UN Regulation No. 155
UN Regulation No. 155: uniform provisions concerning the approval of vehicles with regard to cyber security and cyber security management system
UN Regulation No. 155 makes cybersecurity a condition of vehicle type approval. Adopted under the UNECE 1958 Agreement, it entered into force on January 22, 2021, and the European Union is a contracting party that applies it from that date. A manufacturer needs a Certificate of Compliance for its Cyber Security Management System (CSMS), valid for up to three years, and must show for each vehicle type that it has assessed the risks in the regulation's Annex 5 and applied proportionate mitigations, several of which are access control and privilege controls. In the EU it has applied to new whole-vehicle type approvals from July 6, 2022 and to existing type approvals from July 7, 2024, according to the UK Vehicle Certification Agency's summary of EU dates.
Who it applies to
Vehicle manufacturers seeking type approval for vehicles of categories M (passenger) and N (goods), category O trailers fitted with at least one electronic control unit, and L6 and L7 vehicles with automated driving from level 3. Only vehicle manufacturers can hold the approval, but they must manage supplier-related risks, so requirements cascade to suppliers.
Identity requirements
- Run a Cyber Security Management System covering development, production and post-production, with processes to identify, assess, categorize and treat risks, test cybersecurity, and monitor for, detect and respond to cyber attacks (paragraph 7.2)
- Hold a valid Certificate of Compliance for the CSMS for the vehicle type, renewed after a positive assessment at the end of each period of up to three years (paragraphs 6.7, 6.10 and 7.3.1)
- Apply access control techniques and designs to protect system data and code (Annex 5 mitigation M7) and prevent unauthorized personnel from reaching personal or system-critical data (M8)
- Employ measures to prevent and detect unauthorized privileged access, such as root access (M9), and define and control user roles and access privileges on the principle of least access privilege (M18)
- Verify the authenticity and integrity of messages the vehicle receives (M10) and protect stored cryptographic keys, for example with hardware security modules (M11)
- Implement measures to detect and prevent cyber attacks, support monitoring, and provide data forensic capability, and report monitoring results to the approval authority at least once a year (paragraphs 7.3.7 and 7.4.1)
How it impacts identity systems
| Identity area | Impact |
|---|---|
| Privileged access (PAM) | Annex 5 requires measures to prevent and detect unauthorized privileged access and to control user roles on least privilege, which covers diagnostic, developer and back-end administrator access to vehicles. |
| Authentication & MFA | Vehicles must verify the authenticity and integrity of received messages and protect cryptographic keys, which puts machine identity and key management on the type-approval checklist. |
| Identity governance (IGA) | Insider threats such as staff abusing privileges on back-end servers are listed threats, so manufacturers need governed access to the systems that talk to vehicles. |
| Audit, logging & accountability | Manufacturers must log data to support detection and forensic analysis of attacks and report monitoring outcomes to the approval authority at least yearly. |
Penalties
Approval authorities refuse type approval when the requirements are not met, may withdraw the CSMS certificate if its requirements stop being met or the manufacturer's annual reporting is insufficient, and may withdraw a vehicle type approval if the regulation's requirements are not complied with.
Status and dates last verified against primary sources on 2026-11-05.
UN Regulation No. 155: frequently asked questions
- What identity controls does UN R155 require?
- R155 is risk based, but its Annex 5 lists mitigations that manufacturers must apply where relevant, including access control techniques to protect system data and code (M7), preventing unauthorized access to personal or system-critical data (M8), preventing and detecting unauthorized privileged access (M9), verifying message authenticity (M10), protecting cryptographic keys (M11) and least-privilege user roles (M18).
- When did UN R155 become mandatory in the EU?
- The UK Vehicle Certification Agency lists the EU dates for unlimited series M and N vehicles as July 6, 2022 for new whole-vehicle type approvals and July 7, 2024 for existing type approvals. For EU small series and special purpose vehicles, the dates are July 6, 2024 for new approvals and July 7, 2026 for existing approvals.
- How long is a CSMS certificate valid?
- A Certificate of Compliance for a Cyber Security Management System stays valid for up to three years unless withdrawn. At the end of that period the approval authority can issue a new certificate or extend it for a further three years after a positive assessment.