When Cybersecurity Becomes a Condition for Type-Approval: What UN R155 Teaches Compliance Teams

Since July 2024, a car can no longer be registered in the European Union unless its manufacturer demonstrates — certified by a third party — a cybersecurity management system active across the vehicle's entire lifecycle. This is not a guideline: it is a type-approval condition, introduced by UN Regulation No. 155 (UN R155) and made binding in the EU through the vehicle type-approval regulation. It is one of the first cases on an industrial scale where "manage cyber risk in a demonstrable way" stops being good practice and becomes a legal requirement for staying on the market — a model that other risk-based regulatory regimes, starting with the AI Act, invite comparison with.

What UN R155 Actually Says

UN R155 — "Uniform provisions concerning the approval of vehicles with regards to cyber security and cyber security management system" — is a regulation adopted under UNECE (World Forum for Harmonization of Vehicle Regulations, WP.29) in June 2020 and in force since 22 January 2021. The base text was developed through several documents from the same working session (including ECE/TRANS/WP.29/2020/79, /94 and /97), a detail that signals how much the final outcome is the result of negotiation among multiple contracting parties, not a text imposed from above.

It applies to vehicles of categories M and N (passenger and goods) and, if fitted with at least one electronic control unit, also to category O (trailers). The regulation rests on two distinct pillars: a Cybersecurity Management System (CSMS) certificate at organizational level — the manufacturer must demonstrate structured cyber risk management processes — and a cyber type-approval at the level of the individual vehicle type, which verifies how those processes translated into concrete design requirements. Approving a model without a certified CSMS is simply not possible.

The Core of the Regulation: Managing Risk Across the Entire Lifecycle

What makes UN R155 an interesting case study even outside the automotive sector is not the list of technical requirements, but the time span over which they apply. The CSMS does not certify a one-off check at release: it requires demonstrable processes of risk identification, treatment, testing, monitoring and incident response across the vehicle's entire life— from design to production, through to the end of post-sale support. It is a "by design and by default" logic applied to the cybersecurity of a complex physical product, with a type-approval authority that verifies the organization before even the individual product.

How It Becomes Law in Europe

UN R155 originates at UNECE level and, in principle, applies to all contracting parties to the 1958 Agreement that notify its adoption — more than fifty jurisdictions, not only European ones. In the European Union it becomes a binding type-approval obligation through Regulation (EU) 2019/2144 (the so-called "General Safety Regulation 2", GSR2), which repeals the previous regime (Regulation (EC) 661/2009 and related acts) and builds on the general type-approval and market surveillance framework set out in Regulation (EU) 2018/858. The deadlines are staggered: compliance required for new vehicle types from July 2022, extended to all new registered vehicles from July 2024.

One clarification is worth making, because an improper reference often circulates in public discussion: Commission Implementing Regulation (EU) 2022/1426, which concerns the type-approval of automated driving systems (ADS) for fully automated vehicles — commonly referred to in industry parlance as "level 4" driving, even though this is not the technical wording used by the EU text — cites UN R155 and R156 only as supporting procedural references (for example, holding the CSMS certificate or complying with software update procedures). This is not the regulation that introduces the general CSMS obligation: that source remains Regulation 2019/2144.

The Role of ISO/SAE 21434

UN R155 establishes a regulatory obligation, but it is not an engineering manual: for that reason it refers, as a technical evaluation benchmark, to the standard ISO/SAE 21434:2021("Road vehicles — Cybersecurity engineering"), jointly published by ISO and SAE International on 31 August 2021. Type-approval authorities use it as a basis to assess whether the processes described in a manufacturer's CSMS are actually sound from an engineering standpoint — a pattern common to many risk-based regimes: the law sets the obligation and the scope, the technical standard gives measurable substance to the "how."

Why It Matters Even If You Don't Make Cars

The reason a compliance officer or product security manager outside the automotive sector should look at UN R155 is not the technical content, but the pattern: a regulator turns a risk management framework into a market access condition, certifies the organization (not just the product), extends it across the entire lifecycle, and makes it cascade, contractually, down the supply chain — component manufacturers and Tier 1/Tier 2 suppliers find themselves having to demonstrate compatible risk management practices, even without being direct addressees of the legal obligation.

It is the same conceptual pattern that the AI Actapplies to high-risk AI systems, where a risk management system is an explicit legal requirement (Art. 9), not an option. This needs to be said clearly: it is an analogy between risk-based regulatory regimes, not a legal equivalence — the two regulations have distinct legal bases, enforcement authorities and certification mechanisms. But for anyone who has to build from scratch a legally mandated "by design" risk management system, UN R155 is a concrete precedent of what a type-approval authority ends up demanding in practice, once an abstract regulatory principle becomes a verifiable obligation.

Key takeaway: a legally mandated risk management framework is judged on three things — who has to get certified (the organization, not just the product), over what time span (the entire lifecycle, not the release), and who else in the supply chain gets pulled into the obligation. UN R155 answers all three, which is why it is a reference worth studying even outside the automotive sector.

Sources

UN Regulation No. 155 (UNECE/WP.29, adopted June 2020, in force since 22/01/2021); Regulation (EU) 2019/2144; Regulation (EU) 2018/858; ISO/SAE 21434:2021; Commission Implementing Regulation (EU) 2022/1426 (cited only as context on ADS type-approval).