The UN IWG on Cyber Security and OTA will meet April 21-22, 2026 via video conference. The agenda includes adoption of the provisional agenda and minutes from the previous session, proposals for amendments to UN R155 and its interpretation document regarding multistage vehicles and type approval authorities, review of cyber and software requirements in the ADS Regulation, discussion of RXSWIN application, renewal of the IWG mandate expiring November 2026, and confirmation of next steps.

Proposal to amend UN R155 and UN R156 to require that Certificates of Compliance for Cyber Security Management Systems and Software Update Management Systems be issued by the same approval authority that grants type approval. Germany reported a case where different authorities issued the certificate and type approval, creating assessment and enforcement issues. The proposal aims to ensure holistic cyber security evaluation and align both regulations.

Proposal to amend UN R13, 13-H, 79, 89, 130, 131, 139, 140, 152, 155, 156, 157, 171, 175, and 178 by introducing provisions on software identification and software updates. Amendments add new paragraphs referring to Software Identification Number definitions in Consolidated Resolution R.E.3, require manufacturers to provide Technical Services with information on hardware and software influencing performance, permit vehicle manufacturers to apply for new approvals differentiating software versions for registered versus new vehicles while avoiding test duplication, and modify production discontinuation provisions to exclude cases where manufacturers seek approval extensions for software updates of registered vehicles.

Proposal to amend UN R155 by clarifying its scope to exclude certain equipment. The proposal amends paragraph 5.3.2. to require approval authorities to notify others of assessment methods and criteria. New paragraphs 8.2. and 8.3. establish that vehicle manufacturer installation of equipment with negligible intrinsic cyber security risk, or standard domestic, business or industrial equipment connected only for power, shall not require further assessment under paragraph 7, provided specified criteria are justified. Annex I is amended to include any equipment excluded from assessment pursuant to paragraphs 8.2. and 8.3.

Proposal to provide guidance on application of UN R155 to transformed vehicles. Transformations require new approval unless clear evidence shows original approval remains valid. Cyber-relevant modifications include addition of electrical/electronic systems, inappropriate interface connections, and wiring protection modifications. The approval authority determines whether transformation is cyber-relevant by assessing impact on original vehicle architecture, connection risks, cybersecurity management systems, and whether non-automotive equipment complies with relevant regulations. Manufacturers must provide documentary evidence including functional descriptions, connection details, software modifications, and compliance with original manufacturer instructions.