UN R155 type-approval timeline: new types vs all vehicles
The dates that already bit, market by market — and what 'new type' versus 'all vehicles' means for a programme
The dates that already bit
UN R155 is not a future obligation in its lead markets — it is a live one. The type-approval timeline matters because the regulation lands in two steps, and the second step catches vehicles the first one misses. Getting the distinction wrong is how a programme discovers, too late, that a carry-over type it assumed was exempt is in fact in scope.
UN R155 is a UNECE WP.29 regulation, in force through the 1958 Agreement on vehicle regulations. It is applied by each Contracting Party that has adopted it, which is why there is no single worldwide switch-on date. In the EU it is enforced through the General Safety Regulation, (EU) 2019/2144. Understanding the sequence in one market — the EU, where the dates are furthest along — makes the pattern legible everywhere.
New type versus all vehicles
The two milestones do different jobs.
A new type date applies to vehicle types that are first approved after it. It catches fresh programmes at the point of approval, which is the natural moment to demonstrate a CSMS and a type-specific cybersecurity case. If your type is approved after the new-type date, cybersecurity approval is simply part of getting to market.
An all vehicles date is broader. It applies to every vehicle produced after it, regardless of when the type was first approved. That sweeps in facelifts, carry-over types and long-running platforms that predate the regulation. The purpose of the later date is to give manufacturers a defined window to bring existing production into compliance, not only to gate new launches.
The gap between the two — two years in the EU — is the planning window. A manufacturer with a broad portfolio cannot treat the all-vehicles date as a distant problem, because bringing an established type up to an assessable CSMS with a maintained TARA and supplier evidence is not a quick exercise. What that evidence has to contain is set out in what evidence the assessor actually opens.
The markets, side by side
| Market | New types | All new vehicles | Mechanism |
|---|---|---|---|
| European Union | 6 July 2022 | 7 July 2024 | GSR (EU) 2019/2144 |
| Japan, Korea (and other 1958 Agreement parties) | Enforced on their own national schedules | Enforced on their own national schedules | UNECE 1958 Agreement adoption |
| India | Draft: 1 Oct 2026 (L3+ new models) | Draft: phased to 1 Oct 2029 | AIS-189 (CSMS), draft G.S.R. 503(E) — not yet final |
The EU row is the one with confirmed, already-past dates: 6 July 2022 for new types and 7 July 2024 for all new vehicles. Japan and Korea, as Contracting Parties, enforce UN R155 through their own approval systems and timelines. India is a distinct case and is treated below.
Why the mechanism matters
A UNECE type approval is portable in a specific sense: it travels among Contracting Parties to the 1958 Agreement, which is the point of a mutual-recognition system. A manufacturer approved in one Contracting Party does not re-prove the whole cybersecurity case in another that recognises the approval. That portability is a real commercial advantage for exporters, and it is why the EU dates ripple beyond Europe — a type built for the EU market already carries the UN R155 approval that other Contracting Parties recognise.
India, however, does not simply recognise a UNECE approval for its domestic regime. It runs AIS-189, its own national CSMS standard aligned to UN R155, assessed within India. An Indian approval confers Indian approval; a UNECE approval travels among Contracting Parties. For a manufacturer exporting from India to the EU, that means carrying both files — the domestic assessment and the UNECE type approval — a point developed in the comparison of the two regimes.
The Indian timeline: honest status
India's position needs stating plainly, because loose dates circulate freely. AIS-189, the CSMS standard aligned to UN R155, has been published by ARAI for the AISC under the CMVR-TSC. Its enforcement is now proposed in MoRTH draft G.S.R. 503(E), dated 17 June 2026, which inserts CMVR Rule 125-T with a phased timeline — new Level-3+ automated models from 1 October 2026, through to all software-update-capable vehicles by 1 October 2029. That draft is open for public comment and not yet finalised in the gazette, so the honest planning posture for an Indian OEM is to build the capability against the draft schedule rather than wait for the final notification; that argument is made in full in India's automotive cybersecurity timeline.
This matters for programme managers because a CSMS is not a document you produce on demand. Whatever the notified date turns out to be, the readiness work — scoping, gap assessment, TARA, process evidence — takes the same time to do well. Waiting for certainty on the date does not shorten the work; it only compresses the runway.
Beyond type approval: the reporting clock
One further date belongs on any exporter's timeline, because it runs on a different track from type approval. The EU Cyber Resilience Act, Regulation (EU) 2024/2847, adds horizontal obligations on products with digital elements, with vulnerability and incident reporting obligations applying from 11 September 2026 and the main body of obligations from 11 December 2027. It does not replace UN R155, and its scope interaction with vehicle type approval is nuanced. For an exporter, the practical effect is that UN R155 approval is not the last date on the calendar — the CRA reporting clock is a separate obligation, examined in CRA vs UN R155.
The AutoSifu view
Timelines are only useful if the work behind them is real. AutoSifu works with CIRT as one route — compliance, solutioning and CoC/VTA support with the approval body in the room — so that a programme's readiness matches its market dates rather than a rumour. For Indian OEMs that means building an assessable CSMS now, on the honest understanding that the AIS-189 enforcement date is still draft — proposed in G.S.R. 503(E), phased from October 2026 — while the UNECE dates already bit.
Questions
- When did UN R155 become mandatory?
- In the EU, UN R155 applied to new vehicle types from 6 July 2022 and to all new vehicles produced from 7 July 2024, enforced through the General Safety Regulation (EU) 2019/2144. Other Contracting Parties to the 1958 Agreement, including Japan and Korea, also enforce it on their own schedules. There is no single global date — each market applies the regulation through its own approval regime.
- What is the difference between new types and all vehicles?
- A 'new type' date applies to vehicle types first approved after that date, so it catches new programmes as they come to market. An 'all vehicles' date applies to every vehicle produced after it, including facelifts and carry-over types already in production. The gap between the two dates — two years in the EU — exists to give manufacturers time to bring existing types into compliance, not only new ones.
- Which markets enforce UN R155?
- UN R155 is enforced by Contracting Parties to the UNECE 1958 Agreement that have adopted it, including the EU, Japan and Korea. India runs its own aligned national standard, AIS-189, whose enforcement is proposed in MoRTH draft G.S.R. 503(E) (phased from October 2026) but not yet finalised in the gazette. A UNECE type approval travels among Contracting Parties, but India assesses under its own regime.