UN R155 and R156: the rules that locked down your diagnostics port

Two UN regulations now govern how vehicles handle security and software updates in most major markets. They are the reason a modern car behaves differently at the diagnostic connector than one built ten years ago.

Related: car cybersecurity and CAN injection theft.

R155: cybersecurity management

Requires manufacturers to operate a certified cybersecurity management system covering the whole vehicle lifecycle — design, production, and the years afterwards.

In practice that means:

• Identifying the attack surface and demonstrating it is controlled.
• Monitoring for new threats after the vehicle is sold.
• Being able to respond to a discovered vulnerability.
• Controlling access to vehicle networks.

The diagnostic connector is part of that attack surface, which is why it is now filtered.

R156: software update management

Governs how software updates are delivered, particularly over the air.

Requirements include: verifying update integrity, ensuring the vehicle is in a safe state before updating, recording what version is installed, and ensuring a failed update does not leave the vehicle unusable.

OTA firmware updates and diagnostics.

Why theft drove much of this

The security case is not hypothetical.

Vehicles have been stolen by connecting to the diagnostic network — sometimes through a headlight harness or wing mirror to reach the bus without opening the car — and programming a new key or injecting messages to unlock and start.

A connector that permits unauthenticated write access is a theft method. Closing it closes that route.

Car cybersecurity and CAN injection theft and car won’t start: immobiliser troubleshooting.

What changed at the connector

The distinction is between reading and doing.

Still available without authentication: emissions codes, clearing them, live data, freeze frame, readiness monitors, the VIN and calibration identifiers.

Increasingly requires authentication: actuator tests, coding, adaptation resets, service functions such as electronic parking brake retraction, and access to non-emissions modules.

The legislated minimum survives, because inspection regimes worldwide depend on it: security gateway modules and OBD access.

The competition question

Honesty requires stating the other side.

Authenticated access routes independent workshops through manufacturer infrastructure — an account, often a subscription, sometimes a per-vehicle charge.

Whether that is proportionate security or a barrier to competition is a live argument, and the answer varies by market and by manufacturer.

Right to repair and diagnostic data access and the EU Data Act and vehicle data.

Both positions have merit. A vehicle whose security can be defeated by anyone with a connector is genuinely unsafe; a repair market where only the manufacturer can work on a car is genuinely uncompetitive.

What it means for an owner today

Diagnosis is largely unaffected. Reading codes, watching live data, logging a drive — all still work with a generic adapter. That is most of what owner-side diagnostics is for.

Some repairs now need authenticated access. Establish that before starting a job rather than discovering it partway through.

Over-the-air updates are increasingly normal. Vehicle behaviour can change between drives, and a fault present last week may be resolved without a workshop visit — which also means a third-party tool that worked last month may not this month.

Aftermarket devices need more care. Anything plugged into the diagnostic connector permanently is part of the attack surface: OBD adapter draining battery and aftermarket accessories electrical faults.

Practical security for an owner

Beyond regulation, things that actually reduce theft risk:

• Keep the diagnostic connector out of easy reach where the vehicle allows it.
• Store keys away from doors and windows — relay attacks work through walls.
• Use a signal-blocking pouch for keyless entry keys.
• A physical steering lock remains genuinely effective, because it cannot be defeated electronically.
• Unplug adapters when not in use.

Alarm and tracker installation and catalytic converter theft prevention.

This check needs no workshop — an ELM327 adapter and the free tier of the app cover it. Read codes and live data, which remain available on gateway-equipped vehicles. Knowing where the boundary sits is more useful than being surprised by it.