The UN IWG on Cyber Security and OTA held its 38th session 29 June–1 July 2026 in London with remote participation. The group adopted the provisional agenda and minutes from the 37th session. Three items from the IWG were presented at the May GRVA meeting: multistage vehicle documents to become working documents for September; RXWIN documents with elements in square brackets to be resolved; and SUMs document returned for further discussion. For R155, the group agreed to forward multistage amendment proposals as working documents to September GRVA. The UK proposal on STU and component approval for R155 was discussed extensively; the UK will draft a proposal for components only. The UK proposal on remote operation for ADS requires further development. The group will review ADS GTR cyber and software provisions. RXWIN proposal documents were adapted; R155 was removed and R89 and R156 sections amended; reviewers may address concerns by 31 July 2026. Germany’s proposal requiring the same Type-Approval Authority for CSMS and vehicle type approval was discussed; a dedicated meeting will be scheduled. The UK proposal on approvals for out-of-scope vehicle types was introduced. Draft Terms of Reference were revised and will be forwarded to GRVA for September approval. The next meeting is scheduled for 3 September 2026, 12:00–15:00 CET.

Proposal to insert provisions on Software Identification Numbers and software updates across UN R13, R13-H, R79, R89, R130, R131, R152, R155, R156, R157, R171, R175, and R178 by adding definitions referencing Consolidated Resolution R.E.3 Annex 7 paragraph 2, requiring manufacturers to provide Technical Services with information on hardware and software influencing performance with test reports, permitting vehicle manufacturers to apply for new approvals differentiating software versions for registered vehicles from new vehicles where type approval regulations are updated or hardware changes occur in series production with test duplication avoided where possible, clarifying that production is not considered definitively discontinued if manufacturers obtain subsequent extensions for software updates of registered vehicles, renumbering and inserting new items in approval communication annexes for R13SWIN, R13-HSWIN, R79SWIN, R89SWIN, R130SWIN, R131SWIN, R152SWIN, R155SWIN, R157SWIN, R171SWIN, R175SWIN, and R178SWIN information including whether held on vehicle and relevant parameter identification lists, and amending R157 and R171 to align software update requirements with R156 technical specifications and transitional provisions.

Proposal to amend para. 3.5.1. in Annex 3 to require the manufacturer to demonstrate to the Type Approval Authority at least every three years that the safety management system continues to comply with requirements for software and hardware employed in the system to manage safety and continued compliance throughout the product lifecycle. This amendment resolves outstanding issues in the 01 series of amendments to UN Regulation No. 171.

Proposal to establish a Guidance and Interpretation document supporting implementation of the proposed UN Global Technical Regulation and UN Regulation on Automated Driving Systems. The document, based on informal document GRVA-25-20 reviewed at GRVA’s twenty-fifth session, provides draft guidance as of the seventeenth GRVA Workshop on ADS (27 April–1 May 2026), with restructuring and refinement expected for submission to GRVA at its twenty-sixth session (14–18 September 2026), to facilitate interpretation of ADS requirements, provide evidence guidance, and harmonize application across manufacturers, authorities, and inspection bodies.

Proposal to amend UN R155 by inserting new para. 5.1.3.(e) establishing that the Certificate of Compliance for the Cyber Security Management System shall not be issued by a different Approval Authority than the one granting type approval, and amend UN R156 by inserting new para. 5.4. establishing that Approval Authorities shall not grant type approval if the Certificate of Compliance for the Software Update Management System has not been issued by the same Approval Authority granting type approval. Justification includes ensuring holistic cybersecurity assessment, clarifying reporting obligations under para. 7.2.2.2.(g), addressing unharmonized mutual recognition of management system certificates, maintaining consistency between regulations, and upholding the fundamental principle that approval authorities retain responsibility for all aspects of type approval.

Proposal to amend para. 5.3.2. to require notification of assessment methods and criteria including paras. 8.2. and 8.3., insert new paras. 8.2. and 8.3. establishing criteria for equipment installation without further assessment, and amend Annex 1 to require disclosure of equipment excluded from assessment pursuant to paras. 8.2. and 8.3. The amendments clarify that equipment with negligible intrinsic cyber security risk installed according to manufacturer specifications and not introducing cyber security risk, and standard non-automotive equipment connected solely for power supply with no increased cyber security risk, shall not invalidate approval of the original vehicle type under UN Regulation No. 155.

Proposal to insert new Part C providing guidance for the application of UN R155 to transformed vehicles. Part C addresses identification of cyber-relevant transformations, impact on original vehicle architecture, connection risks, and impact on cyber security management systems. It specifies that transformations require new approval unless the manufacturer provides clear evidence that the original approval remains valid, and outlines critical factors and examples of cyber-relevant actions. It details documentary evidence expected from manufacturers regarding functional descriptions, connections with original vehicle types, added components and functions, and arguments demonstrating negligible intrinsic risk.

Proposal to amend para. 2.14. to insert a footnote clarifying that the road surface friction coefficient of 1 for sufficient nominal Peak Braking Coefficient (PBC) is understood to be a minimum value. This document is based on working document GRVA/2026/21 as amended by informal document GRVA-25-36.

Proposal based on informal document GRVA-25-43 to amend Annex 4, para. 3.5.1. to require the manufacturer to demonstrate to the Type Approval Authority at least every three years that the safety management system continues to comply with requirements for software and hardware employed in the system. This amendment applies the same principle regarding Safety Management System compliance as specified in UN Regulation No. 171 on Driver Control Assistance Systems.

Proposal to insert para. 3.2.2. requiring manufacturers of Automated Lane Keeping Systems active in multiple Contracting Party territories to provide information on traffic rules identification, territory-specific testing, and contact details, insert paras. 4.8. to 4.8.6. establishing procedures for granting approval authorities to inform and consult receiving approval authorities at least 30 days before approval, allow receiving authorities 30 days to comment on regulation interpretation, require dispute resolution under Article 10 and Schedule 6 of the 1958 Agreement, and insert footnote [Y] stating these provisions shall be kept under periodic review by GRVA for amendment as necessary.

Proposal to add examples to the guidance on reporting noncompliance with DDT performance requirements under para. 6, specifying that failures include systematic or repeated deviations from DDT performance requirements defined under para. 6, non-compliance with respect to DDT performance requirements and requirements on interactions between the ADS and its user or other requirements under para. 6, and deviation from Remote Interaction/Intervention as described in the Safety case, with a note that some examples can reveal unreasonable risk to safety requiring only a single report noting this aspect.

Proposal to modify the explanation on performance issues constituting an unreasonable risk to safety by specifying that this occurrence should be understood as deviations, degradations, or performance limitations shown by an ADS feature that affect its ability to perform the DDT within the declared ODD, triggered by events that present an unreasonable risk to safety and/or are beyond expected variability or acceptable degradation, replace “may” with “might” in references to discrete failures and risk existence, replace “Violation of” with “Non-compliance with respect to the”, delete references to identified reduction in safety margins and exceeding overall hazard exposure thresholds, replace “the rate of hazardous event occurrences” with “hazardous event exposure:”, and replace “suggests” with “could suggest”.

Agenda includes status of work on GTR and UNR proposals and the Guidance and Interpretation Document (GID), and proposals to resolve open items concerning:

• The baseline document integration of GTR provisions,
• Introduction to the GID,
• Terms and definitions,
• ADS operational states,
• DDT requirements,
• Other ADS requirements,
• Safety of interactions between the ADS and its user(s),
• Safety cases and their assessment,
• SMS requirements and their assessment,
• Test environment requirements and their assessment,
• In-service monitoring and reporting requirements and related annexes,
• Approvals and related annexes,

Proposal to renumber paragraph 2.2. as paragraph 2.25., amend definitions 2.6.–2.11. to clarify automatically commanded steering function categories not part of Driver Control Assistance Systems, insert new footnote 2 explaining approval routes, delete definition 2.25., amend definitions 2.18., 2.20., 2.35., 2.45., 2.51., 2.64., 2.65., insert new definitions 2.12., 2.71.–2.81., amend paragraphs 5.3.1., 5.3.2., 5.3.3. to add rollover events and AEBS triggers, amend paragraphs 5.4.3. and 6.1., insert transitional provisions in paragraphs 12.12.–12.16. effective from the official entry into force date until 1 September 2033, amend Annex 1 and Annex 4 Table 1 to add and modify data elements including Engine throttle and Accelerator pedal as separate elements, Pre-Event Synchronization Timer, Trigger activated, ACPE, ADDW, DDAW, Blind spot monitoring system, Turn signal, DCAS, Emergency stop signal status, and Time to collision, with adjusted recording intervals and sample rates.

Proposal to amend UN R18, UN R39, UN R46, UN R55, UN R58, UN R67, UN R73, UN R93, UN R97, UN R102, UN R105, UN R107, UN R110, UN R116, UN R121, UN R122, UN R125, UN R144, UN R147, UN R151, UN R158, UN R159, UN R160, UN R161, UN R162, UN R163, UN R166, UN R169, UN R176, UN R181, UN R182 and UN R183:

• Add new paragraphs defining Software Identification Number by reference to Consolidated Resolution on the Construction of Vehicles (R.E.3) Annex 7, para. 2,
• amend paragraphs concerning production discontinuation to clarify that production is not considered definitively discontinued if vehicle manufacturers intend to obtain subsequent extensions of approval for software updates of vehicles already registered in the market,
• add new paragraphs requiring manufacturers to provide Technical Services with information on all hardware and software having an influence on performance,
• add new paragraphs allowing vehicle manufacturers to apply for new vehicle approvals to differentiate software versions for vehicles already registered in the market from those for new vehicles,
• add new paragraphs to approval forms requesting additional information regarding software identification and software updates, including whether Software Identification Number is held on the vehicle and relevant parameters for identification of vehicles that can be updated with the represented software.

The proposal revises para. 7.2.1.4.1. to replace the original text on personnel competencies with revised text that focuses on demonstrating confidence in personnel competence to support appropriate use of simulation results rather than prescribing specific qualifications, role profiles, or individual assessment criteria. Documentation may be supported through organisational or system-level arrangements including defining responsibilities, identifying knowledge and skills needed, providing training and supervision, maintaining records of experience and qualifications, and providing evidence of accreditations and management systems.

Proposal to delete the interpretation in para. 7.2.1.9.1. The Testing sub-group decided not to provide additional guidance regarding approaches for criticality. The topic is already covered in the Guidelines and Recommendations for ADS Safety (WP.29/2024/39). Several options were proposed but none achieved consensus, and potential compromise solutions did not provide a worthwhile addition on top of existing guidance already available in WP.29/2024/39.

Proposal to delete text from the draft Introduction section of the Guidance and Interpretation Document on ADS Regulation. The formal submission to GRVA produced in June was based on the Workshop information document that contained additional explanations on the status of work. These contents are not appropriate for the final version of the Guidance and Interpretation Document.

Proposal to clarify in the introductory text that the document does not limit requirements or introduce new requirements, update the reference to WP.29 adoption of the Regulations under the 1958 and 1998 Agreements, and add explanation that interpretation examples are not exhaustive, definitive, or compulsory and that each safety case must be tailored to the characteristics of the automated driving system, its features, their operational design domain, and assessed on its own merits.

Proposal to delete the final sentence of the Introductory Text of the GID, which states “Nonetheless, the amendments to these other regulations, including those that enable performance of the DDT, are outside the scope of the ADS regulations and of this document.” The deletion removes redundant language already conveyed in the preceding text that modifications of other regulations related to ADS are outside the scope of this document.

Proposal to replace “all entirely” with “solely” in the Introduction.

Proposal to specify GTR number 26 and UN Regulation number 185 to the Introductory Text.

Proposal to simplify text on AV screening in the GID Introduction section. The revised text condenses the explanation that AV screening amendments to WP.29 Regulations are outside the scope of the GID. The original lengthy paragraph explained WP.29’s screening process, task forces, and technical requirements for systems such as braking, steering, and lighting. The revised text concisely states that WP.29 has updated its regulations concerning aspects of the DDT to enable their application to ADS vehicles, and these AV-related amendments are outside the scope of this document.

Proposal to add an interpretation of the term “other road user” in para. 2.21. of Definitions. The proposal defines “other road user” (ORU) as any entity making use of publicly accessible road infrastructure, covering users making intentional use of roadways with knowledge of traffic rules and other sentient entities that might be found in vehicle paths but cannot be expected to respond predictably based on vehicle signals or traffic rules, such as children and animals. The safety case would address both classes of ORU with appropriate adaptation to account for lower predictability of child and animal behaviours where relevant to the ODD of an ADS feature. The proposal was withdrawn for reconsideration during the further development of GTR 26 and UN Regulation 185.