UN Regulation No. 156
UN Regulation No. 156: uniform provisions concerning the approval of vehicles with regards to software update and software updates management system
UN Regulation No. 156 makes a managed, secure software update process a condition of vehicle type approval. It entered into force on January 22, 2021, and the European Union is a contracting party that applies it from that date. A manufacturer needs a Certificate of Compliance for its Software Update Management System (SUMS), valid for up to three years, and each vehicle type must protect the authenticity and integrity of software updates and protect its RX Software Identification Numbers (RXSWIN) against unauthorized modification. EU application is phased: the UK Vehicle Certification Agency lists dates from July 6, 2022 for new whole-vehicle type approvals where manufacturers update type-approved characteristics after registration, through July 7, 2029 for new completed vehicles. Amendments were notified to the UN depositary on June 12, 2026.
Who it applies to
Vehicle manufacturers seeking type approval for vehicles of categories M, N, O, R, S and T that permit software updates.
Identity requirements
- Protect the authenticity and integrity of software updates to reasonably prevent their compromise and reasonably prevent invalid updates (paragraph 7.2.1.1)
- Show that updates are protected against manipulation before the update process starts and that the update processes, including the update delivery system, are protected against compromise (paragraphs 7.1.3.1 and 7.1.3.2)
- Make each RXSWIN uniquely identifiable and readable through a standard interface such as the OBD port, and protect RXSWINs and software versions on the vehicle against unauthorized modification (paragraph 7.2.1.2)
- Keep an auditable register, for every RXSWIN, of all relevant software before and after an update, including integrity validation data (paragraph 7.1.2.3)
- For over-the-air updates that need a skilled action, let the update proceed only when a person skilled to do it is present or in control (paragraph 7.1.4.2)
- Hold a Certificate of Compliance for the SUMS, valid for up to three years unless withdrawn (paragraph 6.6)
How it impacts identity systems
| Identity area | Impact |
|---|---|
| Authentication & MFA | Software updates must be protected for authenticity and integrity, and the update delivery system against compromise, which brings update signing and the systems that deliver updates into the type approval. |
| Privileged access (PAM) | The update delivery system itself must be protected against compromise, so access to signing keys and update infrastructure is a privileged access problem. |
| Audit, logging & accountability | An auditable register per RXSWIN records every software version and its integrity validation data before and after each update. |
Penalties
Approval authorities refuse type approval when the requirements are not met and can withdraw the SUMS certificate or an approval if requirements stop being met.
Status and dates last verified against primary sources on 2026-11-05.
UN Regulation No. 156: frequently asked questions
- What is an RXSWIN?
- An RX Software Identification Number is a manufacturer-defined identifier for the type-approval-relevant software of an electronic control system. Under R156 each RXSWIN must be uniquely identifiable, readable through a standard interface such as the OBD port, and protected against unauthorized modification.
- How does UN R156 relate to UN R155?
- R155 requires a cybersecurity management system and protections for the vehicle type; R156 covers the process for updating vehicle software securely and safely. Both are dated Geneva, 24 June 2020, entered into force on January 22, 2021, and are applied together in EU type approval.
- Does UN R156 apply to over-the-air updates?
- Yes. It adds requirements for over-the-air updates, including assessing whether an update during driving affects safety, being able to restore the previous version or reach a safe state after a failed update, and ensuring enough power to complete the update.