On 11 November 2026, WP.29 working papers and DETA guidance published on the GlobalAutoRegs site set out new administrative steps for how cyber‑security and software‑update management-system certificates will be handled in the type‑approval process. The documents formalise recent GRVA decisions on amendments to UN Regulations No. 155 and 156 and publish updated guidance for the Database for the Exchange of Type Approval documentation (DETA).

What WP.29 and GRVA decided

The GRVA package published in the dossier (document reference GRVA‑26‑35) proposes changes to UN R155 (Cyber Security Management Systems) and R156 (Software Update Management Systems) that alter approval‑authority arrangements. The text requires stricter alignment between a vehicle’s type approval and the Certificate(s) of Compliance for CSMS/SUMS: approval authorities would not accept a first‑time type approval unless the relevant Certificate(s) of Compliance are issued in a manner clearly tied to the authority granting the vehicle type approval. The proposal was prepared by the UK, France, Luxembourg, Germany and the Netherlands and is listed as "Document status: Approved by GR."

At the same time, the DETA workstream published Guidelines for the exchange of cyber‑security information (DETA‑57‑03) on 11 November 2026. The guidance requires notifying approval authorities to upload cyber security documentation as PDF files to DETA no later than 14 days before granting a first‑time approval, to fill mandatory fields (approval number and date), and to notify other approval authorities via DETA. Other authorities may submit comments within 14 days and these must be uploaded without undue delay. The DETA report also records that 41 Contracting Parties have notified focal points and that more than 153,000 approvals have been uploaded to the system so far.

Why regulators moved

The measures respond to long‑running concerns about traceability and shared responsibility in cross‑border approvals for software‑intensive vehicles. GRVA documents and DETA minutes show work since summer 2026 on aligning software identification (RXSWIN), certificates of compliance and the database exchange procedures so that cyber and update management responsibilities are clear across multiple approval authorities and manufacturers. The texts also propose changes to the 1958 Agreement wording to clarify acceptance of third‑party Certificates of Compliance.

What this means for the market

For OEMs and suppliers in Central and Eastern Europe the changes are practical and immediate: administrative steps will be tightened and interactions between national approval authorities will be formalised through DETA. That raises two predictable impacts. First, manufacturers that previously relied on a distant approval authority’s Certificate of Compliance will face clearer rules about who is responsible for issuing and maintaining those certificates — increasing the paperwork and the need to coordinate with the authority tied to the vehicle type approval. Second, the DETA deadlines (upload 14 days before first‑time approval; 14‑day comment window) create new scheduling constraints for homologation timelines and for technical services that prepare CSMS/SUMS evidence. These procedural changes do not change technical cybersecurity requirements themselves, but they do alter how and where compliance is evidenced and who bears formal responsibility during approval.

Companies with R&D or compliance teams in CEE should review their current type‑approval workflows and confirm which approval authority will be the formal issuer of CSMS/SUMS Certificates for each vehicle program. National approval authorities and Technical Services should also be ready to use the updated DETA features (two‑factor authentication, notifications) and to meet the 14‑day exchange timings now recorded in the guidance.

Available vehicles now on WorldTrader24 →

Sources: GlobalAutoRegs (UNECE WP.29 / GRVA documents), DETA report (DETA‑57‑03).