The convergence of intelligent connected vehicles and cybersecurity is reshaping the market access threshold for automotive products. As vehicles become more intelligent and more connected, cybersecurity has become an essential condition for entering the EU market. For vehicle manufacturers and automotive electronics suppliers, UN R155 is no longer optional — it is a compliance threshold that has to be faced.

01 What is UN R155? A regulation that governs process

UN R155 (UN Regulation No. 155) was drawn up by the United Nations Economic Commission for Europe (UNECE) and entered into force on 22 January 2021. Its full title is the Uniform provisions concerning the approval of vehicles with regards to cyber security and cyber security management system. Unlike conventional product safety testing, UN R155 looks not only at whether a vehicle has identity authentication, communications encryption and secure boot, but at whether the manufacturer has established a complete cybersecurity management system (CSMS): how threats are identified and assessed, what mitigation measures are taken, how effectiveness is verified, how new vulnerabilities are handled after launch, and how supply chain risk is managed. The core idea is to use risk management as the basis and the CSMS as the management framework to control cybersecurity across the whole vehicle lifecycle.

02 When does it apply, and to which vehicles?

UN R155 is a technical regulation under the UN 1958 Agreement framework, introduced in the EU through the type approval system. For the main M and N category vehicles it took effect on 22 January 2021, applied to new vehicle types from 6 July 2022, and applies to all new vehicles produced from 7 July 2024. L category vehicles, special-purpose vehicles and transitional arrangements must be confirmed against the specific regulation; the Official Journal of the EU published updated consolidated text 2025/5 on 10 January 2025, and manufacturers should check which version applies to them.

The regulation applies to L, M, N and O category vehicles fitted with at least one electronic control unit (ECU). Components do not need their own R155 approval, but vehicle manufacturers will require suppliers to provide risk assessments, penetration test reports and other cybersecurity evidence — a delivery requirement component companies should take seriously.

03 The two core requirements: CSMS and vehicle type cybersecurity

Compliance assessment under UN R155 has two layers, which are related but cannot substitute for one another. The first is the CSMS conformity assessment, confirming that the manufacturer has the organisational capability, processes and mechanisms to manage cybersecurity risk systematically across development, production and post-production — indeed, risk management and vulnerability handling must continue after production ends for as long as vehicles remain in service.

The second layer is the vehicle type cybersecurity assessment, which carries out a risk assessment for the specific model and demonstrates that the risks are appropriately managed, including identifying critical systems and threats, assessing attack paths, managing supplier risk, and implementing and verifying mitigation measures.

04 Testing, certification process and ISO/SAE 21434

The regulation does not prescribe a uniform penetration test checklist. It requires manufacturers to establish a testing process demonstrating that identified risks are properly managed. Real projects typically cover network interfaces, identity authentication, communications security, firmware, secure boot, diagnostics and software updates. Certification follows six steps: establish the CSMS, have it assessed by the approval authority with a certificate of compliance issued, carry out the vehicle risk analysis, implement and verify measures, submit the type approval application, and finally obtain approval. Note that a CSMS certificate of compliance is valid for a maximum of three years and is not equivalent to a vehicle type approval.

UN R155 and ISO/SAE 21434 are often mentioned together: the former is a type approval regulation that states what must be complied with; the latter is an engineering standard that shows how (TARA, security goal definition, verification and validation). Conformity with 21434 does not automatically mean conformity with R155; the two should be used together.

05 What should component suppliers do?

Six areas deserve priority: map the product cybersecurity architecture; carry out product-level risk analysis; establish security design and verification evidence; perform penetration testing; set up vulnerability management and supply chain collaboration; and improve delivery documentation, providing vehicle manufacturers with architecture, risk analysis and test reports. Building cybersecurity engineering capability in advance not only supports compliance work but also strengthens product competitiveness.

NTEK Information Security Laboratory: supporting automotive cybersecurity compliance

As regulations such as UN R155 take effect, demand for cybersecurity risk analysis, technical verification and test evidence continues to grow. NTEK's Information Security Laboratory can provide, according to project requirements, cybersecurity testing of automotive components, penetration testing, ISO/SAE 21434 technical support and UN R155 compliance support. The specific scope of services is subject to the laboratory's actual capability and the project agreement; formal CSMS certificates of compliance and vehicle type approvals are issued by the approval authority. For EU market access or supplier audit preparation, please contact us.