Proposal to insert provisions on Software Identification Numbers and software updates across UN R13, R13-H, R79, R89, R130, R131, R152, R155, R156, R157, R171, R175, and R178 by adding definitions referencing Consolidated Resolution R.E.3 Annex 7 paragraph 2, requiring manufacturers to provide Technical Services with information on hardware and software influencing performance with test reports, permitting vehicle manufacturers to apply for new approvals differentiating software versions for registered vehicles from new vehicles where type approval regulations are updated or hardware changes occur in series production with test duplication avoided where possible, clarifying that production is not considered definitively discontinued if manufacturers obtain subsequent extensions for software updates of registered vehicles, renumbering and inserting new items in approval communication annexes for R13SWIN, R13-HSWIN, R79SWIN, R89SWIN, R130SWIN, R131SWIN, R152SWIN, R155SWIN, R157SWIN, R171SWIN, R175SWIN, and R178SWIN information including whether held on vehicle and relevant parameter identification lists, and amending R157 and R171 to align software update requirements with R156 technical specifications and transitional provisions.

Proposal to amend para. 5.3.2. to require notification of assessment methods and criteria including paras. 8.2. and 8.3., insert new paras. 8.2. and 8.3. establishing criteria for equipment installation without further assessment, and amend Annex 1 to require disclosure of equipment excluded from assessment pursuant to paras. 8.2. and 8.3. The amendments clarify that equipment with negligible intrinsic cyber security risk installed according to manufacturer specifications and not introducing cyber security risk, and standard non-automotive equipment connected solely for power supply with no increased cyber security risk, shall not invalidate approval of the original vehicle type under UN Regulation No. 155.

Proposal to insert new Part C providing guidance for the application of UN R155 to transformed vehicles. Part C addresses identification of cyber-relevant transformations, impact on original vehicle architecture, connection risks, and impact on cyber security management systems. It specifies that transformations require new approval unless the manufacturer provides clear evidence that the original approval remains valid, and outlines critical factors and examples of cyber-relevant actions. It details documentary evidence expected from manufacturers regarding functional descriptions, connections with original vehicle types, added components and functions, and arguments demonstrating negligible intrinsic risk.

Proposal to amend UN R155 by inserting new para. 5.1.3.(e) establishing that the Certificate of Compliance for the Cyber Security Management System shall not be issued by a different Approval Authority than the one granting type approval, and amend UN R156 by inserting new para. 5.4. establishing that Approval Authorities shall not grant type approval if the Certificate of Compliance for the Software Update Management System has not been issued by the same Approval Authority granting type approval. Justification includes ensuring holistic cybersecurity assessment, clarifying reporting obligations under para. 7.2.2.2.(g), addressing unharmonized mutual recognition of management system certificates, maintaining consistency between regulations, and upholding the fundamental principle that approval authorities retain responsibility for all aspects of type approval.