Two UN regulations sit behind most modern car cybersecurity paperwork, and both come with certificates that expire. R155 covers cyber security management systems; R156 covers software update management systems. Each certificate is valid for a maximum of three years, and authorities can check continued compliance in between.
R155 pushes manufacturers to identify, assess and treat cyber threats across development, production and post-production, then keep monitoring vehicles already on the road. R156 governs software updates: recording hardware and software versions, verifying integrity, judging whether a change affects safety or type approval, and handling the mechanics of an over-the-air install, including power, recovery and user notification.
Under the EU’s General Safety Regulation, the requirements applied to new vehicle types from July 2022 and to all relevant new vehicles from July 7, 2024. Great Britain brought R155 and R156 into its own type-approval framework through the Road Vehicles (Type-Approval) (Amendment) (No. 3) Regulations 2025, with the first mandatory deadline for new types of complete and base vehicles falling on June 1, 2026. Compliance is a renewal cycle, not a one-off filing.
The threat data supports the approach. Upstream Security’s 2026 report counted 494 publicly reported automotive and smart mobility incidents during 2025, with 44% involving ransom and 67% originating in telematics and cloud environments.
R155 is a regulation and ISO/SAE 21434 is the engineering standard that supports it, a distinction often blurred in supplier questionnaires.
