The new EU law on automotive cybersecurity comes into effect soon: Some cars are disappearing from the road

The European Union began implementing road safety regulations back in 2019 and adopted the General Vehicle Safety Regulation, which then represented a series of mandatory advanced driver assistance systems aimed at increasing road safety, and a legal framework was established for the approval of automated and fully autonomous vehicles in the EU.

Now, more specifically, from July 7 of this year, new regulations on automotive cybersecurity are arriving due to fears of espionage and information gathering by third parties. All these advanced systems, numerous electronic components, cameras, and sensors have now become a major problem as they enable tracking, spying, and sending data to companies or some third parties with malicious intent. Indeed, the electronic equipment of cars serves not only the comfort of drivers and their safety in traffic but simultaneously allows for better tracking of cars and their users.

R155 and R156

This has been recognized by the United Nations and the European Union, and new regulations R155 and R156 have been adopted concerning automotive cybersecurity and software updates. These rules also impose stricter requirements on car manufacturers and their suppliers, which will affect car manufacturers, and some of them have already announced that certain models will not be sold in the Union market.

Specifically, regulation R155 represents an international standard concerning cybersecurity and the cybersecurity management system in vehicles. This regulation was developed under the auspices of the United Nations to ensure the safety of connected and autonomous vehicles.

The regulation applies to vehicles with electronic control, diagnostic, or communication systems and to information and communication systems (CS/DS/CSM systems) that are integrated into such vehicles. Additionally, the regulation sets requirements for vehicle cybersecurity to ensure they are protected from cyber threats. This includes protection against unauthorized access, data protection, and identification of security risks.

Furthermore, the new regulation requires manufacturers to implement a cybersecurity management system (CSMS) that will enable them to identify, analyze, and manage security risks throughout the vehicle’s lifecycle. Finally, all vehicles that comply with the regulation must be certified to prove that they meet the prescribed requirements for cybersecurity and the cybersecurity management system.

The second regulation R156 relates to battery safety in electric vehicles and sets standards and requirements for batteries used in electric vehicles to ensure their safety during use, storage, and transport.

National Security

As is increasingly heard from the EU, the issue of automotive cybersecurity is also a matter of national security because it involves sensitive data that can be collected or is already being collected. As German economic expert Moritz Schularick stated, ‘electric cars with numerous cameras and sensors are, from the perspective of intelligence agencies, spy machines on four wheels.’

Schularick warned last year that ‘cars moving around Berlin are recording everything happening around them and forwarding data to their companies and parent corporations in China.’ It is clear that Schularick was referring to the influx of cheaper Chinese electric models that are slowly but surely capturing Union markets, raising questions about tariffs to curb cheap Chinese imports.

What Schularick is saying is also confirmed by a new study titled ‘Automotive Cyber Security‘ conducted by the Center of Automotive Management (CAM) and Cisco Systems in March 2024, which concludes that ‘with the increasing networking and digitalization of cars, production, and logistics, the risk of cyberattacks on the automotive industry is rising.’

– The state of cyber danger for the automotive industry is constantly increasing. With the spread of software-defined vehicles, electromobility, autonomous driving, and networking, cyber risks are further heightened – concludes study leader Stefan Bratzel, director of CAM.

The study shows with concrete examples how the industry is already threatened. For instance, Toyota had to halt production two years ago because one supplier ‘was likely the target of a cyberattack.’ In the summer of 2022, tire manufacturer Continental also suffered a cyberattack when hackers stole data from their systems. In March 2023, car manufacturer Tesla was also attacked. Hackers infiltrated one vehicle and were able to perform various functions. They could honk the horn, open the trunk, turn on the headlights, and manipulate the infotainment system.

New rules mean fewer models

Due to the new rules, manufacturers will stop producing certain models. For Volkswagen, these are the Up model and the T6.1 transporter, while for Porsche, these are the Macan, Boxster, and Cayman models, which will in the future with internal combustion engines only be exported, as reported by the German news agency dpa. Audi, Renault, and Smart also announce that they will no longer produce older models. Thomas Schäfer, a member of the board and head of the passenger car division at Volkswagen, explained this in a statement to dpa as the excessive effort required to comply with all the new rules.

– We would have to integrate a completely new electronic architecture. That would simply be too expensive – said Schäfer.

This was also confirmed by Wiebke Fastenrath, spokesperson for Volkswagen’s commercial vehicle division in an interview with DW.

– To implement the legal regulations for the electronic architecture of the T6.1 model, we would need very large investments in a platform that is nearing the end of its life. Due to the short remaining time planned for the production of that model, those investments were not approved, especially since a modernized model is already on the market – she said.

However, it seems that Mercedes is excellently prepared for this. Company spokesperson Juliane Weckenmann stated for DW that the new regulations ‘will have no consequences for the Mercedes-Benz portfolio.’

– All our architectures meet these requirements and are already or will be timely certified according to UN regulations R155 and R156 – she said.

Volkswagen also believes they are ready for the new challenge and state that their models will be adapted to the new regulations by 2025.