R155 — cybersecurity as a condition of type approval

The regulation is unusual in that it certifies the organisation as well as the product. A manufacturer must demonstrate processes for identifying threats, responding to incidents and maintaining vehicles through their service life, and only then can individual types be approved. A companion regulation covers software update management.

Why it matters when buying

It is the reason a connected car sold in Europe has a named party responsible for its software over time, and the reason over-the-air updates delivered to European cars are subject to a controlled process rather than a manufacturer’s discretion.

For Chinese manufacturers it has been a substantial barrier to entry and a substantial signal once cleared. Meeting it requires European-facing organisation, not just European-facing hardware, and it is part of why market entry is slower and more deliberate than the pace of product launches in China would suggest.

For buyers the practical reading is narrow but real: a legally approved new car has an accountable software custodian, and a car brought in outside the approval system does not. The second case is the one where an unpatched vehicle has nobody obliged to patch it.

Related: OTA update · eCall · WVTA