Consultation outcome

GB type approval scheme: cyber-security and software update requirements – government response

Updated 16 September 2025

Introduction

The Department for Transport (DfT) sought views on our proposal to mandate approval of 2 internationally recognised technical regulations under the GB type approval scheme: 

• UN Regulation No. 155 (R.155) on cyber-security

• UN Regulation No. 156 (R.156) on software updates

Considering the feedback on the proposals in the consultation, we intend to: 

• revise the date for when new vehicle types must comply with R.155 and R.156 (1 June 2026)

• revise the date for when complete vehicles must comply with R.155 and R.156 (1 June 2027)

• revise the date for when completed vehicles must comply with R.155 (1 June 2028), but maintain the date for when they must comply with R.156 (7 July 2029 – to align with EU) 

• revise the date for necessary amendments to the certificate of conformity to become mandatory, to align with the revised date for compliance for all complete vehicles (1 June 2027)

Aims of the GB type approval scheme: cyber-security and software update requirements consultation

The consultation aimed to seek views on our proposal to mandate approval of 2 internationally recognised technical regulations under the GB type approval scheme, R.155 and R.156.

These changes are necessary to ensure that robust processes are in place for new vehicles entering the GB market. They require manufacturers to:

• mitigate and manage cyber-security threats
• safely deploy software updates

We sought views on the department’s proposals to:

• make the approval mandatory for specific vehicle categories produced in unlimited and medium series under the GB type approval framework
• outline the transitional arrangements for new vehicle types and registrations – giving manufacturers time to adapt processes to comply
• introduce exemptions that reduce the administrative burden on manufacturers

We also sought views on potentially extending these regulations to include L category (for example, motorcycles and quadbikes) and O category (trailers) vehicles in the future and introducing additional enforcement measures to address these vehicles when in service.

The call for evidence responses will not be discussed, but may be considered if any further regulatory action is taken.

Consultation responses

We received a total of 30 responses: 15 participants responded directly via the online survey, while the remaining 15 responded by email.

Some email responses did not follow the exact question format asked and presented their response differently from the survey.

Where appropriate, we have:

• categorised responses as agreed/disagreed (where possible) and combined the totals with the survey data
• considered those email responses in connection with the questions asked, where responses clearly align

About the respondents

Twenty-seven participants responded on behalf of organisations and 3 responses were received from private individuals.

Table 1: respondent type and number of responses

Respondent type	Number of responses
Private individual	3
Trade association	6
Vehicle manufacturer	5
Manufacturer of L category vehicles (motorcycles)	3
Manufacturer of multi-stage vehicles	4
Motor insurance	2
Tier 2 supplier	5
Other	2

Names of organisations have been omitted to maintain the privacy of individuals and potential sole traders.

Summary of responses

Vehicles produced in unlimited volumes

Category M (passenger cars) and N (goods vehicle)

The majority of the participants agreed with the policy intent to mandate R.155 and R.156 for both passenger and goods vehicles produced under the GB unlimited series.

Participants felt that not only does this help to protect against cyber-security threats and ensure the safe deployment of software updates, but it also helps to: 

• align the GB type approval to other parts of the world
• maintain a standard to prevent cyber-security and software risks

The dominant view was that most vehicle manufacturers sell vehicles globally and will, therefore, have implemented measures for compliance in other markets, or are aware of the measures required to meet these regulations.

Therefore, complying with the regulations will not be burdensome on those manufacturers.

Category O vehicles (trailers)

The majority of the participants agreed that R.156 should be mandatory for trailers produced under the GB unlimited series for the same reasons discussed above for mandating passenger and goods vehicles.

According to a trade association representing a number of manufacturers, many trailer manufacturers have contributed to the development of these UNECE Regulations. Also, most trailer manufacturers have likely already implemented measures for compliance in other markets or are aware of the measures required to meet these regulations.

Those who disagreed stated that there are only a few trailers that are currently available on the market that can receive software updates, and that it is not, therefore, necessary to mandate R.156 for trailers.

Further clarification on application of R.156 to trailers

As mentioned in the consultation, R.156 would only be required for vehicles that permit software updates, over-the-air or otherwise.

Trailers are becoming more technologically advanced, therefore, it is necessary to ensure that any software associated with them is updated in an appropriate and safe manner.

Vehicles produced in limited volumes

GB medium series and exclusions

A significant proportion of the participants, including manufacturers that would be potential users of the medium series, agreed with the proposal that approval to R.155 and R.156 should be mandatory for GB medium series. The dominant view was that the proposal is beneficial since it aligns with EU type approval.

There was an exceptional view from a vehicle manufacturer who stated that approval to R.155 should be mandatory for the GB medium series only, where a vehicle is fitted with a certain level of ADAS/ADS functionality to align with the EU small series type approval scheme.

There was no substantive evidence provided to support excluding any vehicle categories or sectors from complying with the GB medium series.

Further clarification on GB medium series and exclusions

The GB medium series approval scheme is available for M1 or N1 vehicle types where fewer than 1,500 units are produced each year. This aligns with scheme II of the EU small series approval scheme.

Scheme II of EU small series does not limit the application of R.155 or R.156. So, our proposal to require compliance for the GB medium series will maintain this alignment.

GB small series and Individual vehicle approval

The majority of the participants agreed not to require approval to R.155 and R.156 for either of the national small series type approval (NSSTA) schemes (GB SSTA and UK(NI) SSTA), as well as individual vehicle approvals (IVA).

The common theme of the responses was that mandating small series is not required, as the risks would be minimal.

Additionally, the costs and investments required to comply with these regulations would be more significant for those manufacturers that produce vehicles in small volumes, making it overly burdensome to comply.

Special purpose vehicles

The majority of the relevant participants (such as manufacturers and trade associations) agreed that, for vehicle categories where it is proposed, approval to R.155 and R.156 should remain mandatory even if they are special purpose vehicles (SPVs).

However, it was recommended that careful consideration should be given to each category of SPV to ensure that the regulatory burden imposed by mandating new regulations is proportionate to the volume of the type produced by the manufacturer.

Further clarification on special purpose vehicles

There is, however, no limited production mechanism for SPVs within the GB type approval framework. Therefore, the assumption has to be that they may be produced at a significant scale and so legislated accordingly.

Nevertheless, manufacturers may have the option to utilise the exemption being provided for the small series or IVA schemes, if their production volumes meet the criteria of those schemes.

Vehicles built in multiple stages

R.155 and R.156 (cyber-security and software requirements)

A significant proportion of participants, including manufacturers and trade associations representing multi-stage vehicles, agreed that: 

• approval to R.155 should be mandatory for multi-stage builds where modifications may affect the cyber-security system of the base vehicle 
• approval to R.156 should be mandatory for multi-stage builds that permit software updates

Transition period

New vehicle types and registration of incomplete, complete and completed vehicles

Although it was indicated that compliance with R.155 and R.156 for new vehicle types was possible by 1 February 2026 and it was predominantly supported, it was noted that it would only likely be possible for those who already have approval to the regulations for other regions.

The view of most manufacturers and trade associations was that to achieve compliance by this date was overly ambitious. They stated it would be extremely challenging for those needing to gain approval for the first time due to the technical complexity and the new nature of the requirements.

Participants also expressed concerns that it would put additional workload on VCA at a critical time, as it coincides with the date for mandating GB whole vehicle type approval for existing vehicle models. This led to apprehension about being unable to sell vehicles because they may not have received the necessary approvals from them.

Similar views regarding challenging timescales were expressed for:

• 1 February 2027 date for approval to R.155 and R.156 for any complete or incomplete vehicle
• 1 February 2028 date for any completed vehicle being approved to R.155

Although most manufacturers and associations disagreed with the dates, they generally supported the proposed timeframe with respect to the date at which compliance with R.155 and R.156 for new vehicle types would be mandated. This was 12 months for all complete and incomplete vehicles and 24 months for all completed vehicles.

All participants supported that approval should be mandatory for R.156 from 7 July 2029 for completed vehicles, as this aligns with the date in EU.

Registration of special purpose vehicles

The majority of the respondents agreed that approval to R.155 and R.156 should be mandatory for the registration of special purpose vehicles from 7 July 2029.

We did not receive any concerns about this or the intended date.

Certificate of conformity

The majority of the participants agreed that the amendments to the certificate of conformity to record approval to R.155 and R.156 should be compulsory in certain instances, but not from the outset.

This was more in connection with it occurring 12 months after the requirements applied for new type than the 1 February 2027 proposed. It was noted that sufficient time was needed to make changes in the administrative process of manufacturers to comply.

End of series derogation

The majority of participants agreed that we should permit manufacturers to sell leftover stocks of vehicles that may not be compliant with R.155 and R.156 for a specified time. They held the view that it is necessary as it removes unnecessary cost and burden on manufacturers.

Next steps

Nearly all of the proposals were supported by the majority of participants. The most notable point of contention raised by trade associations and manufacturers concerned the implementation dates for when the regulations would become mandatory.

Our proposals aimed to have a reasonably accelerated implementation of the requirements to promptly align with other equivalent markets. However, based on the responses received, we plan to amend the dates for compliance.

We intend to maintain the 12-month phasing of the implementation dates but with a revised starting point of the 1 June 2026 and, where proposed, the 7 July 2029 date being unchanged. This will mean that:

• new vehicle types must comply with R.155 and R.156 by 1 June 2026 
• all complete and incomplete vehicles must comply with R.155 and R.156 by 1 June 2027 
• all completed vehicles must comply with R.155 by 1 June 2028 and R.156 by 7 July 2029. 

The necessary amendments to the certificate of conformity will only become mandatory as of the date for compliance for all complete vehicles (1 June 2027).

To further alleviate pressure on British industry, we plan to allow more time than previously stated for multi-stage manufacturers to comply with the regulations. 

We intend not to require new types of completed vehicles to comply with R.155 and R.156 at the same time as other new vehicle types and only require that any completed vehicle must comply by the dates applicable for all registrations.

All other proposals will be taken forward, as presented in the consultation. A summary of the proposed revision to the application dates is given in the table below.

Table 2: proposed revision to implementation dates

Registration type	Original date of effect for R.155	Original date of effect for R.156	Revised date of effect for R.155	Revised date of effect for R.156
New GB vehicle types[footnote 1]	1 February 2026	1 February 2026	1 June 2026	1 June 2026
Complete and incomplete vehicles	1 February 2027	1 February 2027	1 June 2027	1 June 2027
Completed vehicles	1 February 2028	7 July 2029	1 June 2028	7 July 2029
Special purpose vehicles	7 July 2029	7 July 2029	7 July 2029	7 July 2029

List of questions and responses

Question 1: do you agree or disagree that R.155 and R.156 should be mandatory for passenger vehicles (category M) produced under the GB unlimited series? Provide supporting evidence where possible, particularly if you disagree.

Table 3: response to question 1

Respondent type	Answer	Total
Trade associations Vehicle manufacturers	Agree	24
Trade associations and manufacturers unrelated to category M vehicles	Don’t know	5
Individual	Disagree	1

Question 2: do you agree or disagree that approval to R.155 and R.156 should be mandatory for goods vehicles (category N) produced under the GB unlimited series? Provide supporting evidence where possible, particularly if you disagree.

Table 4: response to question 2

Respondent type	Answer	Total
Trade associations Vehicle manufacturers	Agree	24
Trade associations Vehicle manufacturers unrelated to category N vehicles	Don’t know	5
Individual	Disagree	1

Question 3: Do you agree or disagree that R.156 should be mandatory for trailers (category O) produced under the GB unlimited series? Provide supporting evidence where possible, particularly if you disagree.

Table 5: response to question 3

Respondent type	Answer	Total
Trade associations Vehicle manufacturers	Agree	15
Trade and motor insurance associations Vehicle manufacturers unrelated to category O vehicles	Don’t know/No response	11
Individuals Vehicle manufacturers Tier 2 suppliers	Disagree	4

Question 4: Do you agree or disagree that approval to R.155 and R.156 should be mandatory for the GB medium series? Provide supporting evidence where possible, particularly if you disagree.

Table 6: response to question 4

Respondent type	Answer	Total
Trade associations Vehicle manufacturers	Disagree	5
Tier 2 supplier	Agree	13
Trade associations Vehicle manufacturers unrelated to GB medium series approval	Don’t know	12

Question 5: Do you believe there is a case to exclude certain vehicle categories or sectors from having to comply with R.155 and R.156 under the GB medium series? Provide supporting evidence where possible, particularly if you disagree.

Table 7: response to question 5

Respondent type	Answer	Total
Trade associations and others	Disagree	6
Individuals L-category vehicle manufacturers Tier 2 suppliers	Agree	8
Other	Don’t know	16

Question 6: Do you agree or disagree with our proposal not to require approval to R.155 and R.156 for either of the national small series type approval (NSSTA) schemes (GB SSTA and UK(NI) SSTA)? Provide supporting evidence where possible, particularly if you disagree.

Table 8: response to question 6

Respondent type	Answer	Total
Trade associations Vehicle manufacturers Tier 2 supplier Individuals	Disagree	4
Vehicle manufacturers	Agree	18
Vehicle manufacturers and others	Don’t know/No response	8

Question 7: Do you agree or disagree with our proposal not to require approval to R.155 and R.156 for individual vehicle approvals? Provide supporting evidence where possible, particularly if you disagree.

Table 9: response to question 7

Respondent type	Answer	Total
Trade associations Vehicle manufacturers Tier 2 supplier Individuals	Disagree	4
Vehicle manufacturers	Agree	18
Vehicle manufacturers and others	Don’t know/No response	8

Question 8: Do you agree or disagree that for vehicle categories where it is proposed that approval to R.155 and R.156 should be mandatory, it should remain so even if they are special purpose vehicles? Provide supporting evidence where possible, particularly if you disagree.

Table 10: response to question 8

Respondent type	Answer	Total
Trade associations Multi-stage manufacturers Individuals	Disagree	3
Trade associations Vehicle manufacturers Tier 2 supplier	Agree	11
Vehicle manufacturers and others	Don’t know/No response	16

Question 9: Do you agree or disagree that approval to R.155 should be mandatory for multi-stage builds where modifications may affect the cyber-security system of the base vehicle? Provide supporting evidence where possible, particularly if you disagree.

Table 11: response to question 9

Respondent type	Answer	Total
Trade associations Multi-stage vehicle manufacturers Individual	Disagree	2
Trade associations Vehicle manufacturers Tier 2 supplier	Agree	17
Vehicle manufacturers and others	Don’t know/No response	11

Question 11: Do you agree or disagree that we should not require approval to R.155 for separate technical units and components? Provide supporting evidence where possible, particularly if you disagree.

Table 12: response to question 11

Respondent type	Answer	Total
Multi-stage vehicle manufacturers Individual	Disagree	6
Trade associations Vehicle manufacturers Tier 2 supplier	Agree	14
Vehicle manufacturers and others	Don’t know/No response	10

Question 15: Do you agree or disagree that approval to R.155 and R.156 should be mandatory for new vehicle types from 1 February 2026? Provide supporting evidence where possible, particularly if you disagree.

Table 13: response to question 15

Respondent type	Answer	Total
Trade associations Multi-stage vehicle manufacturers Indivudal	Disagree	8
Trade associations Vehicle manufacturers Tier 2 supplier	Agree	13
Vehicle manufacturers and others	Don’t know/No response	9

Question 16: Do you agree or disagree that approval to R.155 and R.156 should be mandatory for the registration of complete vehicles, as well as incomplete vehicles, from 1 February 2027? Provide supporting evidence where possible, particularly if you disagree.

Table 14: response to question 16

Respondent type	Answer	Total
L-category vehicle trade associations Multi-stage vehicle manufacturers Indivudal	Disagree	10
Trade associations Vehicle manufacturers Tier 2 supplier	Agree	7
L-category vehicle manufacturers and others	Don’t know/No response	13

Question 17: Do you agree or disagree that for the registration of completed vehicles approval should be mandatory for R.155 from 1 February 2028 and for R.156 from 7 July 2029? Provide supporting evidence where possible, particularly if you disagree.

Table 15: response to question 17

Respondent type	Answer	Total
Trade associations Vehicle manufacturers Tier 2 suppliers Individuals	Disagree	7
Trade associations Vehicle manufacturers Tier 2 supplier	Agree	9
Vehicle manufacturers and others unrelated to completed vehicles	Don’t know/No response	14

Question 18: Do you agree or disagree that approval to R.155 and R.156 should be mandatory for the registration of special purpose vehicles from 7 July 2029? Provide supporting evidence where possible, particularly if you disagree.

Table 16: response to question 18

Respondent type	Answer	Total
Trade association Multi-stage vehicle manufacturers Tier 2 supplier Individual	Disagree	4
Trade associations Vehicle manufacturers Tier 2 supplier	Agree	10
Vehicle manufacturers and other	Don’t know/No response	16

Question 19: Do you agree or disagree that we should provide additional time for multi-stage manufacturers to gain approval to R.155 and R.156 within the GB medium series? Provide supporting evidence where possible, particularly if you disagree.

Table 17: response to question 19

Respondent type	Answer	Total
Trade associations Tier 2 supplier Individuals	Disagree	5
Trade associations Vehicle manufacturers Tier 2 supplier	Agree	8
Vehicle manufacturers and other	Don’t know/No response	17

Question 20: Do you agree or disagree that the amendment of the certificate of conformity to record approval to R.155 and R.156 should be compulsory from 1 February 2027? Provide supporting evidence where possible, particularly if you disagree.

Table 18: response to question 20

Respondent type	Answer	Total
Trade association Multi-stage vehicle manufacturer L-category vehicle manufacturer Individual	Disagree	7
Trade associations Vehicle manufacturers Multi-stage vehicle manufacturer	Agree	12
Vehicle manufacturers and other	Don’t know/No response	11

Question 21: Do you agree or disagree that we should reduce the administrative burden for manufacturers of trailers that are not in scope of our regulations? Provide supporting evidence where possible, particularly if you disagree.

Table 19: response to question 21

Respondent type	Answer	Total
Trade associations L-category standard vehicle manufacturer Individual	Disagree	2
Trade associations Multi-stage vehicle manufacturers L-category vehicle manufacturers	Agree	10
Vehicle manufacturers and other	Don’t know/No response	18

Question 22: Do you agree or disagree that we should permit certain manufacturers to sell leftover stocks of vehicles that may not be compliant with R.155 and R.156 when introduced for a specified time? Provide supporting evidence where possible, particularly if you disagree.

Table 20: response to question 22

Respondent type	Answer	Total
Vehicle manufacturers L-category vehicle manufacturers Tier 2 suppliers Individual and other	Disagree	6
Trade associations Multi-stage vehicle manufacturers	Agree	16
Vehicle manufacturers and others	Don’t know/No response	8

1. Excluding new types of completed vehicles. ↩