Connected Vehicles
Connected Vehicle Compliance: Radio, Cybersecurity, and Software Updates
Regulatory approval for telematics, V2X, in-vehicle radios, and software-defined vehicle features: communications regulator type approval in every market, UNECE R155 cybersecurity, R156 software updates, and data requirements.
The category
The connected vehicle answers to the vehicle authority, the communications regulator, and the cybersecurity framework, and the answers have to agree.
The regulatory convergence
Connectivity turned the vehicle into a radio platform and a software product. Regulation has caught up with both.
A connected vehicle carries a telematics control unit with cellular and GNSS, Wi-Fi and Bluetooth for occupants, V2X for cooperative safety, UWB and low-frequency radios for digital keys, and radar and other RF sensors for driver assistance. Every one of those transmitters needs type approval from the communications regulator in every market where the vehicle is sold. The rules differ by country: band availability, power limits, modular approval policies, local testing requirements, and local holder rules. Vehicle type approval covers EMC under UNECE R10, but not radio authorization.
Connectivity also made the vehicle a cybersecurity and software target, and regulators responded. UNECE R155 requires a certified cybersecurity management system and vehicle-type cybersecurity evidence as a condition of type approval. UNECE R156 requires a software update management system and controls over updates that affect type-approved systems. Both are in force in the EU, Japan, Korea, and other contracting parties, with the US and China taking their own approaches. Data protection rules govern what vehicle data can be collected, where it's processed, and what consent is required.
ORBIS Compliance manages the radio approvals for connected vehicles and their components across markets, and helps manufacturers and suppliers scope and document the cybersecurity, software update, and data evidence that connected features now require for market access.
Connected features
What connected vehicle systems are regulated for
Telematics and cellular
TCUs with LTE and 5G modems, GNSS, and eCall or emergency call functions, under radio type approval, carrier requirements, and emergency call regulations by market.
V2X communication
Vehicle-to-everything radios under DSRC or C-V2X, with spectrum allocations and technology choices that differ sharply between the EU, US, China, and other markets.
Occupant connectivity
Wi-Fi hotspots, Bluetooth, and wireless charging, with radio approval and RF exposure considerations in every market.
Digital keys and sensors
UWB, low-frequency, and NFC for keyless entry, plus radar and other RF sensors for ADAS, each with distinct regulatory limits and approval routes.
Cybersecurity
UNECE R155 cybersecurity management system certification and vehicle-type evidence, with ISO/SAE 21434 as the working framework and supplier flow-down.
Software updates
UNECE R156 software update management, including controls on over-the-air updates that affect type-approved systems and RXSWIN identification.
Radio approval at vehicle scale
Six radios, forty markets, and a firmware update every quarter.
The radio approval workload in a connected vehicle program is large and continuous. Each transmitter needs approval in each market. Approvals may be held at the module, component, or vehicle level depending on the market and the integration, in the OEM's, the supplier's, or a local holder's name. Band availability varies: a V2X technology allocated spectrum in one region may be unavailable in another; a 6 GHz Wi-Fi hotspot may not be permitted in some markets. Firmware updates that change radio behavior can trigger variation filings across the whole market footprint.
Managing this by market and by radio, through separate agents, is where connected vehicle programs lose control. Nobody sees the whole matrix, and an over-the-air update that's routine for engineering becomes a regulatory event in a dozen countries.
ORBIS scopes the radio approvals for every transmitter across every market as one program, clarifies holder arrangements with OEM and suppliers, provides local representation where required, and tracks the approvals in ORBIS Intelligent Compliance so an update is assessed against every affected grant before it deploys.
Software-defined features
When a feature arrives by update, the regulator wants to know it was approved.
Over-the-air updates that add or change functions in type-approved systems are governed by R156 where it applies. The manufacturer needs a software update management system, a way to identify software versions relevant to type approval, and a process to determine whether an update requires a new or extended approval. Features that affect radio behavior touch the communications approvals too. And updates to connected features carry cybersecurity implications under R155.
ORBIS tracks these regulations as they extend to new markets and new vehicle categories through law impact analysis, and helps OEMs and suppliers assess each update against the approvals it affects.
Questions
Connected vehicle compliance
Who holds the radio approvals for a connected vehicle, the OEM or the supplier?
+
It varies by market and by how the radio is integrated. Some markets approve at the module level, some at the component, and some require vehicle-level filings. The holder may need to be a local entity. The arrangement should be agreed between OEM and supplier per market before filing. ORBIS maps the options and manages the filings and holders.
Can we launch V2X globally with one technology?
+
No. Spectrum allocation and technology choices for V2X differ between the EU, US, China, and other markets, and some have not settled. A V2X module may need to support different technologies or be disabled in some markets. ORBIS confirms the position per market before the connectivity architecture is locked.
How do R155 and R156 apply outside the EU?
+
They're UNECE regulations adopted by contracting parties including the EU, UK, Japan, and Korea, with type approval dates that have phased in. The US and China take different regulatory approaches to vehicle cybersecurity. ORBIS tracks which markets apply which requirements from which dates for your vehicle categories.
Connected in every market, approved by every regulator that has a say.
Bring the connectivity architecture, the radios, the update mechanism, and the markets. We'll map the radio approvals, the cybersecurity and software update evidence, and the data requirements each one carries.
Book a Discussion