See Full Document Text
Status: This is the original version (as it was originally made). This
item of legislation is currently only available in its original format.
STATUTORY INSTRUMENTS
2025 No. 1110
ROAD TRAFFIC
The Road Vehicles (Type-Approval)
(Amendment) (No. 3) Regulations 2025
Made - - - - 20th October 2025
Laid before Parliament 22nd October 2025
Coming into force - - 13th November 2025
The Secretary of State makes these Regulations in exercise of the powers conferred by Articles
5(3), 31(8), 36(4), 38(3) and 57(2) of Regulation (EU) 2018/858 of the European Parliament and
of the Council of 30 May 2018 on the approval and market surveillance of motor vehicles and
their trailers, and of systems, components and separate technical units intended for such vehicles,
amending Regulations (EC) No 715/2007 and (EC) No 595/2009 and repealing Directive 2007/46/
EC (“Regulation (EU) 2018/858”)(1).
The Secretary of State has consulted with representative organisations in accordance with Article
82(3) of Regulation (EU) 2018/858.
Citation, commencement and extent
1.—(1) These Regulations may be cited as the Road Vehicles (Type-Approval) (Amendment)
(No. 3) Regulations 2025.
(2) These Regulations come into force on 13th November 2025.
(3) These Regulations extend to England and Wales, Scotland and Northern Ireland.
Amendment of Regulation (EU) 2018/858
2.—(1) R egulation (EU) 2018/858 is amended as follows.
(2) In Article 57 (UN Regulations required for GB type-approval), after paragraph (2), insert—
“(3) UN Regulations and amendments made thereto which are compulsory and the dates
from which they are compulsory are specified in Annex XII.”.
(3) In Annex II (requirements for the purpose of GB type-approval of vehicles, systems,
components or separate technical units)—
(a) in Part I (regulatory acts for GB type-approval of vehicles produced in unlimited series)—
(1) EUR 2018/858, amended by S.I. 2019/648, S.I. 2022/1273, S.I. 2024/146, S.I. 2025/661, and S.I. 2025/796.Document Generated: 2025-11-13
Status: This is the original version (as it was originally made). This
item of legislation is currently only available in its original format.
(i)in the first table, after the row for item 74, insert—
“75 Cyber security UN X X X X X X
and cyber Regulation
security No 155
management
system
76 Software update UN X X X X X X X X X X”;
and software Regulation
update No 156
management
system
(ii)in Appendix 1 (regulatory acts for GB type-approval of vehicles produced in medium
series pursuant to Article 41)—
(aa)in Table 1 (M vehicles), after the row for item 73, insert—
1
“75 Cyber security UN Regulation X
and cyber No 155
security
management
system
76 Software UN Regulation X”;
update and No 156
software
update
management
system
(bb)in Table 2 (N Vehicles), after the row for item 73, insert—
1
“75 Cyber security UN Regulation X
and cyber No 155
security
management
system
76 Software UN Regulation X”;
update and No 156
software
update
management
system
(b) in Part III (list of regulatory acts setting out the requirements for the purposes of GB type
approval of special purpose vehicles)—
(i)in Appendix 1 (motor-caravans, ambulances and hearses), in the table, after the row
for item 73, insert—
2Document Generated: 2025-11-13
Status: This is the original version (as it was originally made). This
item of legislation is currently only available in its original format.
“75 Cyber security and UN Regulation No X X X X
cyber security 155
management system
76 Software update UN Regulation No X X X X”;
and software update 156
management system
(ii)in Appendix 2 (armoured vehicles), in the table, after the row for item 73, insert—
“75 Cyber security UN X X X X X X
and cyber Regulation
security No 155
management
system
76 Software update UN X X X X X X X X X X”;
and software Regulation
update No 156
management
system
(iii)in Appendix 3 (wheelchair accessible vehicles), in the table, after the row for item
73, insert—
“75 Cyber security and UN Regulation No X
cyber security 155
management system
76 Software update UN Regulation No X”;
and software update 156
management system
(iv)in Appendix 4 (other special purpose vehicles), in the table, after the row for item
73, insert—
“75 Cyber security UN Regulation X X X X X
and cyber No 155
security
management
system
76 Software update UN Regulation X X X X X X X X X”;
and software No 156
update
management
system
(v)in Appendix 5 (mobile cranes), in the table, after the row for item 73, insert—
“75 Cyber security and UN Regulation No X N/A in case of
cyber security 155 complete vehicle
management system
3Document Generated: 2025-11-13
Status: This is the original version (as it was originally made). This
item of legislation is currently only available in its original format.
76 Software update UN Regulation No X”;
and software update 156
management system
(vi)in Appendix 6 (exceptional load transport vehicles), after the row for item 73,
insert—
“75 Cyber security UN Regulation X
and cyber No 155
security
management
system
76 Software update UN Regulation X X”.
and software No 156
update
management
system
(4) In Annex IV (conformity of production procedures), after point 4.6, insert—
“5. Arrangements concerning software update
The software update management system of the manufacturer as well as the whole vehicle
type must comply with the requirements of UN Regulation No 156.”.
(5) In Annex XII (UN regulations required for GB type-approval)—
(a) in Table 1 (list of UN regulations referred to in Article 57 which apply on a compulsory
basis), before the row for Regulation Number 157, insert—
“155 Cyber security and cyber security Original version of UN Regulation No M, N
management system 155
156 Software update and software update Original version of UN Regulation No M, N,
management system 156 O”;
(b) in Table 2 (Scope of application of the requirements referred to in Article 57 - applicable
categories per subject)—
(i)before the row for systems replacing the driver’s input to controls, insert—
“Cyber security X X X X X X
Software update X X X X X X X X X X”;
(ii)in the explanatory notes, before note IF, insert—
“X: Vehicles must meet the requirements.”;
(c) after the explanatory notes to Table 2, insert—
“Table 3 - Implementation dates for the requirements for cyber security and cyber
security management system for vehicles of categories M , M , M , N , N and N
1 2 3 1 2 3
Vehicle Category Date of refusal to Date for the Date for the Date for the
grant GB type- prohibition of prohibition of prohibition of
approval to new registration of registration of registration of
4Document Generated: 2025-11-13
Status: This is the original version (as it was originally made). This
item of legislation is currently only available in its original format.
types of complete new complete new completed new special
and base vehicles vehicles and vehicles purpose vehicles
completed
vehicles
incorporating a
noncompliant
base vehicle
M , M , M , N , 1 June 2026 1 June 2027 1 June 2028 7 July 2029
1 2 3 1
N , N
2 3
Table 4 - Implementation dates for the requirements for
software update and software update management system for
vehicles of categories M , M , M , N , N , N , O , O , O and O
1 2 3 1 2 3 1 2 3 4
Vehicle Category Date of refusal to Date for the Date for the Date for the
grant GB type- prohibition of prohibition of prohibition of
approval to new registration of registration of registration of
types of complete new complete new completed new special
and base vehicles vehicles and vehicles purpose vehicles
completed
vehicles
incorporating a
noncompliant
base vehicle
M , M , M , N , 1 June 2026 1 June 2027 7 July 2029 7 July 2029”;
1 2 3 1
N , N , O , O ,
2 3 1 2
O , O
3 4
Amendment of Regulation (EU) 2020/683
3.—(1) Commission Implementing Regulation (EU) 2020/683(2) is amended as follows.
(2) In Article 8—
(a) the existing text becomes sub-paragraph “1.”;
(b) after that sub-paragraph, insert—
“2. A certificate of conformity which is issued using the template provided for in
Annex VIII as it has effect immediately before the coming into force of these Regulations,
is to be treated as a GB certificate of conformity issued in accordance with Article 36(1)
of Regulation (EU) 2018/858, if—
(a) the vehicle to which it applies was manufactured before 1 June 2027; and
(b) a valid GB type-approval granted in accordance with Regulation (EU) 2018/858
applies to the vehicle.”.
(3) In Annex I, in the template for an information document for the GB type-approval of vehicles,
systems, components or separate technical units, after point 12.10.3.2, insert——
“12.11. [Intentionally blank]
(2) EUR 2020/683, amended by S.I. 2022/1273 and S.I. 2024/146.
5Document Generated: 2025-11-13
Status: This is the original version (as it was originally made). This
item of legislation is currently only available in its original format.
12.12. [Intentionally blank]
12.13. [Intentionally blank]
12.14. Cyber security
12.14.1. General construction characteristics of the vehicle type, including:
(a) the vehicle systems which are relevant to the cyber security of the vehicle type;
(b) the components of those systems that are relevant to cyber security;
(c) the interactions of those systems with other systems within the vehicle type and external
interfaces ...
12.14.2. Schematic representation of the vehicle type: ...
12.14.3. The number of the Certificate of Compliance for cyber security management system: ...
12.14.4. Documents for the vehicle type to be approved describing the outcome of its risk
assessment and the identified risks: ...
12.14.5. Documents for the vehicle type to be approved describing the mitigations that have been
implemented on the systems listed, or to the vehicle type, and how they address the stated risks: ...
12.14.6. Documents for the vehicle type to be approved describing the protection of dedicated
environments for aftermarket software, services, applications or data: ...
12.14.7. Documents for the vehicle type to be approved describing what tests have been used to
verify the cyber security of the vehicle type and its systems and the outcome of those tests: ...
12.14.8. Description of the consideration of the supply chain with respect to cyber security: ...
12.15. Software update
12.15.1. General construction characteristics of the vehicle type: ...
12.15.2. The number of the Certificate of Compliance for software update management: ...
12.15.3. Security measures
12.15.3.1. Documents for the vehicle type to be approved describing that the update process will
be performed securely: ...
12.15.3.2. Documents for the vehicle type to be approved describing that the update process will
be performed securely: ...
12.15.4. Software updates over the air
12.15.4.1. Documents for the vehicle type to be approved describing that the update process will
be performed safely: ...
6Document Generated: 2025-11-13
Status: This is the original version (as it was originally made). This
item of legislation is currently only available in its original format.
12.15.4.2. Description of the means of informing vehicle users about an update before and after
its execution: ...
12.15.5. Manufacturer’s declaration of compliance with the requirements for Software Update
Management Systems”.
(4) In Annex VIII (certificate of conformity in paper format), in the Appendix (templates for the
certificate of conformity in paper format)—
(a) in Part I (complete and completed vehicles)—
(i)in vehicle categories M , M , M , N , N , and N , in each case, after point 52, insert—
1 2 3 1 2 3
“55. Vehicle certified in accordance with UN Regulation No 155: yes/no (4)
56. Vehicle certified in accordance with UN Regulation No 156: yes/no (4)”;
(ii)in vehicle categories O and O , and O and O , in each case, after point 52, insert—
1 2 3 4
“55. In the case of a vehicle approved to UN Regulation No 155, vehicle certified
in accordance with UN Regulation No 155: yes/no (4)
56. In the case of a vehicle approved to UN Regulation No 156, vehicle certified
in accordance with UN Regulation No 156: yes/no (4)”;
(b) in Part 2 (incomplete vehicles)—
(i)in vehicle categories M , M , M , N , N , N , in each case, after point 52, insert—
1 2 3 1 2 3
“55. Vehicle certified in accordance with UN Regulation No 155: yes/no (4)
56. Vehicle certified in accordance with UN Regulation No 156: yes/no (4)”;
(ii)in vehicle categories O and O , and O and O , in each case, after point 52, insert—
1 2 3 4
“55. In the case of a vehicle approved to UN Regulation No 155, vehicle certified
in accordance with UN Regulation No 155: yes/no (4)
56. In the case of a vehicle approved to UN Regulation No 156, vehicle certified
in accordance with UN Regulation No 156: yes/no (4)”.
Signed by authority of the Secretary of State for Transport
Simon Lightwood
Parliamentary Under Secretary of State
20th October 2025 Department for Transport
7Document Generated: 2025-11-13
Status: This is the original version (as it was originally made). This
item of legislation is currently only available in its original format.
EXPLANATORY NOTE
(This note is not part of the Regulations)
These Regulations amend Regulation (EU) 2018/858 and Commission Implementing Regulation
(EU) 2020/683 to make compliance with two UNECE Regulations (UNECE Regulation No 155 on
cyber security and cyber security management systems and UNECE Regulation No 156 on software
updates and software update management systems) compulsory for vehicles applying for GB type
approval.
Regulation 2 updates the list of technical requirements in Annex II of Regulation (EU) 2018/858 that
must be met at type approval in the GB scheme to include UNECE Regulations No 155 and No 156,
and procedures relating to conformity of production in Annex IV of that Regulation to reference
arrangements concerning software updates. It also updates Annex XII of that Regulation to outline
the dates on which the requirements apply.
Regulation 3 updates the information document used to make an application for type approval set out
in Annex I of Commission Implementing Regulation (EU) 2020/683 to include provision on cyber
security and software updates. It also updates Annex VIII of that Regulation to ensure that certificates
of conformity contain references to UNECE Regulations No 155 and No 156 where appropriate.
The net costs imposed on business, the voluntary sector and the public sector by these Regulations
have been assessed as being less than £10m in any year and therefore a full impact assessment has
not been prepared.
The UN Regulations are issued by the United Nations Economic Commission for Europe. Copies
of the UN Regulations referred to in these Regulations can be obtained from the UNECE website:
http://www.unece.org/trans/main/wp29/wp29regs.html.
An Explanatory Memorandum and a de minimis assessment have been prepared and are available
alongside this instrument at www.legislation.gov.uk. Hard copies may be obtained from the
Department for Transport, Great Minster House, 33 Horseferry Road, London, SW1P 4DR.
8