| Regulation | Jurisdiction | Mandatory From | Enforcement Body |
|---|---|---|---|
| UNECE R155 (Cybersecurity) | EU, Japan, Korea, others | July 2022 (new types); July 2024 (all new vehicles) | National type approval authority (KBA/Germany, DVSA/UK, NHTSA/US not yet) |
| UNECE R156 (Software Updates) | EU, Japan, Korea | July 2022 (new types); July 2024 (all) | Same as R155 |
| FMVSS (Federal Motor Vehicle Safety Standards) | USA | Per standard effective dates | NHTSA; non-compliance = recall, civil penalties |
| GB/T 44495 (Cybersecurity) | China | 2023 | MIIT (Ministry of Industry and Information Technology) |
| GB/T 44496 (Software Updates) | China | 2023 | MIIT |
⚠️ UNECE R155 Non-Compliance Means No EU Sales
UNECE R155 is not a fine — it is a type approval prerequisite. An OEM that cannot demonstrate a certified CSMS covering its vehicle models will not receive type approval from any EU member state, meaning those vehicles legally cannot be sold in the EU. For OEMs with global portfolios, R155 compliance is effectively mandatory globally because the EU market cannot be abandoned.