Automotive Cybersecurity Regulations: EU, China and US

A vehicle platform sold in Europe, China and the United States now faces three different kinds of cybersecurity gate: type approval under UN Regulations R155 and R156, mandatory Chinese national standards GB 44495 and GB 44496, and a US regime that pairs voluntary engineering guidance with a binding supply chain origin rule. This page is a market access matrix. It sets out, market by market, what has to be proven, by whom, when, and with what evidence, and shows where one engineering programme built on ISO/SAE 21434 can serve all three. It assumes you know what a cyber security management system (CSMS) and a threat analysis and risk assessment (TARA) are; for those basics see the UNECE R155 Cyber Security Management System Guide and the ISO/SAE 21434 Guide. It is written for homologation, product security and supplier quality teams at vehicle manufacturers and tier 1 suppliers. Status checked on 14 November 2026 against the official texts listed at the end.

Key takeaways

Three markets, three legal mechanisms. The EU makes R155 and R156 conditions of type approval, China makes GB 44495 and GB 44496 mandatory national standards, and the US has no cyber type approval but restricts Chinese and Russian linked software and hardware through the Commerce Department's connected vehicles rule.
China moved from voluntary to mandatory on 1 January 2026. Both GB 44495-2024 (whole-vehicle information security) and GB 44496-2024 (software update) were released on 23 August 2024 and implemented on 1 January 2026.
The US gate is about origin, not engineering. From model year 2027 manufacturers must file Declarations of Conformity on covered software at least 60 days before first import or sale; NHTSA's 2022 best practices remain voluntary.
One CSMS can serve two markets, not three. R155 and GB 44495 share the management system idea and the M, N and O scope, but GB 44495 adds concrete vehicle tests and the US rule needs separate supplier origin evidence.
Suppliers carry the evidence burden. R155 makes the manufacturer manage supplier risk, the US rule makes it certify supplier origin, and both flow down to tier 1 and tier 2 contracts.

Regulations and frameworks at a glance

Rules are grouped by market: EU and UNECE, China, United States, then the standard. The order is not a ranking.

Rule	Legal mechanism	Who must comply	What is proven	Status (14 November 2026)
UN Regulation No. 155, cyber security and CSMS	UN type approval regulation; mandatory in the EU through Regulation (EU) 2019/2144	Vehicle manufacturer (supplier evidence flows up)	CSMS certificate plus vehicle type approval: risk assessment covering Annex 5 threats, mitigations, testing, annual monitoring reports	EU: refusal of type approval for new types from 6 July 2022; registration of non-compliant new vehicles prohibited from 7 July 2024
UN Regulation No. 156, software update and SUMS	UN type approval regulation	Vehicle manufacturer	Software update management system, RXSWIN register, update integrity, authenticity and safe execution	In force; SUMS certificate valid up to three years
GB 44495-2024, technical requirements for whole-vehicle information security	Mandatory national standard (强制性)	Vehicle manufacturer for categories M, N and O with at least one ECU	Management system across development, production and post-production, plus vehicle technical requirements and tests	Released 23 August 2024; implemented 1 January 2026; shown as current
GB 44496-2024, general technical requirements for vehicle software update	Mandatory national standard	Vehicle manufacturer	Software update management and vehicle update requirements	Released 23 August 2024; implemented 1 January 2026; shown as current
US: 15 CFR Part 791 Subpart D, connected vehicles (BIS)	Binding regulation under the ICTS supply chain authority; penalties under IEEPA	Manufacturers selling completed connected vehicles; importers of vehicle connectivity system (VCS) hardware	Declarations of Conformity that covered software and VCS hardware are not linked to China or Russia, with due diligence records	Software prohibitions from model year 2027; hardware from model year 2030 (or 1 January 2029 for units without a model year)
US: NHTSA Cybersecurity Best Practices for the Safety of Modern Vehicles (2022)	Voluntary, non-binding guidance	Manufacturers and suppliers	Nothing formally; expected practices in general (G) and technical (T) series	September 2022 update of the 2016 guidance
ISO/SAE 21434:2021, road vehicles cybersecurity engineering	Voluntary standard	Organisations that adopt it across the supply chain	Work products for TARA, cybersecurity goals, concept, verification and operations	Referenced by NHTSA and widely used as R155 evidence

The overview of the whole field, including attack surfaces and OTA, is in the Automotive Cybersecurity Guide. Each rule has its own page: the China GB 44495 Guide and the US Connected Vehicles ICTS Rule Guide cover the Chinese standard and the US rule in detail.

Market access matrix

The question a programme manager asks is "what must exist, and who signs it, before we can sell here?" The matrix answers it per market.

Gate	EU (R155, R156)	China (GB 44495, GB 44496)	United States (BIS rule, NHTSA)
Vehicle scope	R155: M and N; O with at least one ECU; L6 and L7 with automated driving at level 3 or above. R156: M, N, O, R, S and T that permit software updates	M, N and O with at least one ECU	BIS: connected vehicles up to 4,536 kg (10,000 lb) gross vehicle weight rating. NHTSA: all motor vehicles
Organisation-level proof	CSMS certificate (up to three years) and SUMS certificate (up to three years)	Cybersecurity management system covering development, production and post-production, with a risk process	None for cyber engineering; due diligence records behind each Declaration of Conformity
Vehicle-level proof	Type approval: exhaustive risk assessment including Annex 5 Part A threats, proportionate mitigations, testing before approval	Technical requirements and tests: external connections (remote control, third-party applications, external interfaces), communication security, software update via GB 44496	Declaration of Conformity per model year for covered software; per model or calendar year for VCS hardware
Supplier obligations	Manufacturer must identify and manage supplier risks (7.3.2) and show how the CSMS handles dependencies on contracted suppliers (7.2.2.5)	Set within the management system clauses; confirm the supplier provisions in the official text	Origin of covered software and VCS hardware, backed by due diligence records
Software updates	R156: integrity and authenticity, recovery or safe state, sufficient power, no driving if unsafe, user informed	GB 44496 software update requirements	NHTSA T.22 to T.25: authenticated parties, signed images, anti-rollback, OTA integrity
In-service duty	Monitoring report to the approval authority at least once a year (R155 7.4.1)	Post-production phase of the management system	Revised Declaration within 60 days of a material change; annual confirmation
Consequence of failure	No type approval; no registration of new vehicles	Cannot meet a mandatory standard for market access	Civil penalties under IEEPA section 206; wilful violations up to US$1,000,000 and 20 years' imprisonment

R155 vs GB 44495: what carries over

Most global manufacturers already hold an R155 CSMS certificate, so the useful question is what that investment buys in China.

Element	Reusable from R155 programme	New work for GB 44495
Management system across lifecycle phases	Yes: both require development, production and post-production coverage	Map processes to the GB clause structure and its annex audit items
Risk assessment	Yes: ISO/SAE 21434 TARA output	Show it addresses the GB technical requirement list
Vehicle technical tests	Partly: R155 requires testing but sets few specific test cases	Run the GB clause 7 tests on remote control, third-party apps, external interfaces and communications
Software update	Yes: R156 SUMS and RXSWIN processes	Confirm against GB 44496 text
Annual monitoring report	Process exists	Confirm Chinese authority expectations for in-service evidence

Transition: GB 44495 clause 10 sets how the standard applies to new types and to types already approved before implementation. Read clause 10 in the official text rather than relying on secondary summaries, because the date for already approved types decides whether running production needs retesting.

R156 vs GB 44496 vs NHTSA on software updates

R156: the strongest operational detail of the three. It needs an auditable RXSWIN register, a compatibility check before release, protection of the delivery system, and vehicle-side safeguards: restore or safe state after a failed update, enough power to finish, no driving where an update could be unsafe, and the user told the purpose, expected duration and affected functions.
GB 44496: the mandatory Chinese counterpart, implemented on the same date as GB 44495. Treat an R156 SUMS as the starting point and check clause by clause against the official text.
NHTSA: voluntary, but specific about the security mechanisms: firmware changes only by authenticated parties, signed images, protection against rollback and an OTA process with integrity protection (T.22 to T.25).

The mechanism most programmes use to satisfy all three is a signed metadata framework such as Uptane; see the Uptane and Vehicle OTA Security Guide.

Each market in practice

EU and other R155 markets

Threat model: the R155 Annex 5 Part A threat catalogue, which every vehicle type risk assessment must cover, from back-end servers to update procedures and physical access.
Architecture of the obligation: two layers. The organisation earns a CSMS certificate, then each vehicle type earns approval against it. The certificate lasts a maximum of three years.
Failure modes: supplier evidence that arrives after type approval testing, risk assessments that skip Annex 5 entries without justification, and monitoring reports with no new threat analysis.
Decision criterion: where the type approval authority is the gate, the CSMS audit cycle sets the programme calendar.

China

Threat model: external connections and remote control of vehicles, third-party applications and external interfaces, and communication security.
Architecture of the obligation: a management system requirement plus testable vehicle requirements in one mandatory standard, with software update in a companion standard.
Failure modes: assuming an R155 certificate is enough, running tests only on European variants, and missing the clause 10 transition date for carry-over types.
Decision criterion: vehicles built specifically for China need the clause 7 test campaign planned into the validation schedule.

United States

Threat model: two different ones. NHTSA targets safety-affecting attacks on vehicles; BIS targets national security risk from foreign adversary access to vehicle connectivity and automated driving software.
Architecture of the obligation: voluntary engineering guidance, plus a binding declaration regime. Covered software excludes firmware, open-source software within limits, and subcomponents supplied before 17 March 2026 that are not later altered by a linked entity.
Failure modes: treating the BIS rule as a cybersecurity programme (it is a sourcing programme), late SBOMs that miss the 60-day filing window, and no process to detect material changes.
Decision criterion: the model year calendar drives everything; model year vehicles often go on sale in the preceding calendar year, so declarations fall due early.

Worked scenario: a telematics unit supplier

A tier 1 supplier makes a telematics control unit with cellular, Wi-Fi and Bluetooth for three OEMs, one selling in the EU, one in China and one in the US.

One engineering baseline: run the ISO/SAE 21434 TARA and produce the cybersecurity case once, structured so each OEM can lift it into its own R155 type approval file.
EU OEM: deliver work products before the OEM's type approval tests, plus a monitoring commitment so the OEM can file annual R155 reports.
China OEM: support the GB 44495 clause 7 test campaign on the external interfaces and remote control paths the unit exposes, and the GB 44496 update requirements for the unit's firmware and software.
US OEM: provide component and supplier records for the unit's software, and origin evidence for the cellular module, which counts as VCS hardware. Agree a change notification clause so the OEM can refile within 60 days of a material change.
One change process: a single change board decides whether a software change affects the R155 risk assessment, the RXSWIN, a GB test result or a US Declaration.

Choosing a compliance strategy

Situation	Approach	Trade-off
Global OEM with R155 in place	Extend the CSMS to GB 44495 audit items; add the clause 7 test campaign; run BIS sourcing as a separate workstream	Two programmes to govern, but each stays clean
China-focused OEM planning exports	Build to GB 44495 first, then map to R155; check US sourcing exposure before any US plans	US market may need supplier changes
Tier 1 supplier	One 21434 case per component, plus a per-market evidence annex and an origin declaration pack	Annex maintenance cost
Heavy truck maker	R155 and GB 44495 still apply by category; the BIS rule excludes vehicles over 4,536 kg	Do not assume the US exclusion applies elsewhere

Where identity fits

All three markets come back to vehicle and back-end credentials. NHTSA T.5 says a credential from one vehicle should not give access to others, R155 Annex 5 lists back-end servers as an attack path, and GB 44495 sets requirements for remote control and communication security. Per-vehicle keys, diagnostic tool authentication and fleet API tokens are machine identities. See the Automotive Identity Security Guide.

Detection and measurement

Market readiness: share of platforms with a current CSMS and SUMS certificate, GB 44495 and GB 44496 test evidence, and US Declarations filed for the next model year.
Declaration lead time: days between US Declaration filing and first import or sale (must be at least 60).
Supplier evidence on time: share of tier 1 work products and SBOMs delivered before type approval testing.
Monitoring report completeness: R155 annual report items covered (new attacks, mitigation effectiveness).
Change-to-reassessment time: days from a software change to its cybersecurity impact decision across all markets.

Common failure patterns

One certificate, three markets: assuming an R155 certificate satisfies GB 44495 or the US rule.
Sourcing treated as security: passing the BIS declaration and assuming the vehicle is secure, or the reverse.
Late supplier evidence: tier 1 TARA work products arriving after type approval testing.
Model year blindness: missing that model year 2027 US declarations fall due during 2026.
Uncontrolled software change: an update ships without checking the RXSWIN, GB test results and US declaration together.

Framework mapping

Theme	NIST CSF 2.0	NIST SP 800-53 Rev. 5	ISO/IEC 27001:2022 Annex A
Management system and governance	GV.OC, GV.RM	PM-9	A.5.1
Supplier risk and origin	GV.SC	SR-3, SR-4, SR-6	A.5.19, A.5.21
Risk assessment	ID.RA	RA-3	A.5.7
Software update integrity	PR.PS	SI-7, CM-14	A.8.32
Monitoring and reporting	DE.CM	SI-4, CA-7	A.8.16

Practitioner checklist

Build a platform-by-market matrix of every gate above, with an owner and a date per cell.
Keep one ISO/SAE 21434 TARA per platform and map it to R155 Annex 5 and the GB 44495 technical requirements.
Read GB 44495 clause 10 in the official text to fix the date for already approved types.
Plan the GB 44495 clause 7 test campaign on China-specific variants.
Map the R156 SUMS against GB 44496 clause by clause.
Build SBOMs and hardware origin records per model year for US Declarations of Conformity.
Put origin, SBOM and change notification clauses into tier 1 contracts.
Run one change board that checks RXSWIN, GB test results and US declarations together.

Standards and references

This guide summarises automotive cybersecurity market access rules in the EU, China and the United States as of 14 November 2026 and is not legal advice. Related NHI Mgmt Group resources: Automotive Cybersecurity Guide · UNECE R155 Cyber Security Management System Guide · China GB 44495 Guide · US Connected Vehicles ICTS Rule Guide · Connected and Autonomous Vehicle Security Guide

Automotive Cybersecurity Regulations Compared: A Market Access Matrix for OEMs and Suppliers