of Annex 5. RXWIN application proposals (TFCS-39-05, TFCS-39-06, TFCS-39-07, TFCS-39-08, TFCS-39-09, TFCS-39-10, TFCS-39-11, TFCS-39-12) were presented; items 1, 4, and 6 were agreed, item 5 was agreed in principle, and items 2 and 3 regarding R155 and R157 applicability require revised wording. Netherlands expressed concerns about vehicle discontinuation and multiple type approvals. Administrative provisions regarding Type Approval Authority for CSMS/SUMS (GRVA/2026/30, TFCS-39-02, TFCS-39-07) were discussed without consensus. Out-of-scope vehicle approvals (TFCS-38-03) discussion was deferred to a separate workshop. Two informal documents will be provided to GRVA.

Japan submitted comments on RXSWIN assignment at the 38th CS/OTA IWG. Q.1 asks whether, when a type approval is extended from UN R156-00 to UN R156-01, RXSWIN may be assigned at extension time, and if a UN Regulation refers to RE.3 Annex 7 through a supplementary amendment after UN R156-01 transitional provisions become applicable, whether RXSWIN is assigned at that time. Q.2 asks whether Approval Authorities other than the Authority granting approval are expected to have access to the OEM’s Auditable Register, as access information appears provided only to the Approval Authority concerned through paragraph 9.5.2. Q.3 asks whether software updates affecting type approval can be performed under Regulations that do not reference RE.3 Annex 7.

Proposal to amend para. 7.2.1.2.2. to delete, in cases where RXSWINs are not held on the vehicle, the requirement that the manufacturer shall declare the software version(s) of the vehicle or single ECUs with the connection to the relevant type approvals to the Approval Authority and that this declaration shall be updated each time the declared software version(s) is updated, and add that the link between the software version(s) and the RXSWINs shall be declared.

Proposal to insert new paras. 27 and 28 in Part C Guidance for the application of UN Regulation No. 155 to transformed vehicles. Para. 27 states the requirement that the Certificate of Compliance and type approval are issued by the same Approval Authority applies only within the scope of the type approval granted to the manufacturer concerned. Para. 28 states where a vehicle manufacturer modifies a vehicle with existing type approval and applies for new type approval covering the modification, they need not use the same type approval authority as was used by the original vehicle manufacturer.

OICA, CLEPA, and CLCCR oppose the requirement in GRVA/2026/30 for a single Approval Authority to issue the Certificate of Compliance for CSMS/SUMS and vehicle type approval. They contend the approach would create multiple approvals of the same Management System, imposing administrative burden and creating unresolved legal consequences if a CoC is challenged. The organizations propose adding a new paragraph 5.1.5. instead of paragraph 5.1.3. e) to permit mutual agreement between Approval Authorities, allowing usage of a CoC issued by another Approval Authority, with such agreement documented in type approval documentation.

Proposal to amend GRVA/2026/27, which proposes amendments to UN R13, UN R13-H, UN R79, UN R89, UN R130, UN R131, UN R139, UN R140, UN R152, UN R156, UN R157, UN R171, UN R175, and UN R178:

• Throughout these regulations, amend references to the Consolidated Resolution on the Construction of Vehicles (R.E.3) as document ECE/TRANS/WP.29/78/Rev.8,
• insert new definitions for Software Identification Numbers referring to R.E.3 Annex 7 para. 2,
• amend requirements for software identification to require manufacturers provide necessary information allowing Technical Services to uniquely identify hardware and software configurations,
• insert new provisions allowing vehicle manufacturers to apply for new approvals differentiating software versions for vehicles already registered in the market from new vehicles,
• amend production discontinuation provisions to clarify production is not considered definitively discontinued if manufacturer intends to obtain subsequent extensions of approval for software updates of registered vehicles,
• insert new items in annexes regarding additional information on software identification and software updates including R_xSWIN identification, whether held on vehicle, how to read if not held on vehicle, and relevant parameters for vehicle identification.

Proposed changes to align RxSWIN provisions with the RxSWIN template adopted through WP.29-197-06, remove the proposed requirement to comply with UN R156/01 or later from R157 and R171, remove amendments to UN R155 as decided by the IWG CS/OTA, apply the RxSWIN amendments also to earlier series of amendments in R13, R13-H, R79, R131, R152, R157, and R171, update references to the latest version of R.E.3, ECE/TRANS/WP.29/78/Rev.8, in earlier series, and correct paragraph references and improve structure in R89, R139, R140, R155, R156, and R171.

The agenda includes adoption of the provisional agenda and minutes from the thirty-eighth session; proposals for amendments to R155 concerning multistage vehicles, separate technical units and component approval, and remote operation for automated driving systems; review of cyber and software requirements in the ADS Regulation; application of RXSWIN to R156; administrative provisions in R155 and R156 regarding Type Approval Authority for CSMS/SUMS and issuing approvals for out-of-scope vehicle types; and preparation of GRVA 26.

This document presents a concept for approvals of electrical/electronic sub-assemblies (ESAs) as components according to UN R155, and the installation of such approved components on vehicles already holding UN R155 approval. The proposal removes the possibility of separate technical unit (STU) approvals as a first step, limiting coverage to components connected only to power and/or reading data through approved existing interfaces. The document restructures UN R155 into three parts: Part I covers vehicle type approvals; Part II covers ESA component approvals with cybersecurity requirements; Part III covers vehicle type approvals regarding installation of approved ESAs. Requirements include cybersecurity management systems, risk assessments, threat mitigations, and reporting provisions for development, production, and post-production phases.

Proposal to amend Paragraph B to insert new requirement 5.1.3 establishing that the Approval Authority or Technical Service shall refuse to grant type approval regarding cyber security where the vehicle manufacturer has not fulfilled requirements in paragraph 7.3., notably that the Certificate of Compliance for the Cyber Security Management System has not been issued by the same Approval Authority granting the type approval, add explanatory text clarifying that this ensures Article 2(2) of the 1958 Agreement compliance while permitting cooperation between Approval Authorities and acceptance of prior documentation, amend Paragraph K to remove existing guidance text in paragraphs 6.1 and 7.1 regarding Certificate of Compliance issuance and inter-Authority arrangements, and insert statement that no guidance is included regarding paragraph 6 requirements. These changes support proposal GRVA/2026/30.

The UN IWG on Cyber Security and OTA held its 38th session 29 June–1 July 2026 in London with remote participation. The group adopted the provisional agenda and minutes from the 37th session. Three items from the IWG were presented at the May GRVA meeting: multistage vehicle documents to become working documents for September; RXWIN documents with elements in square brackets to be resolved; and SUMs document returned for further discussion. For R155, the group agreed to forward multistage amendment proposals as working documents to September GRVA. The UK proposal on STU and component approval for R155 was discussed extensively; the UK will draft a proposal for components only. The UK proposal on remote operation for ADS requires further development. The group will review ADS GTR cyber and software provisions. RXWIN proposal documents were adapted; R155 was removed and R89 and R156 sections amended; reviewers may address concerns by 31 July 2026. Germany’s proposal requiring the same Type-Approval Authority for CSMS and vehicle type approval was discussed; a dedicated meeting will be scheduled. The UK proposal on approvals for out-of-scope vehicle types was introduced. Draft Terms of Reference were revised and will be forwarded to GRVA for September approval. The next meeting is scheduled for 3 September 2026, 12:00–15:00 CET.

The document presents vehicle modification use cases categorized into four cases and additional scenarios. Case 1 covers components with negligible risk or cyber-relevant non-automotive devices. Case 2 addresses cyber-relevant automotive devices approved to specific regulatory requirements, requiring installation approval and vehicle type re-approval. Case 3a addresses cyber-relevant devices not approved to specific requirements, requiring component or STU approval. Case 3b covers devices controlling vehicle functions, also requiring component or STU approval. Case 4 encompasses invasive modifications or complex interactions not covered by other cases.

Proposal to insert provisions on software identification and software updates into UN R13, UN R13-H, UN R79, UN R89, UN R130, UN R131, UN R152, UN R156, UN R157, UN R171, UN R175, and UN R178 by adding definitions referencing Consolidated Resolution R.E.3 Annex 7, requiring manufacturers to provide Technical Services with information on hardware and software influencing performance, permitting vehicle manufacturers to apply for new approvals differentiating software versions for registered versus new vehicles, clarifying that production discontinuation does not apply when manufacturers seek approval extensions for software updates of registered vehicles, and amending communication forms to include software identification numbers and related information.

The Informal Working Group on Cyber Security and Software Updates will continue to consider how cyber security and software updates have a bearing on automotive safety and security, and whether any changes are necessary to the Regulations and guidance it has produced under WP.29. In particular, the IWG shall maintain official documents regarding UN R155, UN R156, and Recommendations on uniform provisions concerning cyber security and software updates; develop amendments to relevant documents; develop a proposal to amend UN Regulations under the responsibility of GRVA to record details of an RXSWIN where applicable which have been mandated by the 01 series of UN Regulation No. 156; develop proposals to amend UN Regulation No. 155 and its interpretation document to support application in national/regional frameworks for aspects such as multi-stage manufacturing; consider and develop deliverables regarding software updates after registration potentially creating a proposal for modification to the type approval numbering or a classification of update categories; support and review the application of cyber security and software update provisions across GRs notably for the Global Technical Regulation on Automated Driving Systems; and provide opportunities to participants to share knowledge, experience and ideas from implementation of national regulation/standards regarding CS/OTA as well as UN R155 and R156. The IWG will continue its activities until November 2029.

The agenda includes review of proposals for amendments to R155 concerning multistage vehicles, separate technical units and component approval, approval-authority requirements for CSMS CoC and vehicle type approval, and remote operation for ADS; review of cyber and software requirements in the ADS Regulation based on WP.29/2022/60 as amended by WP.29/2023/87; discussion of RXWIN application amendments; and consideration of terms of reference renewal ahead of mandate expiration in November 2026.

Amend para. AI to replace the heading “Examples of documents/evidence that could be provided” with “Explanation of the requirement” and insert text stating that Part C of this document provides further guidance on the application of the Regulation to vehicles which have been modified by carrying out a transformation of the vehicle.

CLEPA welcomes questions raised by Japanese experts under doc TFCS-37-06 and identifies points requiring further clarification regarding component and STU type approval scope, technical integration, STU definition, implementation, risk assessment, impact and benefit, and post-market monitoring. CLEPA proposes that components or STUs required for initial vehicle type approval under Part I should not be subject to separate approval under Part II, noting that vehicle cybersecurity depends on vehicle-level system interactions and E/E architecture, the OEM has full visibility of system architecture, and Part I approval ensures integrated assessment.

Proposal to add para. 3.2.3.1. requiring manufacturers to provide additional information on the Cyber Security Management System at request of the Approval Authority when the Certificate of Compliance for CSMS is issued by a different Approval Authority, add para. 5.1.5. allowing the Approval Authority to refuse type approval if insufficient information on the CSMS and its implementation was provided, and add para. 7.4.1.1. requiring all granting Approval Authorities to be included in reporting when different Approval Authorities are used for the Certificate of Compliance for CSMS and type approval of the vehicle type.