Vehicle cybersecurity rules and what they require

Why it matters

UN Regulations 155 and 156 require carmakers to manage cybersecurity and software updates across the vehicle lifecycle. In the EU and other markets that apply them, compliance is a condition of type approval for new vehicles.

Compliance requires cybersecurity to be part of engineering from concept to decommissioning. Manufacturers must show how risks are assessed, how vulnerabilities are monitored and how updates are delivered safely throughout the vehicle's life.

What's changing

• Manufacturers need a certified cybersecurity management system covering development, production and the period after production.
• Software update management must be documented and controlled.
• Requirements flow down to suppliers through contracts and evidence requests.

How leaders are responding

• Aligning engineering processes with ISO/SAE 21434.
• Monitoring vehicles in the field for emerging threats and vulnerabilities.
• Building supplier assessments into sourcing decisions.

What good looks like

• A certified cybersecurity management system covering the whole vehicle lifecycle
• A vehicle security operations centre monitoring the fleet
• Supplier contracts that require timely vulnerability fixes

What to watch

• Extension of similar requirements to more vehicle categories and markets.
• Software bill of materials expectations from manufacturers.
• Vehicle security operations centres that monitor fleets.

Where to start