Date: 2025-10-29Category: Not ApplicableState: Union GovernmentCountry: Europe
Commission Delegated Regulation (EU) 2025/1535 of 29 July 2025 supplementing Regulation (EU) 2024/2847 of the European Parliament and of the Council with regard to an exclusion from the application of that Regulation for certain products with digital elements falling within the scope of Regulation (EU) No 168/2013 of the European Parliament and of the Council
Issued by European Commission
· Directorate-General for Communications Networks
**Executive Summary**
Commission Delegated Regulation (EU) 2025/1535, dated 29 July 2025, supplements Regulation (EU) 2024/2847. It excludes certain products with digital elements, specifically those falling under the scope of Regulation (EU) No 168/2013, from the application of Regulation (EU) 2024/2847. The regulation will enter into force twenty days after its publication in the Official Journal of the European Union.
**Key Points / Main Content**
* **Exclusion from Regulation (EU) 2024/2847:**
* Products with digital elements falling within the scope of Regulation (EU) No 168/2013 are excluded from the application of Regulation (EU) 2024/2847.
* **Exception to Exclusion:** The exclusion does not apply to L-category vehicles designed to pedal, as defined in Article 3, point (94)(b), of Regulation (EU) No 168/2013.
* **Reasoning for Exclusion:**
* UN Regulation No 155 introduces cybersecurity requirements comparable to and achieving at least the same level of protection as Regulation (EU) 2024/2847, covering cybersecurity risks related to the entire lifecycle of vehicles, equipment and services.
* **Effective Date:**
* The regulation enters into force on the twentieth day following its publication in the Official Journal of the European Union.
**Impact Analysis**
**Manufacturers of L-Category Vehicles (excluding vehicles designed to pedal)**
*Impact*
* Exemption from Cyber Resilience Act (Regulation (EU) 2024/2847) due to coverage under UN Regulation No 155 and Regulation (EU) No 168/2013.
*Action Required*
* Ensure compliance with UN Regulation No 155 regarding cybersecurity requirements for L-category vehicles.
**Manufacturers of L-Category Vehicles designed to pedal**
*Impact*
* Remain subject to the Cyber Resilience Act (Regulation (EU) 2024/2847) as they are excluded from the general exclusion.
*Action Required*
* Ensure compliance with both UN Regulation No 155 and Cyber Resilience Act requirements.
**EU Member States**
*Impact*
* This Regulation is binding in its entirety and directly applicable in all Member States.
*Action Required*
* Implement and enforce the provisions of the Regulation.
Key Entities Referenced
Regulation (EU) 2024/2847: Regulation on horizontal cybersecurity requirements for products with digital elements (Cyber Resilience Act). This delegated regulation supplements it.
Regulation (EU) No 168/2013: Regulation on the approval and market surveillance of two- or three-wheel vehicles and quadricycles (L-category vehicles). This delegated regulation excludes certain products falling under this regulation from Regulation (EU) 2024/2847.
UN Regulation No 155: UN Regulation concerning the approval of vehicles with regards to cybersecurity and cybersecurity management system. Scope includes cybersecurity for L-category vehicles.
Commission Delegated Regulation (EU) No 44/2014: Commission Delegated Regulation supplementing Regulation (EU) No 168/2013 with regard to the vehicle construction and general requirements for the approval of L-category vehicles.
Brussels: Location where the regulation was signed.
Official Journal EN
of the European Union L series
2025/1535 29.10.2025
COMMISSION DELEGATED REGULATION(EU) 2025/1535
of 29 July 2025
supplementing Regulation (EU) 2024/2847 of the European Parliament and of the Council with
regard to an exclusion from the application of that Regulation for certain products with digital
elements falling within the scope of Regulation (EU) No 168/2013 of the European Parliament and of
the Council
THE EUROPEAN COMMISSION,
Having regard to the Treaty on the Functioning of the European Union,
Having regard to Regulation (EU) 2024/2847 of the European Parliament and of the Council of 23 October 2024 on
horizontal cybersecurity requirements for products with digital elements and amending Regulations (EU) No 168/2013
and (EU) 2019/1020 and Directive (EU) 2020/1828 (Cyber Resilience Act)(1), and in particular Article 2(5), second
subparagraph, thereof,
Whereas:
(1) Pursuant to Article (2) of Regulation (EU) 2024/2847, the application of that Regulation to products with digital
elements covered by other Union rules laying down requirements that address all or some of the risks covered by the
essential cybersecurity requirements set out in that Regulation may be limited or excluded where such limitation or
exclusion is consistent with the overall regulatory framework applying to those products and where the sectoral
rules achieve at least the same level of protection as the one provided for by that Regulation.
(2) Regulation (EU) No 168/2013 of the European Parliament and of the Council(2)establishes the administrative and
technical requirements for the type-approval of two- or three-wheel vehicles and quadricycles as categorised in that
Regulation (‘L-category vehicles’). Commission Delegated Regulation (EU) No 44/2014(3) establishes the detailed
technical requirements and test procedures regarding vehicle construction and general requirements for the approval
of L-category vehicles and the systems, components and separate technical units intended for such vehicles in
accordance with Regulation (EU) No 168/2013 and sets out a list of UNECE regulations and amendments thereto.
Pursuant to Article 4(1) of Delegated Regulation (EU) No 44/2014, the UNECE regulations and amendments thereto
set out in Annex I to that Delegated Regulation are to apply to type approval of L-category vehicles.
(3) The scope of UN Regulation No 155(4)has been extended to include rules on cybersecurity for L-category vehicles.
Therefore, Delegated Regulation (EU) No 44/2014 has been amended by Commission Delegated Regulation
(EU) 2025/1455(5)amending Delegated Regulation (EU) No 44/2014 as regards laying down technical requirements
and testing procedures regarding the protection of L-category vehicles against cyberattacks to include UN Regulation
No 155 in the list of UNECE regulations applying on a compulsory basis set out in Annex I to that Delegated
Regulation. L1e category vehicles designed to pedal referred to in Article 3, point (94)(b), of Regulation (EU)
No 168/2013 were however excluded from the compulsory application of UN Regulation No 155. Delegated
Regulation (EU) 2025/1455 is to apply to new vehicle types from 11 December 2027 and to existing vehicle types
from 11 June 2029.
(1) OJ L, 2024/2847, 20.11.2024, ELI: http://data.europa.eu/eli/reg/2024/2847/oj.
(2) Regulation (EU) No 168/2013 of the European Parliament and of the Council of 15 January 2013 on the approval and market
surveillance of two- or three-wheel vehicles and quadricycles (OJ L 60, 2.3.2013, p. 52, ELI: http://data.europa.eu/eli/reg/2013/168/oj).
(3) Commission Delegated Regulation (EU) No 44/2014 of 21 November 2013 supplementing Regulation (EU) No 168/2013 of the
European Parliament and of the Council with regard to the vehicle construction and general requirements for the approval of two- or
three-wheel vehicles and quadricycles (OJ L 25, 28.1.2014, p. 1, ELI: http://data.europa.eu/eli/reg_del/2014/44/oj).
(4) UN Regulation No 155 – Uniform provisions concerning the approval of vehicles with regards to cybersecurity and cybersecurity
management system [2025/5] (OJ L, 2025/5, 10.1.2025, ELI: http://data.europa.eu/eli/reg/2025/5/oj).
(5) Commission Delegated Regulation (EU) 2025/1455 of 23 July 2025 amending Delegated Regulation (EU) No 44/2014 as regards
laying down technical requirements and testing procedures regarding the protection of L-category vehicles against cyberattacks (OJ L,
2025/1455, 29.10.2025, ELI: http://data.europa.eu/eli/reg_del/2025/1455/oj).
ELI: http://data.europa.eu/eli/reg_del/2025/1535/oj 1/2EN
OJ L, 29.10.2025
(4) UN Regulation No 155 introduces certain cybersecurity requirements, including on the operation of a certified
cybersecurity management system, on software updates, covering organisations’ policies and processes for
cybersecurity risks related to the entire lifecycle of vehicles, equipment and services. It addresses cybersecurity risks
in a manner that is comparable to Regulation (EU) 2024/2847 and achieves at least the same level of protection as
that Regulation. In addition, UN Regulation No 155 ensures consistency with the overall type-approval framework
applying to L-category vehicles. Consequently, Regulation (EU) 2024/2847 should not apply to products with digital
elements falling within the scope of Regulation (EU) No 168/2013, with the exception of L1e category vehicles
designed to pedal referred to in Article 3, point (94)(b), of Regulation (EU) No 168/2013,
HAS ADOPTED THIS REGULATION:
Article 1
The application of Regulation (EU) 2024/2847 shall be excluded for products with digital elements falling within the scope
of Regulation (EU) No 168/2013.
However, that exclusion shall not apply to L1e category vehicles designed to pedal referred to in Article 3, point (94)(b), of
Regulation (EU) No 168/2013.
Article 2
This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the
European Union.
This Regulation shall be binding in its entirety and directly applicable in all Member States.
Done at Brussels, 29 July 2025.
For the Commission
The President
Ursula VON DER LEYEN
2/2 ELI: http://data.europa.eu/eli/reg_del/2025/1535/oj