EU: Adoption of cybersecurity rules for L-category vehicles

 

The EU has published a delegated act to implement UN 155 for L-category vehicles.

UN Regulation No 155 establishes cybersecurity requirements for vehicles and has recently been revised to include L-category vehicles (i.e., light motor vehicles such as those with two, three, or four wheels). To align with this update, a Commission Delegated Regulation is being adopted alongside to make the application of UN R 155 mandatory for these vehicles from 11 December 2027, coinciding with the date the Cyber Resilience Act (CRA) becomes applicable.

To prevent overlapping legal obligations, this Delegated Regulation excludes from the CRA’s scope any products with digital elements that are already regulated under Regulation (EU) 168/2013.

The Cyber Resilience Act (Regulation (EU) 2024/2847) empowers the Commission to restrict or exclude its application to products with digital elements covered by other EU legislation that already addresses, fully or partially, the same cybersecurity risks as the CRA.

UN Regulation No 155 on Cybersecurity and Cybersecurity Management Systems was already made mandatory under Regulation (EU) 2019/2144, which is why products with digital elements falling under that regulation were excluded from the CRA by the co-legislators.

Following its recent update, UN R 155 now also covers L-category vehicles. A new Delegated Regulation [C(2025) 4842], which amends Delegated Regulation (EU) No 44/2014, establishes technical requirements and testing procedures to protect L-category vehicles against cyberattacks. This regulation makes compliance with UN R 155 mandatory for type approval of new L-category vehicles from 11 December 2027, and for existing vehicle types from 11 June 2029.

UN Regulation No 155 provides cybersecurity protection comparable to that of the CRA and ensures coherence within the type-approval framework for L-category vehicles. Therefore, to ensure legal consistency and avoid duplication, this Delegated Act supplements the CRA by excluding products covered by Regulation (EU) 168/2013.

However, products with digital elements that are pedal cycles falling under category L1e (as defined in Annex I of Regulation (EU) 168/2013) remain subject to the CRA, as they are not included in the scope of UN R 155 under the upcoming Delegated Regulation [C(2025) 4842].

To find out more about the EU regulations for L-category vehicles, please do not hesitate to contact the Institute for Global Automotive Regulatory Research.