UNECE R155 and R156 Compliance: Cyber Security and Software Update Management

Since July 2024, all new vehicles produced in 54 countries worldwide cannot be registered without certification under UN Regulations No. 155 (Cyber Security Management System - CSMS) and No. 156 (Software Update Management System - SUMS). Non-compliance results in immediate revocation of vehicle Whole Vehicle Type Approval (WVTA), halting factory production lines completely.

The RXSWIN Regulatory Mechanism for In-Field Software Tracking

Under UNECE R156, a vehicle's Whole Vehicle Type Approval (WVTA) is legally bound to a Regulation X Software Identification Number (RXSWIN). When an OEM issues an OTA update that alters emissions parameters, steering braking characteristics, or lighting output, the update must either declare full backwards compliance under the existing RXSWIN, or trigger a formal Type Approval Extension before being flashed. An unauthorized OTA update automatically voids the vehicle's registration in 54 countries.

CSMS Organization Audit: Verifying OEM cybersecurity governance across design, testing, production, and post-production.
SUMS Process Certification: Mandatory RXSWIN (Regulation X Software Identification Number) tracking on all ECUs.
72-Hour Zero-Day Reporting: Legal requirement to notify national type approval authorities upon detecting active cyberattacks.
Cryptographic OTA Traceability: Generating immutable cryptographically signed audit logs for every remote firmware flash.

Explore Domain Portfolio