UNECE R155 suppliers are no longer a side topic for vehicle manufacturers. UN Regulation No. 155 on cyber security and cyber security management systems is the first international regulation of its kind, and its effect reaches well beyond the OEM’s own organisation. For Tier 1 and Tier 2 companies, customers now ask for evidence of cybersecurity capability as part of the relationship.
This article does not explain how to comply. It sets out what a director should be able to answer today, and why those questions matter.
What R155 and R156 mean for the industry
UN R155 requires vehicle manufacturers to operate a cybersecurity management system covering the vehicle lifecycle. According to UNECE, it introduces audit-related provisions that allow the assessment of the cybersecurity measures implemented by manufacturers, including their suppliers’ ability to mitigate cybersecurity-related risks, along with the obligation to perform risk assessments and keep them current.
UN R156 addresses a related topic: the governance of software updates, so that updates are planned, delivered and recorded in a controlled and auditable way over the life of the vehicle.
The regulations apply to manufacturers, but the vehicle is built from components that suppliers design and produce. That is why requirements travel down the supply chain through customer specifications, quality agreements and nomination criteria.
What UNECE R155 suppliers are typically asked for
Customer requests to UNECE R155 suppliers tend to follow a pattern. OEMs ask which products are in scope, who is accountable inside the supplier, and what evidence exists that cybersecurity is considered across the product lifecycle. They also ask how vulnerabilities and software updates are governed after start of production, which is where UN R156 becomes relevant.
The common thread is that UNECE R155 suppliers are judged on organisational capability, not on a single document. Customers want to see that the topic has an owner, a defined scope and consistent practice, whatever the product or the plant.
Why UNECE R155 suppliers face a different conversation
Three shifts are visible across the industry
- Cybersecurity enters the sourcing conversation. Requests for evidence appear next to quality and delivery criteria. A supplier that answers clearly stands out from one that cannot.
- Responsibility crosses functions. Product cybersecurity touches engineering, quality, IT and legal. Without a named owner, customer requests circulate without a clear answer.
- The product lifecycle extends. Obligations do not end at start of production. Vulnerability handling and software updates remain relevant through the vehicle’s service life.
Global vehicle programmes carry global expectations, whichever plant produces the component.
Six questions for your leadership team
1. Scope. Which of our products and services fall under customer requirements linked to R155 or R156?
2. Customer expectations. Do we have each OEM’s cybersecurity and software update requirements in writing, and do we know where they differ between customers?
3. Ownership. Who is accountable for product cybersecurity in our organisation? Is it one person, or a shared gap?
4. Evidence. Can we show documented practices consistent with ISO/SAE 21434, or only an intention to follow them?
5. Post-production. What happens when a vulnerability is reported after start of production, and who decides?
6. Sub-suppliers. What do we require from our own suppliers, and what do we actually know about what they deliver?
What this means for your organisation
In our experience, the organisations that struggle are rarely the ones without answers. They are the ones whose answers sit in different departments and have never been brought together. If several of these questions take more than a minute to answer, the gap is probably already visible to your customer, even if no one has raised it yet.
The aim is not to prepare answers for an auditor. It is to know your own position before a nomination, a customer audit or a contract discussion tests it.
These questions also sit alongside the information security expectations already common in the industry. Many suppliers address product cybersecurity and organisational information security together, and customers increasingly read TISAX and product cybersecurity as one picture of supplier maturity.
For UNECE R155 suppliers, the most useful step is an honest internal view of where the answers sit today. That view is the basis for every later customer conversation, and it is cheaper to build before a nomination than during one.
Conclusion
UNECE R155 suppliers that treat these six questions as a management agenda, and not only an engineering task, will be better placed in their next customer conversation.
Ariol Automotive supports OEMs, Tier 1 and Tier 2 suppliers worldwide in preparing for TISAX, IATF 16949, VDA 6.x and automotive cybersecurity requirements through consulting and auditing support. More at ariolautomotive.com.
