EU: Updates on access to vehicle on-board diagnostics (OBD) requirements

 

The EU Commission has published a Commission Delegated Regulation amending Regulation (EU) 2018/858 as regards the standardised access to vehicle on-board diagnostics information and repair and maintenance information, and the requirements and procedures for secure access to on-board diagnostic information.

Regulation (EU) 2018/858 obliges manufacturers to grant independent operators unrestricted, standardised, and non-discriminatory access to vehicle on-board diagnostics (OBD) information, diagnostic and other equipment tools, including complete references and available software downloads, as well as vehicle repair and maintenance information. The detailed requirements and specific arrangements governing this access are established in Annex X of that Regulation. These provisions are designed to ensure fair competition and promote vehicle repairability. Conversely, the General Safety Regulation (Regulation (EU) 2019/2144) requires vehicle manufacturers to safeguard vehicles against evolving cybersecurity threats. The proposal currently under consultation seeks to update Annex X in order to enable more effective yet secure access to vehicle RMI and OBD information.

The relevant provisions have been introduced through Commission Delegated Regulation (EU) 2022/1398, which references UN Regulation No. 155. However, this UN Regulation clearly states that it applies “without prejudice to (…) regional or national legislations governing the access by authorized parties to the vehicle, its data, functions and resources, and conditions of such access.” Consequently, the application of cybersecurity rules cannot justify any measure that would restrict access to vehicle OBD information beyond what is explicitly allowed under Regulation (EU) 2018/858.

In its judgment in Case C-296/22, A.T.U. Auto-Teile-Unger and Carglass of 5 October 2023, the European Court of Justice confirmed this interpretation, ruling that vehicle manufacturers cannot impose conditions on access to OBD information other than those set out in Regulation (EU) 2018/858. The Court also reaffirmed that the technical cybersecurity requirements in UN Regulation No. 155 do not affect the type-approval rules on vehicle data access contained in Annex X of Regulation (EU) 2018/858. Under the current legislation, vehicle manufacturers are therefore prevented from implementing effective cybersecurity measures to protect against attacks linked to access to vehicle OBD systems. To address this, Annex X must be amended to define the specific cybersecurity measures manufacturers may adopt, in line with the requirements of Regulation (EU) 2019/2144.

Furthermore, the provisions of Annex X should be revised and clarified to reflect technological progress — particularly to support faster software updates by independent operators, improve repair and maintenance processes for vehicle batteries and advanced driver assistance systems, and ensure equal access to OBD information through means other than the standardised connector. These new measures are expected to substantially enhance vehicle repairability and lower repair costs for electric vehicles. This initiative forms part of the recently adopted Industrial Action Plan for the European automotive sector, which seeks to accelerate the transition toward zero-emission vehicles.

To find out more about regulations for EU vehicle regulations, please do not hesitate to contact the Institute for Global Automotive Regulatory Research.