UNECE R156 (UN Regulation No. 156 — Software Updates)
UNECE R156 is UN Regulation No. 156 on software updates for road vehicles. It makes an audited Software Update Management System (SUMS) a prerequisite for type approval: the manufacturer must be able to prove at any time which software version runs on which vehicle type and whether an update affects the approval. The regulation was developed — in the same package as UNECE R155 — by the UNECE World Forum for Harmonization of Vehicle Regulations (WP.29).
What does R156 require?
Like R155, the regulation assesses on two levels, which must be passed separately:
- SUMS at organizational level: The manufacturer must demonstrate that it manages software updates across the entire lifecycle — from identifying the target vehicles through checking compatibility and impact to secure delivery and documentation. This includes integrity and authenticity protection of the update packages and the assessment of whether an update changes approval-relevant systems.
- Type approval per vehicle type: For each vehicle type, the manufacturer must identify and document the type-approval-relevant software configurations via the RXSWIN (RX Software Identification Number). For every update, it must be assessed and evidenced whether it changes an approved state.
Additional requirements apply to over-the-air updates: the update must not compromise the safety of the vehicle while it is being performed, a failed update must lead to a safe state, and the vehicle user must be informed about the purpose and impact of the update.
The deadlines
| Date | Scope |
|---|---|
| Since July 2022 | Mandatory for all new vehicle types |
| Since July 2024 | Mandatory for all newly produced and sold vehicles, including existing types |
In the EU, the deadlines are anchored in the General Safety Regulation (EU) 2019/2144 — in parallel to R155.
Where does the regulation apply?
R156 applies in the contracting states of the UNECE 1958 Agreement that apply the regulation — including the EU member states, the United Kingdom, Japan and South Korea. It does not apply in the USA, where separate regulatory frameworks are in place. For manufacturers with global sales, R156 is nevertheless the de facto benchmark, because European type approval cannot be obtained without it.
Relationship to UNECE R155
R155 and R156 are twin regulations: same origin, same deadlines, same approval logic. R155 protects the vehicle against attacks, R156 protects the path through which vehicle software changes. The overlap is large: an insecure update mechanism is one of the most attractive attack targets of all, which is why the TARA from the R155 context must cover the update path as well. In practice, CSMS and SUMS are therefore usually built up and audited together.
Relationship to ISO 24089
What ISO/SAE 21434 is to R155, ISO 24089 (Road vehicles — Software update engineering) is to R156: the recognized engineering framework with which manufacturers technically implement the requirements of the regulation. The standard describes processes and work products for software update engineering at the organizational, project and infrastructure level.
UNECE R156 in practice
The most demanding part of R156 is traceability in continuous operation: which software version runs on which ECU in which vehicle variant, which RXSWIN is affected, and does the upcoming update change an approved state? These questions can only be answered if the relationships between requirements, software configurations, ECUs and approval documents are documented end-to-end — over years and across all variants. This is exactly where it is decided whether an update is a routine task or an approval risk: at the requirements traceability between software, systems and evidence.