With the arrival of the software-defined vehicle, software updates have become a primary means of adding functions, fixing vulnerabilities and maintaining vehicles over their life. Ensuring that updates are safe, reliable and traceable is now a compliance essential for entering the EU market. UN R156 is no longer optional — it is a threshold every supplier has to face.

01 What is UN R156? A regulation that governs process

UN R156 (UN Regulation No. 156) was drawn up by the United Nations Economic Commission for Europe (UNECE) and entered into force on 22 January 2021. Its full title is the Uniform provisions concerning the approval of vehicles with regards to software update and software update management system.

Unlike an ordinary functional test of a software upgrade, UN R156 is not concerned only with whether software can be installed successfully. It requires manufacturers to establish a software update management system (SUMS): can software versions be managed, the impact of updates identified, the safety of updates verified, and update records retained? The core idea is to use the SUMS as the management basis and version and configuration management as the core, so that the entire software update process is effectively controlled.

02 When does it apply, and to which vehicles?

UN R156 is a technical regulation under the UN 1958 Agreement framework, introduced in the EU through the type approval system. For the main M and N category vehicles it took effect on 22 January 2021, applied to new vehicle types from 6 July 2022, and applies to all new vehicles produced from 7 July 2024. In June 2026 the 01 series of amendments entered into force, adjusting the allocation and management requirements for the software identification number RXSWIN; manufacturers should check which amendment series applies to them.

The regulation applies to M, N, O, R, S and T category vehicles that permit software updates. One common misconception should be corrected: R156 does not apply only to OTA vehicles — software updates performed via USB, diagnostic equipment or service tools are equally in scope, and OTA is simply one implementation route (OTA updates carry the additional requirements of paragraph 7.2.2). Components do not need their own R156 approval, but vehicle manufacturers will require suppliers to provide software update processes, version information, security mechanisms and test evidence.

03 The two core requirements: SUMS and vehicle software update technology

The first layer is the conformity assessment of the software update management system (SUMS), confirming that the manufacturer has an organisational process covering software update planning, development, verification, deployment and recording — including software version and configuration management, update impact analysis, records and traceability, safety management of the update process, and supply chain coordination.

The second layer covers the technical requirements for software updates on the vehicle type, verifying for a specific model the authenticity and integrity of update packages, software identification and, where applicable, the safety requirements for OTA updates. The two layers are related but cannot substitute for one another.

04 RXSWIN and OTA safety: key mechanisms

RXSWIN (software identification number) identifies the software state associated with a particular regulatory type approval and differs from an ordinary software version number: an ordinary version number identifies a software component, whereas RXSWIN is tied to the type approval. Manufacturers must uniquely identify the RXSWIN, establish its correspondence with software versions, manage the information before and after an update, and prevent unauthorised modification.

For vehicles supporting OTA, the regulation further requires the ability to revert to a previous version or enter a safe state if an update fails or is interrupted (for example via A/B partitions or backup restore); a check of power conditions before updating; prevention of unsafe use of the vehicle during an update; and notification to the user of the update content and outcome. It is worth stressing that R156 is about whether a software update can be carried out safely, not merely whether an OTA platform can push remotely.

05 Testing, certification process and ISO 24089

Software update safety testing typically covers authenticity of the update package (digital signature verification), integrity (tamper detection), authorisation control, version matching, recovery from a failed update, power conditions and user notification. Certification follows six steps: establish the SUMS, have it assessed by the approval authority with a certificate of compliance issued, carry out the technical assessment of vehicle software updates, submit the type approval application, obtain approval, and maintain the SUMS. Note that a SUMS certificate of compliance is valid for a maximum of three years and is not equivalent to a vehicle type approval.

UN R156 and ISO 24089 are often mentioned together: the former is a type approval regulation that states what must be complied with, the latter an engineering standard that shows how. Conformity with ISO 24089 does not automatically confer R156 type approval; by combining it with the cybersecurity approach of ISO/SAE 21434, manufacturers can also manage cybersecurity risk during software updates.

06 What should component suppliers do?

Six areas deserve priority: document the software update mechanism; implement secure update design; carry out software update security testing; establish software version and configuration management; provide technical evidence for updates; and support vehicle manufacturers in assessing update impact. Building sound software update security design and verification capability in advance helps meet supply chain requirements and reduces the risk of rework in later projects.

NTEK Information Security Laboratory: supporting automotive software update compliance

With UN R156 in force, demand from vehicle manufacturers and component suppliers for software update security, version management and technical verification continues to grow. NTEK's Information Security Laboratory can provide, according to project requirements, software update security testing, security verification of OTA update mechanisms, firmware security analysis, UN R156 technical conformity support and ISO 24089 engineering support. Specific services are subject to the laboratory's actual capability, accreditation scope and project agreement; formal SUMS certificates of compliance and vehicle type approvals are issued by the approval authority in accordance with the prescribed procedure. For EU market access or supplier audit preparation, please contact us.