Guides / UNECE R155 vs R156

UN R155 vs R156: cyber security and software update compared

Last updated 2026-11-01 · Based on the UNECE texts of UN Regulations No. 155 (incl. Supplements 1–3) and No. 156 · ~8 min read

UN Regulation No. 155 (cyber security) and UN Regulation No. 156 (software update) were adopted together and both entered into force on 22 January 2021. They are separate approvals with separate management-system certificates. This page compares them side by side, with paragraph references, so engineering and homologation teams can see which evidence belongs where.

Key facts
  • R155 asks for a CSMS (Cyber Security Management System); R156 asks for a SUMS (Software Update Management System).
  • Each needs a Certificate of Compliance for the management system, valid for a maximum of 3 years, plus a vehicle type approval.
  • R155's scope now includes category L (Supplement 3, 10 Jan 2025); R156 covers M, N, O, R, S and T.

Side-by-side comparison

UN R155: Cyber securityUN R156: Software update
Full titleUniform provisions concerning the approval of vehicles with regards to cyber security and cyber security management systemUniform provisions concerning the approval of vehicles with regards to software update and software update management system
DocumentE/ECE/TRANS/505/Rev.3/Add.154E/ECE/TRANS/505/Rev.3/Add.155
Entry into force22 January 202122 January 2021
ScopeVehicles of categories L, M, N and O, if fitted with at least one electronic control unit (scope as amended by Supplement 3, in force 10 Jan 2025; the original text covered M, N, O with an ECU and L6/L7 with automated driving functions from level 3)Vehicles of categories M, N, O, R, S and T that permit software updates (para. 1.1)
Management systemCSMS, Cyber Security Management System (para. 2.3): a risk-based approach to processes, responsibilities and governance for cyber threats to vehiclesSUMS, Software Update Management System (para. 2.5): processes and procedures to deliver software updates in line with the Regulation
Lifecycle coveredDevelopment, production and post-production phases (para. 7.2.2.1)Processes 7.1.1.1 to 7.1.1.12, records for every update (7.1.2), security (7.1.3), over-the-air processes (7.1.4)
Certificate of ComplianceFor the CSMS (para. 6, model in Annex 4); valid for a maximum of 3 years (para. 6.7)For the SUMS (para. 6); valid for a maximum of 3 years (para. 6.6)
If the certificate expiresTreated as a modification of the vehicle type approval; the authority may withdraw the approval if conditions are no longer met (para. 6.11)Existing vehicle type approvals do not lose validity (para. 6.10)
Application must includeDescription of the vehicle type, documentation, the CSMS Certificate of Compliance (para. 3.2.3)Description of the vehicle type (Annex 1), the SUMS Certificate of Compliance (para. 3.5), a representative vehicle (para. 3.6)
Vehicle type requirementsValid CSMS certificate (7.3.1); supplier risks managed (7.3.2); exhaustive risk assessment (7.3.3); mitigations, incl. Annex 5 Parts B and C (7.3.4); protection of aftermarket software environments (7.3.5); testing before approval (7.3.6); detect and prevent attacks, support monitoring, forensic data (7.3.7); cryptographic modules in line with consensus standards (7.3.8)Authenticity and integrity of updates protected (7.2.1.1); where RXSWIN is used, each RXSWIN uniquely identifiable and readable at least via the OBD port (7.2.1.2); for over-the-air updates: recovery or safe state if an update fails, enough power, user informed, preconditions checked (7.2.2)
Key artefactsRisk assessment against the Annex 5 threat catalogue; mitigation evidence; test results; monitoring and incident response recordsRXSWIN (para. 2.2) and its auditable register; per-update records; integrity validation data (para. 2.11)
Ongoing dutyReport monitoring results to the approval authority at least once a year (para. 7.4.1)Keep records for every software update, including an auditable register for every RXSWIN (para. 7.1.2)
Approval testDocument checks (para. 5.1.1) plus testing of a vehicle of the type (para. 5.1.2)Testing of a vehicle of the type, by sampling, to verify the documented measures (para. 5.1.1)
EU applicationListed in the General Safety Regulation (EU) 2019/2144: EU type-approval refused from 6 July 2022 and registration refused from 7 July 2024 for non-compliant vehicles (Annex II, row D4, date code B)Listed as item H2 "Software update" in Annex II to Regulation (EU) 2018/858. Check EUR-Lex for the dates that apply to your vehicle category.

R155 amendments so far

Amendment to R155Entry into forceWhat changed (summary)
Supplement 18 Oct 2022Transitional wording in para. 7.3.1 for type approvals first issued before 1 July 2024: where the type could not be developed in compliance with the CSMS, show that cyber security was adequately considered during development
Supplement 25 Jan 2024Amended the Annex 5 threat and mitigation entries on spoofing of messages (examples now include V2X and GNSS messages)
Supplement 310 Jan 2025Extended the scope to category L vehicles fitted with at least one ECU; transitional wording for L-category types first approved before 1 July 2029

We found no supplements to R156 in the UNECE addenda list when we checked. Always confirm the current consolidated text on the UNECE pages linked below.

Steps to prepare

  1. Check scope per market. Confirm vehicle categories (R155: L, M, N, O with an ECU; R156: M, N, O, R, S, T that permit software updates) and which contracting parties or regional rules apply.
  2. Build both management systems. R155 needs a CSMS covering development, production and post-production; R156 needs a SUMS with the 7.1.1 processes. Many teams run them with shared governance, but they are certified separately.
  3. Get the two Certificates of Compliance. Each is valid for a maximum of 3 years. Put renewal dates in your calendar; an expired CSMS certificate counts as a modification of the vehicle type approval.
  4. Do the vehicle-type work. R155: risk assessment against Annex 5, mitigations, supplier risk evidence, testing. R156: RXSWIN definition, update integrity protection, over-the-air safety measures.
  5. Prepare the documentation package. Both regulations ask for documents in triplicate and a formal documentation package used as the reference for the approval.
  6. Plan post-approval duties. R155 annual monitoring report; R156 records for every update and an auditable RXSWIN register.

Free sample and checklists

Download the free sample (16 checklist items, 4 each from R100, R10, R155 and R156) to see the format. The full UNECE EV Certification Readiness Checklists have 67 bilingual (EN/中文) items, including 18 for R155 and 15 for R156, each with evidence to prepare, a section reference and a suggested owner.

AI-assisted content. This guide was drafted with AI assistance from the official texts listed under Sources. It has not been reviewed by a lawyer, homologation engineer or other qualified professional and is not legal or certification advice. Always read the current official text before relying on it. How we use AI. 本文由 AI 辅助根据官方原文整理,未经律师或认证工程师审核,不构成法律或认证意见,请以官方最新文本为准。

Sources (official)

  1. UN Regulation No. 155: Cyber security and cyber security management system, UNECE page
  2. UN R155 text (E/ECE/TRANS/505/Rev.3/Add.154), UNECE PDF
  3. UN R155 Supplement 1, UNECE PDF
  4. UN R155 Supplement 2, UNECE PDF
  5. UN R155 Supplement 3, UNECE PDF
  6. UN Regulation No. 156: Software update and software update management system, UNECE page
  7. UN R156 text (E/ECE/TRANS/505/Rev.3/Add.155), UNECE PDF
  8. Regulation (EU) 2019/2144 (General Safety Regulation), EUR-Lex
  9. Regulation (EU) 2018/858 (type-approval framework), EUR-Lex

UN R155 与 R156 对比(中文摘要)

R155(网络安全)和 R156(软件升级)均于 2021 年 1 月 22 日生效,是两项独立认证。R155 要求网络安全管理体系 CSMS,R156 要求软件升级管理体系 SUMS;两者的体系符合性证书有效期均最长 3 年。R155 经第 3 号补充件(2025 年 1 月 10 日生效)范围扩展至装有 ECU 的 L 类车辆;R156 适用于允许软件升级的 M、N、O、R、S、T 类车辆。R155 要求每年至少一次向认证机关报告监测结果;R156 要求记录每次升级并维护可审核的 RXSWIN 清单。在欧盟,R155 列入《通用安全法规》(EU) 2019/2144。最后更新 2026-11-01;AI 辅助整理,未经认证工程师审核,请以 UNECE 官方文本为准。