Skip to main content

ISO 24089 (Software Update Engineering for Road Vehicles)

ISO 24089 is the international standard for software update engineering in road vehicles. It sets out requirements and recommendations on two levels: for the organisation and for the individual project. ISO published it in February 2023, and a first amendment followed in 2024.

What does ISO 24089 cover?

The standard applies to vehicles whose software can be updated. It covers the vehicle with its systems and ECUs, and the infrastructure. It also covers assembling and delivering update packages after initial development. The standard is aimed at vehicle manufacturers, suppliers and their partners. It is meant to give everyone involved a shared understanding of who owns which activity.

It deliberately leaves out two things. Developing the software for the vehicle functions themselves is out of scope. And it does not prescribe specific technologies or solutions.

Relation to UNECE R156

UNECE R156 makes a Software Update Management System (SUMS) a precondition for type approval. The manufacturer has to prove which software version runs on which vehicle, whether an update affects the approval, and how updates are protected against manipulation.

R156 says what has to be proven. ISO 24089 describes how to organise the work for it. The regulation’s text does not mention the standard. Even so, testing organisations describe the relationship exactly this way. It mirrors the one between UNECE R155 and ISO/SAE 21434.

Relation to ISO/SAE 21434

ISO/SAE 21434 requires updates and the vehicle’s update capability to be developed under its own rules. That puts the update path into the Threat Analysis and Risk Assessment (TARA). An insecure update mechanism is a way into the vehicle.

So ISO 24089 governs the process around the update, ISO/SAE 21434 the security of the update path. Both standards come from the same subcommittee, ISO/TC 22/SC 32.

ISO 24089 in practice

Anyone setting up a SUMS should bring in the TARA early. The analysis needs to know the update interfaces, and update engineering needs to implement the countermeasures from the TARA. Our Cyber Security page shows how the regulations and standards fit together.

More on this topic

Related terms

UNECE R156 ISO/SAE 21434 UNECE R155 TARA

Frequently asked questions

Is ISO 24089 mandatory?
No. ISO 24089 is a standard. For type approval, UNECE R156 with its Software Update Management System (SUMS) is mandatory. R156 does not mention ISO 24089. Still, the standard is considered the obvious way to implement the regulation.
What is the difference between ISO 24089 and UNECE R156?
R156 is a UN regulation addressed to the vehicle manufacturer applying for type approval. It says what has to be proven. ISO 24089 is a standard for manufacturers and suppliers. It describes what software update engineering should look like in the organisation and in the project.
How do ISO 24089 and ISO/SAE 21434 relate?
ISO/SAE 21434 requires updates and the vehicle’s update capability to be developed according to the standard itself. That puts the security of the update path into the TARA. ISO 24089 governs the update process around it. Both standards come from the same ISO subcommittee.
Reviewed by Jens Bühl, Product Owner on October 30, 2026