Proposal to amend para. 5.12. to require the manufacturer’s management system encompassing cyber security to comply with the relevant requirements of UN R155 with regard to total distance indicated and total distance values, and to require threat and associated vulnerabilities to be analysed according to the management system with regard to total distance indicated and total distance values, with proportionate mitigations implemented including or equivalent to mitigation 7 referred to in Annex 5, Part B, Table B5, threat 20.4. of UN R155. The proposal aligns odometer anti-tampering and security management requirements with UN R155 and clarifies that mitigating measures must be implemented regardless of risk value assessment.

Proposal for a new UN Regulation establishing uniform provisions for type approval of Electric Powertrain Retrofit Systems (EPRS) designed for conversion of vehicles of categories M and N to full electric propulsion. The regulation does not apply to vehicles holding approval under UN R155 or UN R156. It sets out requirements for EPRS manufacturers, installers, markings, approval procedures, general and specific technical requirements for retrofit systems, installer authorization and training, documentation to be provided by manufacturers, conformity of production, modification and extension of approvals, and penalties for non-conformity.

Minutes of the eleventh meeting of the IWG on EV/HFCV Retrofit Systems held on 9 September 2026. The group adopted the provisional agenda and reviewed the draft UN Regulation on EV/HFCV retrofit systems. Key discussions addressed the regulatory concept for approval of the Electric Powertrain Retrofit System combined with installation requirements and vehicle testing, vehicle scope including possible exclusion of older vehicles and those subject to UN Regulations Nos. 155 and 156, and confirmation that HFCV provisions would remain as placeholders for later development. The updated working document will be circulated before submission to GRPE in October 2026.

GRVA will continue to establish and maintain the United Nations regulatory framework for Automated Driving Systems, including UN R185 and GTR 26. GRVA will continue its work on cyber security, over-the-air software updates, and the Data Storage System for Automated Driving. GRVA will focus on implementation of ADS and development of provisions for the Exchange of Scenario-Relevant Information. GRVA will further elaborate requirements for Advanced Driver Assistance Systems, building on UN R79 and UN R171, and for Automated Emergency Braking Systems, building on UN R131 and UN R152.

Proposal to amend paragraph AI to introduce a link between existing text in Part A and new text in Part C regarding vehicle transformations, and insert new Part C providing guidance for the application of UN Regulation No. 155 to transformed vehicles. The proposal adds section 6 clarifying that the requirement for the Certificate of Compliance and type approval to be issued by the same Approval Authority applies only within the scope of the type approval granted to the manufacturer concerned, and does not restrict another manufacturer from obtaining a separate type approval and associated Certificate of Compliance from the responsible Approval Authority.

Proposal to insert new clauses to section 8 of the Consolidated Resolution on the Construction of Vehicles (R.E.3) to add provisions 8.40.1. through 8.40.9. establishing requirements for:

• Periodic technical inspection of vehicles, including verification of proper condition and functionality through testing equipment, electronic vehicle interface, scan-tools and manual/visual inspection,
• access to in-vehicle data without changing approved vehicle design or affecting software integrity, functionality of installed safety systems, and cyber security measures,
• manufacturer provision of technical information for testing equipment, electronic vehicle interface, scan-tools and methods,
• vehicle construction providing access to Diagnostic Trouble Code with regard to identify failure of vehicle, equipment and parts,
• definition of failure,
• requirement that Diagnostic Trouble Code be accessible by scan-tools compliant with international standards without manufacturer-specific, user-specific, or tool-specific restrictions,
• cyber security measures not affected,
• application limited to authorized test centers and workshops.

Proposal to amend para. 5.1.3., insert new paras. 5.1.5. and 5.1.5.1. requiring the Approval Authority to refuse type approval unless the Certificate of Compliance for the Cyber Security Management System is issued by the same Approval Authority granting vehicle type approval, while permitting referencing of certificates from other Approval Authorities under specific conditions with documented agreements and clarified responsibilities, and insert new paras. 5.4. and 5.4.1. with equivalent requirements for the Software Update Management System Certificate of Compliance.

Document outlining GRVA’s priority activities for 2027 based on ECE/TRANS/WP.29/2026/1. GRVA will continue establishing and maintaining the United Nations regulatory framework for Automated Driving Systems, including UN R185 and GTR 26, with work on cyber security, over-the-air software updates, and the Data Storage System for Automated Driving. GRVA will focus on ADS implementation, provisions for Exchange of Scenario-Relevant Information, and elaboration of requirements for Advanced Driver Assistance Systems and Automated Emergency Braking Systems building on UN R79, 171, 131, and 152.

Proposal to amend Article 2, paragraph 2 to clarify that where a Certificate of Compliance required under a UN Regulation and issued by an Approval Authority of another Contracting Party is accepted by a Contracting Party, the Approval Authority granting the corresponding type approval shall remain responsible for all aspects of that type approval. The amendment addresses management systems and their Certificates of Compliance used in UN Regulations such as UN R155 and UN R156.

Document explains concerns about the approach in GRVA/2026/30 to require a single Approval Authority to issue certificates of compliance for Cyber Security Management Systems and Automated Driving Systems Management Systems and vehicle type approval. The proposed changes would lead to double or triple approvals of management systems, creating administrative burden and unresolved legal consequences regarding challenged certificates of compliance and their effects on other issued certificates for the same management system. The submission proposes clarifying existing wording, documenting implications of challenged certificates, and adding a new paragraph 5.1.5. to UN R155 permitting mutual agreement between Approval Authorities regarding certificate usage.

Proposal to renew the terms for the Informal Working Group on Cyber Security and Software Updates under GRVA. The IWG shall maintain official documents on cyber security and software updates, develop amendments to UN R155 and UN R156 including provisions on software identification, support application across Global Technical Regulations, and provide opportunities for participants to share implementation experience. The IWG will be chaired by the United Kingdom, United States, and Japan, with OICA providing technical secretariat, and will operate until November 2029.

Status report on activities of the IWG on CS/OTA since the 25th GRVA session. The IWG reviewed proposals for amendment of UN R155 and its interpretation document for multi-stage vehicles, proposals for approval-authority arrangements and Certificates of Compliance for UN R155 and R156, proposals integrating software identification and update text across several UNRs outlined in RE.3, component and STU approval concepts, and remote operation and automated driving systems. The IWG proposes updating regulatory text and interpretation documents for UN R155, revisions to software identification and update text across several regulations, and revised Terms of Reference for a mandate till November 2029.

Proposal to amend paragraph AI to introduce a link between existing text in Part A and new Part C regarding vehicle transformations, insert new Part C providing guidance for the application of UN Regulation No. 155 to transformed vehicles including documentary evidence requirements, and add section 6 clarifying that the requirement for Certificate of Compliance and type approval to be issued by the same Approval Authority applies only within the scope of a specific type approval and its approval holder.

Proposal to insert definitions for Software Identification Number, insert requirements for manufacturers to provide necessary information allowing the Technical Service to uniquely identify hardware and software configurations, insert provisions allowing vehicle manufacturers to apply for new approvals to differentiate software versions for registered versus new vehicles, amend production discontinuation provisions to clarify that cessation is not deemed definitive if the manufacturer intends to obtain subsequent extensions for software updates of vehicles already registered in the market, renumber and insert new items in approval communication annexes regarding software identification and software updates including RxSWIN, and insert provisions allowing vehicle manufacturers to obtain new approvals for software version differentiation across multiple UN Regulations (13, 13-H, 79, 89, 130, 131, 139, 140, 152, 155, 156, 157, 171, 175, and 178).

The UN IWG on Cyber Security and OTA issues held its 39th session on 3 September 2026. The provisional agenda (TFCS-38-01/Rev.3) and minutes from the 38th session (TFCS-38-13) were adopted. Regarding R155 amendments: multistage vehicle proposals (GRVA/2026/28, GRVA/2026/29, TFCS-39-08) will be submitted as informal documents with a merged paragraph; component approval proposals (TFCS-39-04) had STU references removed and discussion continues; remote operation for ADS proposals were not discussed but participants are invited to consider a general refresh of Annex 5. RXWIN application proposals (TFCS-39-05, TFCS-39-06, TFCS-39-07, TFCS-39-08, TFCS-39-09, TFCS-39-10, TFCS-39-11, TFCS-39-12) were presented; items 1, 4, and 6 were agreed, item 5 was agreed in principle, and items 2 and 3 regarding R155 and R157 applicability require revised wording. Netherlands expressed concerns about vehicle discontinuation and multiple type approvals. Administrative provisions regarding Type Approval Authority for CSMS/SUMS (GRVA/2026/30, TFCS-39-02, TFCS-39-07) were discussed without consensus. Out-of-scope vehicle approvals (TFCS-38-03) discussion was deferred to a separate workshop. Two informal documents will be provided to GRVA.

Proposal to insert new paras. 27 and 28 in Part C Guidance for the application of UN Regulation No. 155 to transformed vehicles. Para. 27 states the requirement that the Certificate of Compliance and type approval are issued by the same Approval Authority applies only within the scope of the type approval granted to the manufacturer concerned. Para. 28 states where a vehicle manufacturer modifies a vehicle with existing type approval and applies for new type approval covering the modification, they need not use the same type approval authority as was used by the original vehicle manufacturer.

OICA, CLEPA, and CLCCR oppose the requirement in GRVA/2026/30 for a single Approval Authority to issue the Certificate of Compliance for CSMS/SUMS and vehicle type approval. They contend the approach would create multiple approvals of the same Management System, imposing administrative burden and creating unresolved legal consequences if a CoC is challenged. The organizations propose adding a new paragraph 5.1.5. instead of paragraph 5.1.3. e) to permit mutual agreement between Approval Authorities, allowing usage of a CoC issued by another Approval Authority, with such agreement documented in type approval documentation.

Proposal to amend GRVA/2026/27, which proposes amendments to UN R13, UN R13-H, UN R79, UN R89, UN R130, UN R131, UN R139, UN R140, UN R152, UN R156, UN R157, UN R171, UN R175, and UN R178:

• Throughout these regulations, amend references to the Consolidated Resolution on the Construction of Vehicles (R.E.3) as document ECE/TRANS/WP.29/78/Rev.8,
• insert new definitions for Software Identification Numbers referring to R.E.3 Annex 7 para. 2,
• amend requirements for software identification to require manufacturers provide necessary information allowing Technical Services to uniquely identify hardware and software configurations,
• insert new provisions allowing vehicle manufacturers to apply for new approvals differentiating software versions for vehicles already registered in the market from new vehicles,
• amend production discontinuation provisions to clarify production is not considered definitively discontinued if manufacturer intends to obtain subsequent extensions of approval for software updates of registered vehicles,
• insert new items in annexes regarding additional information on software identification and software updates including R_xSWIN identification, whether held on vehicle, how to read if not held on vehicle, and relevant parameters for vehicle identification.

Proposed changes to align RxSWIN provisions with the RxSWIN template adopted through WP.29-197-06, remove the proposed requirement to comply with UN R156/01 or later from R157 and R171, remove amendments to UN R155 as decided by the IWG CS/OTA, apply the RxSWIN amendments also to earlier series of amendments in R13, R13-H, R79, R131, R152, R157, and R171, update references to the latest version of R.E.3, ECE/TRANS/WP.29/78/Rev.8, in earlier series, and correct paragraph references and improve structure in R89, R139, R140, R155, R156, and R171.

The agenda includes adoption of the provisional agenda and minutes from the thirty-eighth session; proposals for amendments to R155 concerning multistage vehicles, separate technical units and component approval, and remote operation for automated driving systems; review of cyber and software requirements in the ADS Regulation; application of RXSWIN to R156; administrative provisions in R155 and R156 regarding Type Approval Authority for CSMS/SUMS and issuing approvals for out-of-scope vehicle types; and preparation of GRVA 26.

This document presents a concept for approvals of electrical/electronic sub-assemblies (ESAs) as components according to UN R155, and the installation of such approved components on vehicles already holding UN R155 approval. The proposal removes the possibility of separate technical unit (STU) approvals as a first step, limiting coverage to components connected only to power and/or reading data through approved existing interfaces. The document restructures UN R155 into three parts: Part I covers vehicle type approvals; Part II covers ESA component approvals with cybersecurity requirements; Part III covers vehicle type approvals regarding installation of approved ESAs. Requirements include cybersecurity management systems, risk assessments, threat mitigations, and reporting provisions for development, production, and post-production phases.

Proposal to amend Paragraph B to insert new requirement 5.1.3 establishing that the Approval Authority or Technical Service shall refuse to grant type approval regarding cyber security where the vehicle manufacturer has not fulfilled requirements in paragraph 7.3., notably that the Certificate of Compliance for the Cyber Security Management System has not been issued by the same Approval Authority granting the type approval, add explanatory text clarifying that this ensures Article 2(2) of the 1958 Agreement compliance while permitting cooperation between Approval Authorities and acceptance of prior documentation, amend Paragraph K to remove existing guidance text in paragraphs 6.1 and 7.1 regarding Certificate of Compliance issuance and inter-Authority arrangements, and insert statement that no guidance is included regarding paragraph 6 requirements. These changes support proposal GRVA/2026/30.

Proposal to insert provisions on Software Identification Numbers and software updates across UN R13, R13-H, R79, R89, R130, R131, R152, R155, R156, R157, R171, R175, and R178 by adding definitions referencing Consolidated Resolution R.E.3 Annex 7 paragraph 2, requiring manufacturers to provide Technical Services with information on hardware and software influencing performance with test reports, permitting vehicle manufacturers to apply for new approvals differentiating software versions for registered vehicles from new vehicles where type approval regulations are updated or hardware changes occur in series production with test duplication avoided where possible, clarifying that production is not considered definitively discontinued if manufacturers obtain subsequent extensions for software updates of registered vehicles, renumbering and inserting new items in approval communication annexes for R13SWIN, R13-HSWIN, R79SWIN, R89SWIN, R130SWIN, R131SWIN, R152SWIN, R155SWIN, R157SWIN, R171SWIN, R175SWIN, and R178SWIN information including whether held on vehicle and relevant parameter identification lists, and amending R157 and R171 to align software update requirements with R156 technical specifications and transitional provisions.

Proposal to insert new Part C providing guidance for the application of UN R155 to transformed vehicles. Part C addresses identification of cyber-relevant transformations, impact on original vehicle architecture, connection risks, and impact on cyber security management systems. It specifies that transformations require new approval unless the manufacturer provides clear evidence that the original approval remains valid, and outlines critical factors and examples of cyber-relevant actions. It details documentary evidence expected from manufacturers regarding functional descriptions, connections with original vehicle types, added components and functions, and arguments demonstrating negligible intrinsic risk.

Proposal to amend para. 5.3.2. to require notification of assessment methods and criteria including paras. 8.2. and 8.3., insert new paras. 8.2. and 8.3. establishing criteria for equipment installation without further assessment, and amend Annex 1 to require disclosure of equipment excluded from assessment pursuant to paras. 8.2. and 8.3. The amendments clarify that equipment with negligible intrinsic cyber security risk installed according to manufacturer specifications and not introducing cyber security risk, and standard non-automotive equipment connected solely for power supply with no increased cyber security risk, shall not invalidate approval of the original vehicle type under UN Regulation No. 155.

Proposal to amend UN R155 by inserting new para. 5.1.3.(e) establishing that the Certificate of Compliance for the Cyber Security Management System shall not be issued by a different Approval Authority than the one granting type approval, and amend UN R156 by inserting new para. 5.4. establishing that Approval Authorities shall not grant type approval if the Certificate of Compliance for the Software Update Management System has not been issued by the same Approval Authority granting type approval. Justification includes ensuring holistic cybersecurity assessment, clarifying reporting obligations under para. 7.2.2.2.(g), addressing unharmonized mutual recognition of management system certificates, maintaining consistency between regulations, and upholding the fundamental principle that approval authorities retain responsibility for all aspects of type approval.

The UN IWG on Cyber Security and OTA held its 38th session 29 June–1 July 2026 in London with remote participation. The group adopted the provisional agenda and minutes from the 37th session. Three items from the IWG were presented at the May GRVA meeting: multistage vehicle documents to become working documents for September; RXWIN documents with elements in square brackets to be resolved; and SUMs document returned for further discussion. For R155, the group agreed to forward multistage amendment proposals as working documents to September GRVA. The UK proposal on STU and component approval for R155 was discussed extensively; the UK will draft a proposal for components only. The UK proposal on remote operation for ADS requires further development. The group will review ADS GTR cyber and software provisions. RXWIN proposal documents were adapted; R155 was removed and R89 and R156 sections amended; reviewers may address concerns by 31 July 2026. Germany’s proposal requiring the same Type-Approval Authority for CSMS and vehicle type approval was discussed; a dedicated meeting will be scheduled. The UK proposal on approvals for out-of-scope vehicle types was introduced. Draft Terms of Reference were revised and will be forwarded to GRVA for September approval. The next meeting is scheduled for 3 September 2026, 12:00–15:00 CET.

The document presents vehicle modification use cases categorized into four cases and additional scenarios. Case 1 covers components with negligible risk or cyber-relevant non-automotive devices. Case 2 addresses cyber-relevant automotive devices approved to specific regulatory requirements, requiring installation approval and vehicle type re-approval. Case 3a addresses cyber-relevant devices not approved to specific requirements, requiring component or STU approval. Case 3b covers devices controlling vehicle functions, also requiring component or STU approval. Case 4 encompasses invasive modifications or complex interactions not covered by other cases.

Proposal to insert provisions on software identification and software updates into UN R13, UN R13-H, UN R79, UN R89, UN R130, UN R131, UN R152, UN R156, UN R157, UN R171, UN R175, and UN R178 by adding definitions referencing Consolidated Resolution R.E.3 Annex 7, requiring manufacturers to provide Technical Services with information on hardware and software influencing performance, permitting vehicle manufacturers to apply for new approvals differentiating software versions for registered versus new vehicles, clarifying that production discontinuation does not apply when manufacturers seek approval extensions for software updates of registered vehicles, and amending communication forms to include software identification numbers and related information.

The Informal Working Group on Cyber Security and Software Updates will continue to consider how cyber security and software updates have a bearing on automotive safety and security, and whether any changes are necessary to the Regulations and guidance it has produced under WP.29. In particular, the IWG shall maintain official documents regarding UN R155, UN R156, and Recommendations on uniform provisions concerning cyber security and software updates; develop amendments to relevant documents; develop a proposal to amend UN Regulations under the responsibility of GRVA to record details of an RXSWIN where applicable which have been mandated by the 01 series of UN Regulation No. 156; develop proposals to amend UN Regulation No. 155 and its interpretation document to support application in national/regional frameworks for aspects such as multi-stage manufacturing; consider and develop deliverables regarding software updates after registration potentially creating a proposal for modification to the type approval numbering or a classification of update categories; support and review the application of cyber security and software update provisions across GRs notably for the Global Technical Regulation on Automated Driving Systems; and provide opportunities to participants to share knowledge, experience and ideas from implementation of national regulation/standards regarding CS/OTA as well as UN R155 and R156. The IWG will continue its activities until November 2029.

Amend para. AI to replace the heading “Examples of documents/evidence that could be provided” with “Explanation of the requirement” and insert text stating that Part C of this document provides further guidance on the application of the Regulation to vehicles which have been modified by carrying out a transformation of the vehicle.

CLEPA welcomes questions raised by Japanese experts under doc TFCS-37-06 and identifies points requiring further clarification regarding component and STU type approval scope, technical integration, STU definition, implementation, risk assessment, impact and benefit, and post-market monitoring. CLEPA proposes that components or STUs required for initial vehicle type approval under Part I should not be subject to separate approval under Part II, noting that vehicle cybersecurity depends on vehicle-level system interactions and E/E architecture, the OEM has full visibility of system architecture, and Part I approval ensures integrated assessment.

Proposal to add para. 3.2.3.1. requiring manufacturers to provide additional information on the Cyber Security Management System at request of the Approval Authority when the Certificate of Compliance for CSMS is issued by a different Approval Authority, add para. 5.1.5. allowing the Approval Authority to refuse type approval if insufficient information on the CSMS and its implementation was provided, and add para. 7.4.1.1. requiring all granting Approval Authorities to be included in reporting when different Approval Authorities are used for the Certificate of Compliance for CSMS and type approval of the vehicle type.

The agenda includes review of proposals for amendments to R155 concerning multistage vehicles, separate technical units and component approval, approval-authority requirements for CSMS CoC and vehicle type approval, and remote operation for ADS; review of cyber and software requirements in the ADS Regulation based on WP.29/2022/60 as amended by WP.29/2023/87; discussion of RXWIN application amendments; and consideration of terms of reference renewal ahead of mandate expiration in November 2026.

A comprehensive cyber security risk assessment without gaps between Parts I, II, and III is required for component or separate technical unit approval. Risk assessment is difficult for manufacturers alone; contracts are required to share vulnerability information. Identification of realistic installation use cases, information sharing between approval authorities, and clarification of responsibilities are necessary. Components with no communication to the vehicle or only mechanical and power connection do not require new approval. Components sending data to the vehicle or controlling it require Part II approval and joint risk analysis by the original equipment manufacturer and installer.

Answers to questions on separate technical unit approvals under UN R155 clarify that a base vehicle must already hold an R155 type approval before an ESA can be added at Part III; approval authorities for different parts may differ with mutual recognition applying; the end of support period for an ESA manufacturer must be communicated to the vehicle manufacturer, with implications to be discussed by the IWG; installation of ESAs must follow vehicle manufacturer instructions without necessarily requiring separate agreement; STU data sharing agreements are required; and after ESA installation, a whole vehicle cyber security risk assessment is not necessary, though Part III must consider risks where ESA and base vehicle interactions occur. A working document is planned for submission to GRVA in January 2027. The IWG will explore whether Part II components may include equipment from certificated base vehicles under UN R155 multi-stage categorization and discuss incorporating STU into original approvals.

Questions address whether minimum vehicle architecture approval should be required before Part III can be used for additional devices; whether approved ESAs can be incorporated in original vehicle approval or as an extension to Part I approval; whether different terminology should replace CSMS for Part III approvals; whether second Part III approvals are permissible for vehicles already approved to Parts I and III; and what implications arise from end-of-support by ESA manufacturers.

Vehicles of categories M₁, N, O, R, S and T may fall out of scope of UN R155 or UN R156 if they lack ECUs or do not permit software updates. Approval authorities currently make individual determinations regarding whether vehicles are in or out of scope, and justification for out-of-scope decisions must be recorded to ensure vehicles remain out of scope during the lifetime of whole vehicle approval. UN Regulation No. 10 provides precedent by allowing approvals for vehicles where certain equipment is not relevant. A similar provision could be incorporated into UN R155 and UN R156 by amending the scope and adding provisions to section 5 allowing manufacturers to obtain approvals for vehicles that do not permit software updates, with requirements of paragraph 7 not applying.

The document requests guidance on the legal basis for provisions within UN Regulations extending beyond the End-of-Production date and which authority such provisions address. Examples include UN R171 requirements for manufacturers to demonstrate safety management systems to the Type Approval Authority every three years and report annually on Driven Coded Auxiliary System operation until production is discontinued, and UN R155 requirements for Cyber Security Management Systems to apply to the post-production phase when vehicles remain operational but are no longer produced. The document poses an additional question regarding vehicle safety when manufacturers cease operations and cannot fulfill post-deployment safety provisions.

The CS/OTA Task Force held its thirty-seventh session on 21-22 April 2026 by video conference. The group adopted the provisional agenda and minutes from the thirty-sixth session. Discussions addressed proposals for amendments to UN R155 concerning multi-stage vehicle approvals and separate technical units, for which a subworking group was established. Proposals were also considered on type approval authority responsibility for cyber security management systems and remote operation of automated driving systems. The group reviewed cyber and software requirements in the ADS GTR and WP.29/2022/60 as amended by WP.29/2023/87, and discussed application of RXSWIN to UN Regulations, selecting option 2 for presentation to GRVA with R155, R156, and R89 square bracketed. The IWG mandate renewal was discussed, with potential new items including component and STU approval and software numbering proposals.

China supports establishing a new task force or informal working group on vehicle data security and sees the need for a dedicated UN Regulation or Global Technical Regulation. Work can begin with applicability analysis of existing regulations, gradually establishing the main framework of the standard, the scope of data management, and handling of special cases. China is ready to act as a key contributor, offering typical use cases, design questionnaires based on GB 44497 and GB 44464, delivering terms of reference with other Contracting Parties, and proposing basic framework and specific requirements by February 2028.

The Informal Working Group on Cyber Security and Software Updates discussed amendments to UN R155 and UN R156 for multi-stage approval, including simplified handling for low-risk devices and clarification of intrinsic cyber risk assessment. The group reviewed proposals from GRVA-25-31 and GRVA-25-32 concerning continued validity of approvals and Certificate of Compliance issuance. A Sub-Working Group was established to develop component and separate technical unit approval concepts. Pending discussion include RXSWIN application to components, STUs, and the extent of application to UN R155 and UN R156, and type-approval numbering for software updates.

Proposal to insert new Part C providing guidance on application of UN R155 to transformed vehicles. Part C defines when transformations require new approval, establishes terminology for original vehicle types, transformed vehicle types, transformations, and installations, identifies cyber-relevant transformations by evaluating impact on architecture and connection risks, addresses intrinsic cyber security risks, clarifies non-automotive equipment requirements, and specifies documentary evidence manufacturers must provide to approval authorities or technical services, including functional descriptions, connection details, software modifications, and component lists.

Proposal to amend UN R155 regarding cyber security assessment and approval procedures:

• Amend para. 5.3.2. to require approval authorities to notify other approval authorities of methods and criteria used to assess measures taken in accordance with the Regulation
• Insert new para. 8.2. to exclude equipment with negligible intrinsic cyber security risk from further assessment where installation does not impinge on the cyber security management system and is connected exclusively via an approved interface
• Insert new para. 8.3. to exclude standard domestic, business or industrial equipment connected only for power from further assessment where the equipment is unmodified and complies with applicable regional and national cyber security requirements
• Amend Annex 1 to include any equipment excluded from assessment pursuant to paras. 8.2. and 8.3.

Proposal to insert provisions on software identification and software updates into UN R13, UN R13-H, UN R79, UN R89, UN R130, UN R131, UN R152, UN R155, UN R156, UN R157, UN R171, UN R175, and UN R178 by adding definitions referencing Consolidated Resolution R.E.3 Annex 7, requiring manufacturers to provide Technical Services with information on hardware and software influencing performance, permitting vehicle manufacturers to apply for new approvals differentiating software versions for registered versus new vehicles, clarifying that production discontinuation does not apply when manufacturers seek approval extensions for software updates of registered vehicles, and amending communication forms to include software identification numbers and related information.

Proposal to amend UN R155 and UN R156 regarding approval authority requirements:

• Add a refusal ground to para. 5.1.3. of UN R155 where the Certificate of Compliance for the Cyber Security Management System has not been issued by the same approval authority granting type approval
• Insert new para. 5.4. into UN R156 to provide that approval authorities shall not grant any type approval if the Certificate of Compliance for the Software Update Management System has not been issued by the same approval authority granting type approval.

Germany proposes that the TAA granting UN R155 or UN R156 type approvals shall be obliged to only use CSMS or SUMS certificates signed by the same TAA. Issues identified include that CSMS and SUMS are Management Systems covering entire manufacturers’ organizations, mandating the same TAA will have huge consequences for OEMs using multiple TAAs, and no such obligation exists for ISO 9001 and ISO 14001. A possible way forward in the short term is to keep text unchanged to allow different TAAs for Management Systems CoC and type approval based on voluntary acceptance and implement wording on information exchange and procedure if different TAAs involved.

Proposal to amend UN R155 by clarifying its scope to exclude certain equipment. The proposal amends paragraph 5.3.2. to require approval authorities to notify others of assessment methods and criteria. New paragraphs 8.2. and 8.3. establish that vehicle manufacturer installation of equipment with negligible intrinsic cyber security risk, or standard domestic, business or industrial equipment connected only for power, shall not require further assessment under paragraph 7, provided specified criteria are justified. Annex I is amended to include any equipment excluded from assessment pursuant to paragraphs 8.2. and 8.3.

The UN IWG on Cyber Security and OTA will meet April 21-22, 2026 via video conference. The agenda includes adoption of the provisional agenda and minutes from the previous session, proposals for amendments to UN R155 and its interpretation document regarding multistage vehicles and type approval authorities, review of cyber and software requirements in the ADS Regulation, discussion of RXSWIN application, renewal of the IWG mandate expiring November 2026, and confirmation of next steps.

The Informal Working Group on EV/HFCV Retrofit Systems held its seventh meeting on 5th March 2026. The group adopted the provisional agenda, approved minutes of the previous meeting, and acknowledged ongoing activities under GRPE, GRSP and GRVA. Electrical safety review will continue once clarification regarding UN R100 is available. Cybersecurity discussions covered very old vehicles, older vehicles without cybersecurity provisions, and modern vehicles compliant with UN R155. Braking aspects and the structure of the draft UN Regulation were discussed, including vehicle versus system approval approaches and minimum and maximum vehicle age within the regulation’s scope.