GB type approval scheme: cyber-security and software update requirements

Question 1

Executive summary

Accepted Answer

Our vehicle standards are largely harmonised at an international level through the United Nations Economic Commission for Europe (UNECE). More precisely, through the World Forum for Harmonization of Vehicle Regulations (WP.29). Harmonisation of technical regulations promotes:

consistent road safety, security and environmental standards
facilitates international trade
reduces design, development and testing burdens for vehicle manufacturers

Under the UNECE’s 1958 agreement, we must accept vehicles and components type approved against a UN regulation that we apply even if issued by another contracting party or if we do not yet mandate it.

In 2021, WP.29 adopted 2 new UN Regulations that the UK decided to apply. These regulations provide uniform provisions concerning the approval of vehicles with regard to:

cyber-security and cyber-security management systems (R.155)
software updates and software update management systems (R.156)

Increasing vehicle connectivity and automation promotes road safety, reduces environmental impacts and optimises efficient travel. However, stringent regulation is required to protect against cyber-security threats and ensure the safe deployment of software updates.

We propose making approval for R.155 and R.156 compulsory for new vehicles under the GB vehicle type approval scheme.

Question 2

Introduction

Accepted Answer

This consultation seeks views on our proposal to mandate approval to 2 internationally recognised technical regulations under the GB type approval scheme.

These changes are necessary to ensure robust processes are in place for manufacturers to:

mitigate and manage cyber-security threats
safely deploy software updates
for new vehicles that enter the GB market

Under this proposal, we intend to:

make the approval mandatory for specific vehicle categories produced in unlimited and medium series under the GB type approval framework
outline the transitional arrangements for new vehicle types and registrations – giving manufacturers time to adapt processes to comply
introduce exemptions that reduce the administrative burden on manufacturers

We are calling for evidence on potentially extending these regulations to include L category (for example, motorcycles and quadbikes) and O category (for example, trailers) vehicles in the future and introduce additional enforcement measures to address these vehicles when in service.

Question 3

Background

Accepted Answer

The international harmonisation of technical vehicle regulations promotes road safety, increases environmental protection, supports market access and reduces manufacturer burden. This is done under the UNECE through its World Forum for Harmonisation of Vehicle Regulations (WP.29).

In 2021, WP.29 introduced 2 new technical regulations. As a contracting party to the 1958 agreement that establishes the rules and procedures of WP.29, we already accept vehicles approved to these regulations onto our roads.

UN Regulation No. 155 (R. 155) provides uniform provisions for manufacturers to assess and mitigate cyber-security threats at an organisational level and in the vehicle design phase by developing a cyber-security management system. This requirement extends throughout the vehicle’s life to ensure that emerging threats are continually monitored and managed.

Similarly, UN Regulation No. 156 (R.156) set out processes for manufacturers to develop a software management system to ensure the safe deployment of software updates while the vehicle is in use.

The increasing capability of modern conventional vehicles provides many benefits. Advanced automated features can increase road safety, while connectivity provides greater convenience for the user. However, stringent regulation is required to manage cyber-security threats and safely deploy software updates over the air (by wireless means).

By 2022, the EU had mandated R.155 (as item D4) and R.156 (as item H2) within its type approval framework. Manufacturers active in both the EU and GB markets are expected to use the same vehicle architectures to avoid production complexities.

Due to this, most manufacturers should already have in place management systems for cyber-security and software updates covering vehicles in GB. However, these regulations are currently not mandatory for all vehicles placed on the GB market.

Type approval is confirmation that production samples of a new vehicle type, system, component or separate technical unit meet safety and environmental requirements. The GB type approval scheme sets out technical regulations that are assessed by the Vehicle Certification Authority (VCA) before new vehicle types are placed on the market.

Approximately 75% to 80% of subject areas for passenger vehicles within the GB type approval scheme are agreed at the international level through the UNECE. As a contracting party, when a new vehicle or component is tested and approved to a UNECE Regulation, this is recognised by the approval authority of all other countries that apply that regulation. This process of mutual recognition facilitates trade and prevents repeat testing.

We are proposing to require approval to R.155 and R.156 for new vehicles registered or placed on the GB market under the GB vehicle type approval scheme. We are also seeking views on enhancing the application of R.155 and R.156 by increasing the vehicle categories within scope and implementing additional measures in the future.

Question 4

GB type approval scheme

Accepted Answer

During the UK’s membership of the EU, the safety and environmental requirements that most vehicles, and their parts, had to meet to be placed on the market or registered were set out in the EU type approval frameworks.

Following the UK’s withdrawal from the EU in 2021 and the end of the transition period, a provisional type approval scheme was introduced. This allowed vehicles approved under EU type approval to continue to be placed on the GB market without the need for double testing.

We have since introduced legislation to amend retained EU law to correct legal deficiencies. This established a permanent GB type approval scheme and included transition periods to phase out the provisional scheme for different vehicle categories.

The GB type approval scheme applies to manufacturers wishing to place or register whole vehicles and components in Great Britain on the market. The VCA is the sole type approval authority permitted to issue new GB whole vehicle type approvals. To obtain this, manufacturers must demonstrate compliance with all system and component approvals relevant to the vehicle type.

GB unlimited series

Vehicle types produced in quantities of over 1,500 units fall into the main route GB type approval scheme, referred to as the ‘unlimited series’. We intend to require approval to R.155 and R.156 for certain vehicle categories under the GB unlimited series.

Specifically:

R.155 and R.156 for category M vehicles, which are passenger vehicles and encompasses cars, minibuses, buses and coaches
R.155 and R.156 for category N vehicles, which are goods vehicles and encompasses vans, rigid trucks and tractor units
R.156 for category O vehicles, which are trailers.

Note

Although we are proposing to mandate approval to these regulations for specific vehicle categories, this is only required for R.155 if the vehicle is fitted with at least one electronic control unit and R.156 if the vehicle permits software updates.

Vehicles produced in unlimited volumes questions

Question 1: Do you agree or disagree that R.155 and R.156 should be mandatory for passenger vehicles (category M) produced under the GB unlimited series?

Question 2: Do you agree or disagree that approval to R.155 and R.156 should be mandatory for goods vehicles (category N) produced under the GB unlimited series?

Question 3: Do you agree or disagree that R.156 should be mandatory for trailers (category O) produced under the GB unlimited series?

Vehicles produced in limited volumes

Within GB type approval scheme, there are 2 routes for new vehicle types produced in limited volumes to demonstrate compliance with the necessary requirements to gain a whole vehicle type approval that allows them to be placed on the market.

GB medium series

The GB medium series applies to category M1 passenger vehicles and category N1 goods vehicles where less than 1,500 units are produced each year.

Category M1 vehicle is a passenger vehicle with not more than 9 seats including that of the driver. Category N1 is a goods vehicle with a maximum mass not exceeding 3.5 tonnes.

GB small series

The GB small series applies to all vehicle categories with production limits of either 250 or 500 units depending on the vehicle category.

Our proposal

The GB medium and small series approval schemes are intended to reduce the burdens on smaller manufacturers. They can be used to approve vehicles produced in limited numbers using simpler procedures or requirements to demonstrate compliance.

We intend to require approval for R.155 and R.156 under the GB medium series.

We have no intention to make this mandatory under the GB small series scheme.

Note

Although we are proposing to mandate approval to these regulations for specific vehicle categories, this is only required for R.155 if the vehicle is fitted with at least one electronic control unit and R.156 if the vehicle permits software updates.

Vehicles produced in limited volumes questions

Question 4: Do you agree or disagree that approval to R.155 and R.156 should be mandatory for the GB medium series?

Question 5: Do you believe there is a case to exclude certain vehicle categories or sectors from having to comply with R.155 and R.156 under the GB medium series?

Question 6: Do you agree or disagree with our proposal not to require approval to R.155 and R.156 for either of the national small series type approval (NSSTA) schemes (GB SSTA and UK(NI) SSTA)?

Individual vehicle approval

Under individual type approval, vehicles (such as kit cars) that are made, modified or imported in single or very small quantities are inspected and tested to a less onerous set of requirements to gain their whole vehicle approval. This is because these approvals are generally being sought by individual members of the public and there is a reduced degree of risk due to the numbers involved.

We are not proposing to require approval to R.155 or R.156 for individual type approval.

Individual vehicle approval question

Question 7: Do you agree or disagree with our proposal not to require approval to R.155 and R.156 for individual vehicle approvals?

Question 5

Vehicle sub-categories and other considerations

Accepted Answer

This section outlines our proposal for:

special purpose vehicles
vehicles approved in multiple stages
separate technical units and components

Special purpose vehicles

A special purpose vehicle is a sub-category of vehicles fitted with specific technical features enabling them to perform a function that requires special arrangements or equipment. In some instances, they are given exemptions or alternative requirements due to challenges with compliance as a result of their features.

We are not proposing any exemption or alternatives to requiring approval to R.155 and R.156 for special purpose vehicles listed below.

Approval to R.155 is only required for vehicles fitted with at least one electronic control unit and for R.156 this is only required for vehicles that permit software updates.

Table 1: list of special purpose vehicles

Special purpose vehicle	R. 155	R.156
Motor caravans, ambulances and hearses	M1 to M3	M1 to M3
Wheelchair accessible vehicles	M1	M1
Mobile cranes	N3	N3
Other special purpose vehicles	M2 and M3, N1 to N3	M2 and M3, N1 to N3, O1 to O4
Armoured vehicles	M1 to M3, N1 to N3	M1 to M3, N1 to N3, O1 to O4
Exceptional load vehicles	N3	N3, O4

Special purpose vehicles question

Question 8: Do you agree or disagree that for vehicle categories where it is proposed that approval to R.155 and R.156 should be mandatory it should remain so even if they are special purpose vehicles?

Vehicles built in multiple stages

The multi-stage build process refers to vehicles built in different stages by 2 or more manufacturers. Typically, this means each manufacturer would approve the aspects of their own stage before passing it on to the next manufacturer.

This may include situations where:

the vehicle chassis and bodywork are completed separately
a modification is made to a vehicle during production to provide additional features, such as a wheelchair lift

We are participating in ongoing discussions with multi-stage manufacturers, the VCA and UNECE contracting parties to understand the implications of R.155 and R.156 on the multi-stage industry. However, the proposal still expects multi-stage build vehicles to be compliant with R.155 and R.156 as applicable.

We welcome views from all first and subsequent-stage manufacturers on this topic. If you have additional feedback on the implementation of these UN Regulations for the multi-stage build process, submit this along with your response to: ivs.consult@dft.gov.uk.

Vehicles built in multiple stages questions

Question 9: Do you agree or disagree that approval to R.155 should be mandatory for multi-stage builds where modifications may affect the cyber-security system of the base vehicle?

Question 10: Do you agree or disagree that approval to R.156 should be mandatory for multi-stage builds that permit software updates?

Separate technical units and components

Components and separate technical units are type approved parts tested independently of a vehicle. This includes spare parts produced for a particular vehicle type.

The EU mandated approval to R.155 for separate technical units and components in 2022. However, there are no specific provisions relating to these under R.155, which focuses on the entire vehicle and associated processes.

Due to this, we believe that mandating R.155 for separate technical units and components may create confusion for the industry as it is not technically feasible. Therefore, we are not proposing them for inclusion at this time.

Separate technical units and components questions

Question 11: Do you agree or disagree that we should not require approval to R.155 for separate technical units and components?

Other considerations

Even though Great Britain and the EU now have separate type approval frameworks, the majority of the requirements are similar given the history and the basis of them tend to be UN Regulations. It is understood that this means that most manufacturers selling into Great Britain and the EU utilise the same model for both markets.

Consequently, since approval to R.155 and R.156 is already mandated in the EU, we expect that:

the majority of vehicles are already compliant
there is negligible costs to those businesses as a result of these proposals for those operating in GB and the EU

New vehicle types

To facilitate manufacturers in transitioning to the new regulations, we propose staggering the commencement of mandating R.155 and R.156. We expect this to be of most benefit to GB specific manufacturers, as most manufacturers that are active in the EU and GB markets are expected to use the same vehicle architecture that will be compliant already.

We propose to mandate approval to R.155 and R.156  for registration of vehicles considered as a new type of vehicles under GB type approval from 1 February 2026.

This avoids any issues with vehicles being classed as new types as they transition from the provisional type approval scheme to the permanent GB scheme as it will be phased out for all vehicle categories by then.

Vehicles built in a single stage

We propose that manufacturers have an additional 12 months after this date to ensure that any new vehicle built in a single stage (complete vehicles) is approved to R.155 and R.156 at the time of registration.

This will also apply to an incomplete vehicle to avoid any unnecessary delays to compliance.

Vehicles built in multiple stages

For the registrations of any new vehicles built in multiple stages (completed vehicles), we propose to separate the requirements and provide an additional 12 months (over and above that for complete vehicles) to have approval for R.155.

This is because it is considered a greater urgency to bring cyber-security requirements into effect than software management.

The date to have approval to R.156 at registration for any new completed vehicle is proposed to align with the date required in the EU.

Special purpose vehicles

Given the challenges that special purpose vehicles may encounter in complying with cyber-security requirements, additional time is proposed for requiring approval to R.155.

We propose to align the dates for R.155 and R.156 to the date when all new completed vehicles are required to have approval for R.156 at the time of registration. Therefore, providing an additional 12 months to comply with and gain approval for R.155.

Table 2: proposed date of effect

Registration type	Proposed date of effect for R.155	Proposed date of effect for R.156
New GB vehicle types	1 February 2026	1 February 2026
Complete^{[footnote 1]} vehicles	1 February 2027	1 February 2027
Completed vehicles	1 February 2028	7 July 2029
Special purpose vehicles	7 July 2029	7 July 2029

Transition period questions

Question 15: Do you agree or disagree that approval to R.155 and R.156 should be mandatory for new vehicle types from 1 February 2026?

Question 16: Do you agree or disagree that approval to R.155 and R.156 should be mandatory for the registration of complete vehicles, as well as incomplete vehicles, from 1 February 2027?

Question 17: Do you agree or disagree that for the registration of completed vehicles, approval should be mandatory for R.155 from 1 February 2028 and for R.156 from 7 July 2029?

Question 18: Do you agree or disagree that approval to R.155 and R.156 should be mandatory for the registration of special purpose vehicles from 7 July 2029?

Question 19: Do you agree or disagree that we should provide additional time for multi-stage manufacturers to gain approval to R.155 and R.156 within the GB medium series?

Question 7

Certificate of conformity

Accepted Answer

The certificate of conformity is a document issued by the manufacturer certifying a vehicle has been manufactured in conformity with its type approval standards. It shows that the vehicle complies with the relevant safety and environmental regulations and can be registered.

When a buyer is purchasing a new vehicle, the supplying dealer must provide this certificate to the buyer for free at the delivery stage. Although not a prerequisite for registration in Great Britain, it is an important document that can help when exporting a vehicle.

Under Article 36(1A) of Retained Regulation (EU) 2018/858, manufacturers are permitted to use the EU template of the certificate of conformity until 6 July 2026. After this date, all manufacturers must produce a GB certificate of conformity if registering or placing a vehicle on the GB market.

As R.155 and R.156 are compulsory in the EU, we expect most manufacturers already to record approval of these regulations. However, manufacturers that are only active in the GB market may require additional time to adapt IT systems and update the GB certificate of conformity to record approval of these new regulations.

We propose to permit all manufacturers to update GB certificates of conformity to record approval to R.155 and R.156 for new vehicle types within 12 months of these regulations applying for the registration of new vehicle types.

Certificate of conformity question

Question 20: Do you agree or disagree that amendment of the certificate of conformity to record approval to R.155 and R.156 should be compulsory from 1 February 2027?

Question 8

Exemptions and derogations

Accepted Answer

Recording compliance for trailers

Although trailers (category O vehicles) are within scope of R.155, the EU has not applied these cyber-security provisions to trailers as the cyber-security threat is deemed low.

Our assessment of the situation is the same, therefore, we do not plan to require trailers to comply with R.155 at this time.

Consequently, we do not intend to require trailer manufacturers to record any approval to R.155 on the GB certificate of conformity to reduce administrative burden.

We also propose to include a similar exemption for trailers with a maximum mass that does not exceed 3.5 tonnes (category O1 and O2) that are not capable of software updates. Manufacturers will not be required to record if there is no approval to R.156 on the GB certificate of conformity to reduce the administrative burden.

Recording compliance for trailers question

Question 21: Do you agree or disagree that we should reduce the administrative burden for manufacturers of trailers that are not in scope of our regulations?

End of series derogation

In certain circumstances, there may be special provisions within the GB type approval framework allowing manufacturers to apply to the VCA for a derogation.

An end of series derogation permits manufacturers wishing to sell and register certain vehicles that do not comply with newly applicable standards. This seeks to support manufacturers facing economic or technical difficulties in complying with new regulations by providing additional time to sell stocks made to the previous standards.

As these UN Regulations are mandatory within the EU, we anticipate most manufacturers will already comply with R.155 and R.156 and should not have significant stocks of non-compliant vehicles at this stage.

This means we are not including an end of series derogation for these regulations. However, we would like to gather views on where this may be needed for limited cases.

End of series derogation question

Question 22: Do you agree or disagree that we should permit certain manufacturers to sell leftover stocks of vehicles that may not be compliant with R.155 and R.156 when introduced for a specified time?

Question 9

Call for evidence

Accepted Answer

This section calls for evidence on the following aspects.

Application to L and O category vehicles

We intend to require 2 and 3-wheeled motorcycles and quadricycles, which are considered as category L vehicles, to comply with R.155 once they are brought into scope of the regulation.

Although trailers (category O vehicles) are in R.155 scope, we generally do not consider the risk significant enough for trailers to require R.155 approval. We may change this position if:

evidence indicates that this is no longer the case
it helps to align with other markets, such as the EU – should they mandate approval to R.155

Application to L and O category vehicle questions

Question 23: Do you agree or disagree that approval to R.155 should be mandatory for 2 and 3-wheeled motorcycles and quadracycles (category L vehicles) once they are brought in scope of the regulation?

Question 24: Do you agree or disagree that approval to R.155 should be mandatory for trailers (category O vehicles) if evidence suggests that it is required or if this becomes mandatory in other markets, such as the EU?

Additional enforcement measures

If a manufacturer is non-compliant with R.155 and R.156 when introduced (as proposed), action to correct this is limited. For example, withdrawal of type approval is an option but withdrawal would only prevent further sale of that vehicle type and would not address the non-compliant vehicles already in use.

We are considering the introduction of future enforcement measures to recall vehicles on our roads if there is a risk to cyber-security. This will allow us to force manufacturers to recall all in-service vehicles that pose a cyber-security risk, which will ensure public safety.

We also are considering further measures to prevent manufacturers from modifying software of type approved systems on vehicles post-registration so that it no longer conforms with its original or the latest type approval requirements.

Additional enforcement measures questions

Question 25: Do you agree or disagree with our proposal to introduce future enforcement measures to recall vehicles once in service if there is a risk to cyber-security?

Question 26: Do you agree or disagree with our proposal to introduce future enforcement measures to address post-registration software updates for vehicles that no longer comply with the original or latest type approval requirements?

Question 27: Provide any additional comments you may have on R.155 and R.156 for consideration about future amendments.

Question 10

How to respond

Accepted Answer

See the ways to respond section of the consultation page on GOV.UK to find out how you can respond to this consultation.

The consultation period began on 26 February 2025 and will until 28 April 2025. Ensure that your response reaches us before the closing date.

Question 11

Next steps

Accepted Answer

A summary of responses, including the next steps, will be published within 3 months of the consultation closing. Paper copies will be available on request.

If you have questions about this consultation, please contact:

GB type approval consultation
Department for Transport
Great Minster House
London SW1P 4DR

Alternatively, you can email: ivs.consult@dft.gov.uk.

Question 12

Full list of consultation questions

Accepted Answer

This section gives a guide to the questions we ask for this consultation. Provide supporting evidence where possible – particularly if you disagree.

Question 1: Do you agree or disagree that R.155 and R.156 should be mandatory for passenger vehicles (category M) produced under the GB unlimited series?

Question 2: Do you agree or disagree that approval to R.155 and R.156 should be mandatory for goods vehicles (category N) produced under the GB unlimited series?

Question 3: Do you agree or disagree that R.156 should be mandatory for trailers (category O) produced under the GB unlimited series?

Question 4: Do you agree or disagree that approval to R.155 and R.156 should be mandatory for the GB medium series?

Question 5: Do you believe there is a case to exclude certain vehicle categories or sectors from having to comply with R.155 and R.156 under the GB medium series?

Question 6: Do you agree or disagree with our proposal not to require approval to R.155 and R.156 for either of the national small series type approval (NSSTA) schemes (GB SSTA and UK(NI) SSTA)?

Question 7: Do you agree or disagree with our proposal not to require approval to R.155 and R.156 for individual vehicle approvals?

Question 8: Do you agree or disagree that for vehicle categories where it is proposed that approval to R.155 and R.156 should be mandatory it should remain so even if they are special purpose vehicles?

Question 9: Do you agree or disagree that approval to R.155 should be mandatory for multi-stage builds where modifications may affect the cyber-security system of the base vehicle?

Question 10: Do you agree or disagree that approval to R.156 should be mandatory for multi-stage builds that permit software updates?

Question 11: Do you agree or disagree that we should not require approval to R.155 for separate technical units and components?

Question 12: What, if any, other issues do you think there are with complying with the requirements outlined in R.155 and R.156?

Question 13: If manufacturers are required to gain approval to R.155 and R.156, in your view, do you think there would be additional burdens experienced by third parties including suppliers?

Question 14: For those manufacturers that have vehicles compliant with R.155 and R.156 due to sales in the EU, are there any additional costs associated with selling these vehicles in GB because of this proposal?