Every software update now needs a managed, approved system.
UN R156 requires a certified Software Update Management System and the ability to deliver vehicle software updates — including over-the-air — safely, securely and traceably, with RXSWIN identifying the approved software state of each type. Setu Innovation builds the SUMS and the secure-update engineering behind it.
- UNECE WP.29
- New types · Jul 2022
- All new vehicles · Jul 2024
- Covers OTA & RXSWIN
If your vehicles receive software updates, R156 applies.
R156 binds vehicle manufacturers whose type-approved vehicles can receive software updates — the same vehicle categories as R155. A certified SUMS is a precondition for approval of software-updatable types.
A 20-second self-check
- Can your vehicles' software be updated after production?
- Do you deliver, or plan to deliver, updates over the air?
- Can you identify the approved software state of each type (RXSWIN)?
- Can you guarantee update integrity, authenticity and safe execution?
Mostly "yes"? You need a certified SUMS and secure-update engineering. R156 is the companion to R155 — most programmes run both together. A short call confirms the path.
What you'll have to demonstrate.
R156 has two layers: a certified update-management system, and proof that each update is safe, secure and identifiable.
A certified management system
An audited Software Update Management System covering the processes, roles and tooling to manage updates across the lifecycle — certified before software-updatable types are approved.
Software identification
Maintain the RXSWIN for each type so the approved software state is identifiable, and so you can recognise when an update affects type-approval-relevant parameters.
Update integrity & authenticity
Protect updates against tampering and rollback: signing, integrity verification, authenticity, and protection of the update process end to end.
Safe updates
Assess each update's impact on type approval and vehicle safety, execute it safely, and inform the user where required — no update should compromise a safe state.
Over-the-air requirements
Where updates are delivered over the air, satisfy the additional requirements: secure delivery, configuration awareness, fail-safe behaviour and user information.
Traceability across the fleet
Keep records of software versions and updates so the state of each vehicle and type is traceable over its life.
From management system to delivered update.
R156 connects an organisation-level SUMS certificate to identifiable software states and the safe, secure mechanism that delivers them — alongside R155.
SUMS certificate
The audited, organisation-level certificate a manufacturer must hold before software-updatable vehicle types can be approved.
RXSWIN
The software identification number that ties type-approval-relevant software to a type, so changes that affect approval can be recognised and managed.
OTA delivery
Over-the-air updates bring extra requirements — secure delivery, fail-safe execution, configuration awareness and user information — built on a robust update architecture.
R155 companion
R156 handles software updates; R155 handles cybersecurity management. They're designed to work together, and most connected-vehicle programmes need both.
R156 is won in the SUMS and the update pipeline.
The SUMS has to be real and the update mechanism has to be secure and safe by design. Setu does the advisory and the engineering, in one team.
Scope & gap
Map your update programme against R156, settle the SUMS scope and RXSWIN strategy, and produce a prioritised gap to certification.
Engineer the SUMS & OTA
Stand up the SUMS processes, the RXSWIN management, and the secure-update architecture — signing, integrity, rollback protection and safe, fail-safe OTA delivery.
Reach approval
Package the SUMS evidence for the technical service, rehearse the audit, and pre-review the update and RXSWIN records before submission.
R156, answered plainly.
When does R156 apply?
Like R155, it's been mandatory in the EU for new vehicle types since July 2022 and for all new vehicle registrations since July 2024, under the UNECE 1958 Agreement.
What is a SUMS?
A Software Update Management System — the certified framework for managing software updates safely and securely across the lifecycle. R156 requires a SUMS certificate before software-updatable types can be approved.
What is RXSWIN?
The Regulation X Software Identification Number identifies the software relevant to type-approved parameters for a type — so you and the authority can track the approved software state and tell when an update affects approval.
Does R156 require OTA?
No — it doesn't force OTA, but if you deliver updates over the air it adds requirements: secure delivery, integrity, user information and safe execution. The SUMS must cover whatever mechanism you use.
What's the difference between R156 and R155?
R156 covers the SUMS and safe, secure software updates; R155 covers the CSMS and per-type cybersecurity. They're companion regulations — most connected-vehicle manufacturers need both.
Stand up a compliant R156 update process.
A focused review: the SUMS scope, your RXSWIN and OTA strategy, the gap to certification, and the realistic route to approval. Tell us where you are and we'll take it from there — or ask for a call if that's easier.
Talk to our team →