R155, NIS2 and the Cyber Resilience Act: what changes for the automotive supply chain

In brief

For an automotive supplier, cybersecurity today comes from three different sources: the UNECE type-approval regulations, which arrive through contracts with manufacturers; NIS2, which applies to the company; and the Cyber Resilience Act, which applies to digital products sold outside vehicle type approval. They have different addressees, timelines and authorities, but they largely ask for the same capabilities.

UN R155 and R156: the condition for type approval

UNECE Regulations R155 (cybersecurity management) and R156 (software update management) are mandatory in the European Union for cars, light commercial vehicles, buses, trucks and trailers fitted with electronic control units (categories M, N and O): for new types since July 2022, and for all new vehicles since July 2024. Without a certified cybersecurity management system (CSMS), the manufacturer does not obtain type approval.

The CSMS covers the whole vehicle life cycle: threat analysis and risk assessment (TARA) for each type, vulnerability monitoring, incident response and supplier management. Under R156, software updates, including over-the-air ones, must be authenticated and traced, and must not compromise type approval.

What reaches suppliers

R155 is addressed to manufacturers, not suppliers. But a manufacturer cannot show that it controls the risks of its supply chain without asking for evidence from those who supply its components and software. That is why the requirements arrive in specifications and contracts:

• development processes compliant with ISO/SAE 21434, the cybersecurity engineering standard for road vehicles;
• agreements that set out who does what on the security of the component throughout its life cycle;
• timely communication of vulnerabilities discovered after delivery;
• for corporate information security, often a TISAX assessment.

NIS2: the company, not the product

Legislative Decree 138/2024 lists the manufacture of motor vehicles, trailers and semi-trailers among the sectors in Annex II. The entry corresponds to NACE division C29, which also includes the manufacture of parts and accessories: component suppliers fall within it, and electronics may fall under other entries in the same annex. Those operating in it that are at least medium-sized enterprises are important entities, unless ACN classifies them as essential. The obligations concern the organisation: security measures, incident notification, accountability and training of management bodies, supply chain security.

For those entering the NIS list in 2026, ACN Determination 127434/2026 sets notification of significant incidents from 1 January 2027 and baseline security measures by 31 July 2027. The CSIRT contact person must be designated by 31 December of the year of inclusion (ACN Determination 127437/2026).

Cyber Resilience Act: what falls outside type approval

Regulation (EU) 2024/2847 excludes products to which Regulation (EU) 2019/2144 on type approval applies: the vehicle, but also type-approved systems, components and separate technical units, as well as spare parts identical to the originals. Products with digital elements sold outside that type approval remain within its scope, as is often the case for telematics and fleet management boxes installed after registration, connected accessories, diagnostic tools, wallboxes and software sold separately. The boundary has to be assessed product by product.

From 11 September 2026, manufacturers of these products must report actively exploited vulnerabilities and severe incidents to ENISA and the national CSIRT through the single reporting platform: early warning within 24 hours, notification within 72 hours, final report within 14 days of the fix for vulnerabilities or within one month of the notification for incidents. The other obligations, from secure design to CE marking, apply from December 2027.

The picture in one table

Not just theory: three cases

• 2022, Toyota. An attack on the component supplier Kojima Industries stopped 28 lines in 14 Japanese plants for one day, with lost production estimated at about 13,000 vehicles.
• 2025, Jaguar Land Rover. After a cyber attack on 31 August, production stopped from 1 September and restarted gradually only on 8 October. Many suppliers had to lay off staff, and the British government guaranteed a £1.5 billion loan.
• 2025, Stellantis. The group confirmed the theft of North American customers’ contact data through the platform of a customer service provider.

In all three cases the weak point was not the vehicle, but the company or one of its suppliers.

Where to start

1. List customers, contracts and the cyber requests already received.
2. Check whether the company falls within NIS2 and with which classification.
3. List the products with digital elements sold outside type approval: these are the ones subject to the Cyber Resilience Act.
4. Set up a single vulnerability and incident management process, with the deadlines of all the regulations.
5. Carry out a gap analysis of the development processes against ISO/SAE 21434.

Sources

UNECE Regulations No 155 and No 156; Regulation (EU) 2019/2144; Regulation (EU) 2024/2847 (Cyber Resilience Act), Articles 2 and 14; Legislative Decree 138/2024, Annex II; ACN Determinations No 127434 and No 127437 of 13 April 2026; ICT Security Magazine, “UN R155 e R156” (March 2026); Automotive IQ on the exclusion in Article 2(2)(c) of the CRA (September 2026); Cybersecurity360 on CRA reporting obligations (September 2026); for the cases: Autocar Pro (Toyota, 2022), Automoto.it, The National and Computing (Jaguar Land Rover, 2025), BleepingComputer (Stellantis, 2025). Sources consulted on 3 November 2026. This article is for information only and does not replace reading the legal texts or your customers’ contractual requirements.