The CS/OTA Task Force held its thirty-seventh session on 21-22 April 2026 by video conference. The group adopted the provisional agenda and minutes from the thirty-sixth session. Discussions addressed proposals for amendments to UN R155 concerning multi-stage vehicle approvals and separate technical units, for which a subworking group was established. Proposals were also considered on type approval authority responsibility for cyber security management systems and remote operation of automated driving systems. The group reviewed cyber and software requirements in the ADS GTR and WP.29/2022/60 as amended by WP.29/2023/87, and discussed application of RXSWIN to UN Regulations, selecting option 2 for presentation to GRVA with R155, R156, and R89 square bracketed. The IWG mandate renewal was discussed, with potential new items including component and STU approval and software numbering proposals.

The Informal Working Group on Cyber Security and Software Updates discussed amendments to UN R155 and UN R156 for multi-stage approval, including simplified handling for low-risk devices and clarification of intrinsic cyber risk assessment. The group reviewed proposals from GRVA-25-31 and GRVA-25-32 concerning continued validity of approvals and Certificate of Compliance issuance. A Sub-Working Group was established to develop component and separate technical unit approval concepts. Pending discussion include RXSWIN application to components, STUs, and the extent of application to UN R155 and UN R156, and type-approval numbering for software updates.

Proposal to insert provisions on software identification and software updates into UN R13, UN R13-H, UN R79, UN R89, UN R130, UN R131, UN R152, UN R155, UN R156, UN R157, UN R171, UN R175, and UN R178 by adding definitions referencing Consolidated Resolution R.E.3 Annex 7, requiring manufacturers to provide Technical Services with information on hardware and software influencing performance, permitting vehicle manufacturers to apply for new approvals differentiating software versions for registered versus new vehicles, clarifying that production discontinuation does not apply when manufacturers seek approval extensions for software updates of registered vehicles, and amending communication forms to include software identification numbers and related information.

Proposal to amend para. 5.1.3. of UN R155 to add a refusal ground where the Certificate of Compliance for the Cyber Security Management System has not been issued by the same approval authority granting type approval, and insert new para. 5.4. into UN R156 to provide that approval authorities shall not grant any type approval if the Certificate of Compliance for the Software Update Management System has not been issued by the same approval authority granting type approval. The proposal, based on TFCS-37-02, ensures that Certificates of Compliance and type-approvals for UN R155 and UN R156 are issued by the same approval authority to enable holistic assessment and clarify reporting obligations.

The UN IWG on Cyber Security and OTA will meet April 21-22, 2026 via video conference. The agenda includes adoption of the provisional agenda and minutes from the previous session, proposals for amendments to UN R155 and its interpretation document regarding multistage vehicles and type approval authorities, review of cyber and software requirements in the ADS Regulation, discussion of RXSWIN application, renewal of the IWG mandate expiring November 2026, and confirmation of next steps.

Germany proposes that the TAA granting UN R155 or UN R156 type approvals shall be obliged to only use CSMS or SUMS certificates signed by the same TAA. Issues identified include that CSMS and SUMS are Management Systems covering entire manufacturers’ organizations, mandating the same TAA will have huge consequences for OEMs using multiple TAAs, and no such obligation exists for ISO 9001 and ISO 14001. A possible way forward in the short term is to keep text unchanged to allow different TAAs for Management Systems CoC and type approval based on voluntary acceptance and implement wording on information exchange and procedure if different TAAs involved.

Proposal to amend UN R13, 13-H, 79, 89, 130, 131, 139, 140, 152, 155, 156, 157, 171, 175, and 178 by introducing provisions on software identification and software updates. Amendments add new paragraphs referring to Software Identification Number definitions in Consolidated Resolution R.E.3, require manufacturers to provide Technical Services with information on hardware and software influencing performance, permit vehicle manufacturers to apply for new approvals differentiating software versions for registered versus new vehicles while avoiding test duplication, and modify production discontinuation provisions to exclude cases where manufacturers seek approval extensions for software updates of registered vehicles.

Proposal to amend the Interpretation Document for UN R156. The document clarifies requirements in paragraph 7 and Annex 1 concerning software update and software update management systems to promote uniform assessments and align with the 01 series of amendments. The document provides non-mandatory guidance for demonstrating compliance with UN R156 requirements through documentation, presentation, and audit, with supporting reference to ISO 24089:2023. The proposal addresses processes for software updates after vehicle registration, including assessment of compliance impacts, documentation procedures, security measures, over-the-air update safeguards, and vehicle user notification requirements.

Proposal to amend UN R155 and UN R156 to require that Certificates of Compliance for Cyber Security Management Systems and Software Update Management Systems be issued by the same approval authority that grants type approval. Germany reported a case where different authorities issued the certificate and type approval, creating assessment and enforcement issues. The proposal aims to ensure holistic cyber security evaluation and align both regulations.

UN R156 requires administrative provisions under the 1958 Agreement to demonstrate that vehicles comply with its requirements at specific points in time, not solely at market placement. The action plan involves developing a numbering system for amending approval extensions to account for software updates, considering how updates impact existing type approvals, and reviewing related 1958 Agreement aspects.

Proposal to update the Interpretation Document to reflect provisions introduced by the 01 series of amendments to UN R156.

Proposal to update the declaration of compliance and the certificate of compliance to identify the series of UN R156 under which the documents were issued.

Proposal to amend Appendix 1 to Annex 1 to insert heading “Annex 1 – Appendix 1” and amend the model of declaration of compliance for Software Update Management System Manufacturers to reference paragraph 7.1 of UN Regulation No. 156, and amend Annex 4 to insert headings “CERTIFICATE OF COMPLIANCE FOR” and “SOFTWARE UPDATE MANAGEMENT SYSTEM” in the model of Certificate of Compliance for Software Update Management System with the 01 series of amendments to Regulation No. 156.

Proposal to update the declaration of compliance and Certificate of Compliance models to communicate the relevant series of amendments to ensure alignment between the management systems and the corresponding requirements of UN R156.

Proposal from the CS/OTA informal group to update the interpretation document pursuant to amendments introduced via the 01 series of amendments to UN R156.

Proposal to update provisions concerning implementation of RxSWIN software identification numbers.

Dynamic vehicle characteristics are (data) elements of a vehicle that keep changing during its lifecycle.

Proposal to introduce a mapping of requirements and references to ISO 24089:2023 (“Road vehicles – Software update engineering”) where such referencing may aid the understanding and/or implementation of UN Regulation No. 156 requirements.

Proposal to update provisions concerning implementation of RxSWIN software identification numbers.

Proposal to introduce a mapping of requirements and references to ISO 24089:2023 (“Road vehicles – Software update engineering”) where such referencing may aid the understanding and/or implementation of UN Regulation No. 156 requirements.

Proposal to introduce a mapping of requirements and references to ISO 24089:2023 (“Road vehicles–Software update engineering”) where such referencing could aid the understanding and/or implementation of UN R156 requirements.

Proposal to mandate the use of RXSWIN for vehicle types, and introduce transitional provisions allowing Contracting Parties to phase out the first registration of vehicles that do not use RXSWIN by 2028.

Proposals harmonising vehicle onboard authorisation concept and data privacy.

Proposal to amend RE3 to align with UN R156 and other regulation requirements for use of the RxSWIN identification number.

Commission Delegated Regulation (EU) 2022/2236 of 20 June 2022 amending Annexes I, II, IV and V to Regulation (EU) 2018/858 of the European Parliament and of the Council as regards the technical requirements for vehicles produced in unlimited series, vehicles produced in small series, fully automated vehicles produced in small series and special purpose vehicles, and as regards software update.

Proposal to update the interpretation document for UN R156 regarding newly available international standard on software update engineering for road vehicles.

Proposal drafted by the Secretariat pursuant to GRVA deliberations to date.

Comments regarding terms “development phase”, “production phase” and “post-production phase”.

Email (.msg format) raising a question on the application of UN R156 to noise requirements under UN R51with regard to possible risk of deviation from limits resulting from a software update.

The purpose of this document is to help clarify the requirements of paragraph 7 and Annex 1 of the UN Regulation on uniform provisions concerning the approval of vehicles with regards to software update and software updates management system (ECE/TRANS/WP.29/2020/80) and provide information on what may be used to evidence those requirements.

Proposal to remove Category R, S, and T vehicles unintentionally included in the scope of the regulation.

Proposal to permit the use of a software identification system that differs from the RxSWIN established under UN R156 on software updates. (This proposal corresponds with a proposal to amend UN R156).