UN R155, UN R156 and ISO/SAE 21434: automotive cybersecurity and software updates explained

Last updated: 2026-10-22

Selling a connected vehicle, or a component that goes into one, into a UN 1958 Agreement market now means passing type approval on cybersecurity grounds, not just on crash safety. Two UN vehicle regulations make that happen: UN R155 requires a certified cybersecurity management system (CSMS), and UN R156 requires a certified software update management system (SUMS) covering over-the-air updates. The engineering standard manufacturers use to build and evidence the process behind both is ISO/SAE 21434. The three are related but distinct: one is the management-system law, one is the software-update law, and one is the voluntary engineering framework that helps satisfy them.

UN R155: the cybersecurity management system law

UN R155, "Uniform provisions concerning the approval of vehicles with regards to cyber security and cyber security management system," requires a vehicle manufacturer to hold a Cyber Security Management System (CSMS) certificate and, for each vehicle type seeking approval, to demonstrate that cybersecurity risks across the vehicle's lifecycle have been identified, assessed and appropriately mitigated. It was adopted by the UN World Forum for Harmonization of Vehicle Regulations (WP.29) under the 1958 Agreement and entered into force as an annex to that agreement on 22 January 2021.

Scope: UN R155 applies to vehicle categories M (passenger vehicles) and N (goods vehicles), category O vehicles fitted with at least one electronic control unit, and categories L6 and L7 (certain light vehicles) where they have automated driving functionalities of level 3 or above. It remains without prejudice to other UN regulations or regional/national rules on authorised-party access to the vehicle.

UN R156: the software update management system law

UN R156, "Uniform provisions concerning the approval of vehicles with regards to software update and software updates management system," is the companion regulation, also in force as a 1958 Agreement annex since 22 January 2021. It requires a Software Update Management System (SUMS): organisational processes for configuration control that record the hardware and software versions relevant to a vehicle type, including integrity validation data, plus protection of the update delivery mechanism to ensure authenticity and integrity.

Scope: UN R156 applies to vehicles of categories M, N, O, R, S and T that permit software updates, a broader category sweep than R155 because it covers any vehicle type designed to receive updates at all, including trailers and agricultural/forestry vehicles (R, S, T).

For over-the-air (OTA) updates specifically, UN R156 requires the vehicle to be able to restore the previous working state if an update fails, to execute updates only when there is sufficient power, to execute updates safely where safety-critical systems are affected, and to inform the user of each update, including whether it succeeded.

When each becomes mandatory: UN entry into force vs. EU application dates

It is easy to conflate two different dates here.

Date	What happens
22 January 2021	UN R155 and UN R156 enter into force as annexes to the 1958 Agreement, making them available for any contracting party to apply
6 July 2022	The EU's General Safety Regulation, Regulation (EU) 2019/2144, requires cybersecurity and software-update type approval for new vehicle types seeking EU type approval
7 July 2024	The same EU requirement extends to all new vehicles registered in the EU, regardless of when the vehicle type was originally approved

Regulation (EU) 2019/2144 explicitly anticipates this: its recitals note that the connectivity and automation of vehicles increase the risk of unauthorised remote access and illegal over-the-air software modification, and state that UN regulations or other regulatory acts on software-update processes should be applied on a mandatory basis as soon as possible after their entry into force. The UN regulations themselves are not automatically binding in every market; it is each contracting party's own domestic or regional law, such as the EU's General Safety Regulation here, that turns them into an enforceable market-access condition on a specific date.

ISO/SAE 21434: the engineering standard behind the management system

ISO/SAE 21434:2021, "Road vehicles — Cybersecurity engineering", was jointly published by ISO and SAE International, developed by ISO technical committee ISO/TC 22, Road vehicles, subcommittee SC 32, in collaboration with SAE's Vehicle Cybersecurity Systems Engineering Committee. It was published in its first edition on 31 August 2021 and formally cancels and supersedes the earlier SAE J3061 guideline.

Its own scope: it specifies engineering requirements for cybersecurity risk management across concept, product development, production, operation, maintenance and decommissioning of electrical and electronic (E/E) systems in road vehicles, including their components and interfaces, and defines a framework of cybersecurity processes and a common language for communicating and managing cybersecurity risk. It applies to series-production road vehicle E/E systems whose development or modification began after the standard's publication, and it does not prescribe specific technology or solutions.

How it relates to UN R155: ISO/SAE 21434 is voluntary, not itself the legal text of UN R155. In practice, it is the de facto engineering framework that manufacturers build their CSMS around and that auditors and approval authorities commonly reference when assessing whether a CSMS meets UN R155's risk-management expectations. No independently confirmed formal UN or EU citation making ISO/SAE 21434 the automatically sufficient means of UN R155 compliance could be found in the sources checked for this guide; treat any claim of automatic formal equivalence as to be confirmed with the relevant type-approval authority, rather than assumed.

How the three fit together

	UN R155	UN R156	ISO/SAE 21434
Nature	Binding UN vehicle regulation, applied via national/regional law	Binding UN vehicle regulation, applied via national/regional law	Voluntary engineering standard
Covers	Cybersecurity management system (CSMS) and per-type risk assessment	Software update management system (SUMS), including OTA conditions	Engineering process for managing cybersecurity risk across the vehicle lifecycle
Certifies	The manufacturer's CSMS, as a type-approval condition	The manufacturer's SUMS, as a type-approval condition	Not a certification scheme itself; informs the process behind both
EU mandatory from	6 July 2022 (new types), 7 July 2024 (all new vehicles)	Same General Safety Regulation mechanism	Not independently mandatory; adopted voluntarily

What vehicle and component makers should do now

Confirm which UN R155/R156 vehicle categories apply to your product: category and intended automated-driving level or update capability decide whether you are in scope at all.
Build (or buy into) a CSMS and SUMS before your next EU type-approval submission, not after; both are now a type-approval gate, not an optional add-on, for any vehicle type approved after the applicable date.
Use ISO/SAE 21434 as your engineering backbone for the CSMS, and treat it as living documentation an approval authority or Tier 1 customer may ask to review, not a one-off exercise.
Track component-level vulnerabilities and software versions the same way firmware teams in other sectors do; a vehicle's E/E architecture is, in security terms, a large connected-device fleet. See firmware SBOM for the component-inventory techniques that carry over directly.
Keep CSMS/SUMS evidence separate from, but cross-referenced to, any CRA or component-level IEC 62443 work your suppliers already do; see IEC 62443-4-1 secure development lifecycle for a comparable process-maturity standard in the industrial space.

SoftWSP builds component- and firmware-level SBOMs and vulnerability evidence that feed into a CSMS or SUMS audit trail: see device firmware security.

This guide is general information, not legal advice.

Frequently asked questions

What is UN Regulation No. 155 (UN R155)?

UN R155 is a United Nations vehicle regulation, adopted under the 1958 Agreement, titled 'Uniform provisions concerning the approval of vehicles with regards to cyber security and cyber security management system'. It requires a manufacturer to hold a certified Cyber Security Management System (CSMS) and to show, for each vehicle type, that cyber risks were assessed and mitigated, as a condition of type approval.

What is UN Regulation No. 156 (UN R156)?

UN R156 is the companion UN vehicle regulation on software updates, titled 'Uniform provisions concerning the approval of vehicles with regards to software update and software updates management system'. It requires a certified Software Update Management System (SUMS) covering configuration control, update delivery security, and specific conditions for over-the-air (OTA) updates, such as the ability to roll back a failed update and sufficient power before executing one.

When did UN R155 and R156 become mandatory in the EU?

UN R155 and R156 entered into force as annexes to the UN 1958 Agreement on 22 January 2021, which made them available for contracting parties to apply. The EU made them mandatory through its General Safety Regulation (EU) 2019/2144: from 6 July 2022 for new vehicle types seeking EU type approval, and extending to all new vehicles registered in the EU from 7 July 2024.

Does ISO/SAE 21434 certification satisfy UN R155?

ISO/SAE 21434:2021 is a voluntary engineering standard, not a law, and it is not itself the UN R155 legal text. In practice it is the framework manufacturers and auditors commonly use to build and evidence the cybersecurity engineering process that a UN R155 CSMS audit checks. No independently confirmed formal UN or EU citation naming ISO/SAE 21434 as automatically satisfying UN R155 could be found in the sources checked for this guide; treat formal-equivalence claims as to be confirmed with your type-approval authority.

Which vehicles are in scope of UN R155 and R156?

UN R155 applies to vehicle categories M and N, category O vehicles fitted with at least one electronic control unit, and categories L6 and L7 where equipped with automated driving functionalities of level 3 or above. UN R156 applies to vehicles of categories M, N, O, R, S and T that permit software updates.