The Paradigm Shift in whole Vehicle Type Approval

Nouri, Majid

doi:10.22034/asas.2026.586192.1108

The Paradigm Shift in whole Vehicle Type Approval

Document Type : Original Article

Author

majid nouri

Vehicle Engineering Research Group, Research Center of Technology and Engineering, Standard Research Institute, Karaj, Iran

10.22034/asas.2026.586192.1108

Abstract

The automotive industry is witnessing a profound technological transformation, migrating from traditional hardware-centric engineering to the era of Software-Defined Vehicles (SDVs). In this paradigm, vehicle functionality, performance, and safety attributes are increasingly governed by software that evolves throughout the vehicle’s lifecycle. This transition challenges the fundamental tenets of traditional Whole Vehicle Type Approval (WVTA) frameworks, which have historically relied on “frozen” hardware configurations and static validation methodologies. As vehicles transition into dynamic, hyper-connected ecosystems capable of continuous over-the-air (OTA) updates, legacy certification processes face a critical regulatory vacuum. This paper provides a critical evaluation of the recent integration of UN Regulations No. 155 (Cyber Security) and No. 156 (Software Update Management System) into the global regulatory landscape. By examining the tension between the iterative, agile nature of software development cycles and the traditionally sequential timelines of regulatory compliance, this study identifies the operational challenges faced by both Original Equipment Manufacturers (OEMs) and Type Approval Authorities. Furthermore, it analyzes the shift from product-based validation to process-oriented auditing, arguing that contemporary standards must evolve from static point-in-time assessments to continuous, lifecycle-based monitoring. The findings offer strategic insights into harmonizing cybersecurity engineering (ISO/SAE 21434) with regulatory requirements, providing a roadmap for future-proofing automotive standards in an increasingly digitized global market.

Keywords

Software-Defined Vehicles (SDVs)

Whole Vehicle Type Approval (WVTA)

Regulatory Compliance

Subjects

Engineering & Technology

[1] UNECE, UN Regulation No. 155: Cyber security and cyber security management system. United Nations Economic Commission for Europe. Available: https://unece.org/sites/default/files/2023-02/R155e (2).pdf

[2] UNECE, UN Regulation No. 156: Software update and software update management system. United Nations Economic Commission for Europe. Available: https://unece.org/sites/default/files/2024-03/R156e (2).pdf

[3] ISO/SAE, ISO/SAE 21434: Road vehicles — Cybersecurity engineering. International Organization for Standardization / SAE International, 2021.

[4] Development for high-assurance software update management system complying with UN R156. IEEE Xplore. Available: https://ieeexplore.ieee.org/iel8/6287639/6514899/10595114.pdf

[5] An adaptable security-by-design approach for ensuring a … ScienceDirect. Available: https://www.sciencedirect.com/science/article/pii/S0167404824005741

[6] ISO, ISO 26262: Road vehicles — Functional safety. Geneva, Switzerland: International Organization for Standardization, 2018.

[7] ISO/SAE, ISO/SAE 21434:2021 — Road vehicles — Cybersecurity engineering. Geneva, Switzerland: International Organization for Standardization / SAE International, 2021.

[8] ISO, ISO 24089:2023 — Road vehicles — Software update engineering. Geneva, Switzerland: International Organization for Standardization, 2023.

[9] OECD, The Governance of Regulators: Driving Performance at Regulatory Agencies. Paris, France: OECD Publishing, 2014.

[10] OECD, International Regulatory Co-operation: The Role of International Organisations in Fostering Better Rules of Globalisation. Paris, France: OECD Publishing, 2016.

[11] S. Checkoway et al., “Comprehensive experimental analyses of automotive attack surfaces,” in Proceedings of the 20th USENIX Security Symposium, San Francisco, CA, USA, 2011.

[12] K. Koscher et al., “Experimental security analysis of a modern automobile,” in Proceedings of the IEEE Symposium on Security and Privacy, Oakland, CA, USA, 2010, pp. 447–462.

[13] SAE International, Taxonomy and Definitions for Terms Related to Driving Automation Systems for On-Road Motor Vehicles, SAE J3016. Warrendale, PA, USA: SAE International, 2021.

[14] European Commission, Ethics of Connected and Automated Vehicles: Recommendations on Road Safety, Privacy, Fairness, Explainability and Responsibility. Brussels, Belgium: European Commission, 2020.

[15] ISO, ISO 34502:2022 — Road vehicles — Test scenarios for automated driving systems — Scenario-based safety evaluation framework. Geneva, Switzerland: International Organization for Standardization, 2022.

[16] ISO, ISO 21448:2022 — Road vehicles — Safety of the intended functionality. Geneva, Switzerland: International Organization for Standardization, 2022.

[17] C. Miller and C. Valasek, “Remote exploitation of an unaltered passenger vehicle,” Black Hat USA, 2015.

[18] OECD, Regulatory Policy Outlook 2021. Paris, France: OECD Publishing, 2021.

[19] United Nations Economic Commission for Europe, UN Regulation No. 156: Uniform provisions concerning the approval of vehicles with regard to software update and software updates management system, UNECE, Geneva.

[20] UNECE World Forum for Harmonization of Vehicle Regulations, Software update and software updates management system: Interpretation and implementation guidance under UN Regulation No. 156, UNECE WP.29 documentation.

[21] International Organization for Standardization, ISO 24089: Road vehicles — Software update engineering, ISO, Geneva.

[22] United Nations Economic Commission for Europe, UN Regulation No. 155: Uniform provisions concerning the approval of vehicles with regard to cyber security and cyber security management system, UNECE, Geneva.

[23] International Organization for Standardization and SAE International, ISO/SAE 21434: Road vehicles — Cybersecurity engineering, ISO/SAE.

[24] International Organization for Standardization, ISO 26262: Road vehicles — Functional safety, ISO, Geneva.

[25] International Organization for Standardization, ISO 21448: Road vehicles — Safety of the intended functionality, ISO, Geneva.

[26] European Parliament and Council of the European Union, Regulation (EU) 2018/858 on the approval and market surveillance of motor vehicles and their trailers, and of systems, components and separate technical units intended for such vehicles, Official Journal of the European Union, 2018.

[27] National Highway Traffic Safety Administration, Federal Motor Vehicle Safety Standards and Regulations, U.S. Department of Transportation, Washington, DC.

[28] National Highway Traffic Safety Administration, Cybersecurity Best Practices for the Safety of Modern Vehicles, U.S. Department of Transportation, Washington, DC.