UN Regulations R155 and R156 (vehicle cybersecurity)
Technical regulations adopted in 2020 under UN auspices, requiring manufacturers to run a cybersecurity management system and secure software updates to obtain vehicle type approval.
A recent vehicle carries dozens of control units, a permanent mobile network connection and remote software updates. It has become a mobile computer system whose compromise can have physical consequences. In June 2020, the World Forum for Harmonization of Vehicle Regulations, attached to the UN Economic Commission for Europe, adopted two regulations. Regulation R155 requires the manufacturer to run a cybersecurity management system covering the vehicle's whole life cycle, from design to end of sales: risk analysis, protection measures, threat monitoring, incident response, supplier control. Regulation R156 governs software updates, including over the air, so that they cannot be hijacked. In the European Union, these requirements have applied to new vehicle types since July 2022 and to all new vehicles since July 2024; some older models had to be withdrawn from sale for lack of a way to bring them into compliance. For insurance, these regulations matter in three directions: the manufacturer's liability if an attack causes an accident, motor claims as theft by electronic hacking grows, and insurance of connected fleets exposed to simultaneous compromise.
Textbook case: thieves access vehicles' internal communication bus through a removed headlight and start hundreds of cars of the same model. The motor insurer pays the thefts, then examines with the manufacturer whether its cybersecurity management system had identified this vulnerability, with a view to recourse.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.