UN R155 requires vehicle manufacturers to run a cybersecurity management system covering development, production and post production. UN R156 requires a software update management system so updates, including over the air ones, are safe, traceable and keep the vehicle compliant with its type approval. They are audited separately and designed to work together.
UN R155 in short
R155 is about the organization. A cybersecurity management system, or CSMS, is described by UL as a systematic, risk based approach that defines processes, responsibilities and governance for treating cyber risk. Core elements include security culture, organizational structure, documented development processes, monitoring, infrastructure and skills.
The scope runs through development, production and post production until the vehicle series reaches the end of its service life. UL states that the requirement applies to vehicles manufactured from July 2024. Treat that date as a secondary source claim and check the regulation text for your market.
UN R156 in short
R156 is about change. A software update management system, or SUMS, should make sure updates are carried out in a safe, functional, traceable and compliant manner. It must identify target vehicles, check compatibility with each vehicle configuration, and assess how each update affects type approval.
Both over the air and workshop updates must meet the security, safety and documentation expectations. The update process itself must be protected.
How they fit together
| Question | R155 | R156 |
|---|---|---|
| Main subject | Managing cyber risk | Managing software change |
| System name | CSMS | SUMS |
| Focus | Process, governance, monitoring | Version tracking, update safety, records |
| Link | SUMS builds on the CSMS | Needs the CSMS foundation |
UL says the SUMS builds on the CSMS. In plain terms, you cannot run safe updates without a risk process that tells you what could go wrong with them.
Evidence an auditor will want
For R155, expect risk assessments, monitoring records and supplier arrangements. For R156, expect records of hardware and software versions per system, documented update processes, and proof that integrity and authenticity are established before installing. UL also reports that a SUMS is audited by an auditor from a listed inspection body and that certificates have a limited validity period, which it gives as three years. Confirm that figure with your approval authority.
Common confusion
R155 is not only about connected features, and R156 is not only about wireless updates. A car with no wireless link still has a diagnostic port, a supply chain and a workshop update path. Both still apply to the process.
Where teams stumble
Small teams often run the two as separate projects, with security staff on one and release engineers on the other. That duplicates evidence and leaves gaps between them. A shared inventory of software versions, linked to risk assessment entries, serves both. When a vulnerability arrives, the same record answers which units are affected and which update path fixes them.
Quick check
Which one covers incident monitoring?
R155, through the CSMS and its monitoring of process and product security.
Which one defines RXSWIN?
R156. See the post what an RXSWIN is.
Sources
Last reviewed: 19 October 2026.
