Regulation (EU) 2018/858 of the European Parliament and of the Council of 30 May 2018 on the approval and market surveillance of motor vehicles and their trailers, and of systems, components and separate technical units intended for such vehicles, amending Regulations (EC) No 715/2007 and (EC) No 595/2009 and repealing Directive 2007/46/EC (Text with EEA relevance.)

• 1.1. The satisfactory operation of the multi-stage type-approval requires joint action by all the manufacturers concerned. To that end approval authorities must ensure, before granting first and subsequent stage type-approvals, that suitable arrangements exist between the relevant manufacturers for the supply and interchange of documents and information, so that the completed type of vehicle meets the technical requirements of all the relevant regulatory acts listed in Annex II. Such information must include details of relevant system, component and separate technical unit type-approvals and of vehicle parts that form part of the incomplete vehicle but have not yet been type-approved.

• 1.2. Each manufacturer involved in a multi-stage type-approval shall be responsible for the approval and conformity of production of all systems, components or separate technical units manufactured or added by that manufacturer to the previously built stage. The manufacturer of the subsequent stage shall not be responsible for objects that have been approved in an earlier stage, except where that manufacturer modifies relevant parts to such an extent that the previously granted type-approval becomes invalid.

2. Obligations of approval authorities

• 2.1. The approval authority shall:

• (a) verify that all EU type-approval certificates issued pursuant to the regulatory acts that are applicable for vehicle type-approval cover the type of vehicle at its state of completion and correspond to the prescribed requirements;

• (b) ensure that all the relevant data, taking account of the state of completion of the vehicle, is included in the information folder;

• (c) by reference to the documentation ensure that the vehicle specification(s) and data contained in the information folder are included in the data in the information packages and in the EU type-approval certificates issued in accordance with the relevant regulatory acts; and in the case of a completed vehicle, where an item number of the information folder is not included in the information package of any of the regulatory acts, confirm that the relevant part or characteristic conforms to the particulars in the information folder;

• (d) on a selected sample of vehicles from the type to be approved carry out or arrange to be carried out inspections of vehicle parts and systems to verify that the vehicle(s) is/are built in accordance with the relevant data contained in the authenticated information package in accordance with all relevant regulatory acts; and

• (e) where required carry out, or arrange to be carried out, relevant installation checks for separate technical units.

• 2.2. The number of vehicles to be inspected for the purposes of point 2.1 (d) shall be sufficient to permit the proper control of the various combinations to be EU type-approved according to the state of completion of the vehicle and the following criteria:

• — engine;

• — gearbox;

• — powered axles (number, position, interconnection);

• — steered axles (number and position);

• — body styles;

• — number of doors;

• — hand of drive;

• — number of seats;

• — level of equipment.

3. Applicable requirements

• 3.1. Multi-stage type-approvals shall be granted on the basis of the state of completion of the type of vehicle and shall incorporate all type-approvals granted at earlier stages.

• 3.2. For the whole-vehicle type-approval, this Regulation (in particular the requirements of Annex I and the particular regulatory acts listed in Annex II) shall apply in the same manner as if the approval would have been granted (or extended) to the manufacturer of the base vehicle.

• 3.2.1. Where a type of system, component or separate technical unit has not been modified, the system, component or separate technical unit type-approval granted in the previous stage shall remain valid until the expiration date for the first registration, as specified in the particular regulatory act.

• 3.2.2. Where a type of system has been modified at the subsequent stage of completion of the vehicle, to the extent that the system has to be retested for type-approval purposes, that retesting shall be limited to only those parts of the system that have been modified or affected by the changes.

• 3.2.3. Where a type of vehicle or a type of system has been modified by another manufacturer at the subsequent stage of completion of the vehicle, to the extent that, apart from the manufacturers name, the vehicle or system may still be considered as the same type, the requirement applying to existing types may still be applied as long as the date for first registration in the relevant regulatory act has not been reached.

• 3.2.4. The change of category of a vehicle shall lead to the application of the relevant requirements to the new category of vehicle. The EU type-approval certificates from the previous category shall be accepted provided that the vehicle complies with the same requirements as, or more stringent than, those applying to the new category.

• 3.3. Subject to the agreement of the approval authority, a whole-vehicle type-approval granted to the manufacturer of the subsequent stage of completion of the vehicle does not need to be extended or revised where an extension given at the previous stage vehicle does not affect the subsequent stage or the technical data of the vehicle. However, the type-approval number including the extension of the previous stage(s) vehicle shall be copied in the certificate of conformity of the subsequent stage vehicle.

• 3.4. Where the cargo area of a complete or completed vehicle of category N or O is modified by another manufacturer for the addition of removable fittings to store and secure the cargo (for example, load space lining, storage racks and roof racks), such items can be treated as part of the pay-mass and a type-approval is not needed, provided both of the following conditions are met:

• (a) the modifications do not affect the vehicle's type-approval in any way, other than an increase of the actual mass of the vehicle;

• (b) the added fittings can be removed without using special tools.

4. Identification of the vehicle

• 4.1. The VIN, prescribed by Regulation (EU) No 19/2011, shall be retained during all the subsequent stages of the type-approval to ensure the traceability of the process.

• 4.2. At the second and subsequent stages, in addition to the statutory plate prescribed by Regulation (EU) No 19/2011, each manufacturer shall affix to the vehicle an additional plate the model of which is shown in the Appendix to this Annex. This plate shall be firmly attached, in a conspicuous and readily accessible position on a part not subject to replacement in use. It shall clearly and indelibly show the following information in the order listed:

• — the name of the manufacturer;

• — sections 1, 3 and 4 of the EU type-approval number;

• — the stage of approval;

• — the VIN of the base vehicle;

• — the technically permissible maximum laden mass of the vehicle where the value has changed during the current stage of approval;

• — the technically permissible maximum laden mass of the combination (where the value has changed during the current stage of approval and where the vehicle is permitted to tow a trailer). ‘0’ shall be used if the vehicle is not permitted to tow a trailer;

• — the technically permissible maximum mass on each axle, listed in order from front to rear where the value has changed during the current stage of approval;

• — in the case of a semi-trailer or centre axle trailer, the technically permissible maximum mass at the coupling point where the value has changed during the current stage of approval.

Unless otherwise provided for in point 4.1 and this point the additional plate shall comply with the requirements set out in Annex I and Annex II to Regulation (EU) No 19/2011.

Appendix

Model of the manufacturer's additional plate

The example below is given as a guide only.

MANUFACTURER'S NAME (stage 3)

e2201X/XX2609

Stage 3

WD9VD58D98D234560

1 500  kg

2 500  kg

1 – 700 kg

2 – 810 kg

ANNEX X

ACCESS TO VEHICLE OBD INFORMATION AND VEHICLE REPAIR AND MAINTENANCE INFORMATION

1. Introduction

This Annex lays down technical requirements for the access to vehicle OBD information and vehicle repair and maintenance information regardless of the vehicle powertrain type.

2. Access to vehicle OBD information and vehicle repair and maintenance information

• 2.1. A manufacturer shall put in place the necessary arrangements and procedures, in accordance with Article 61(2), second subparagraph, first sentence, to ensure that vehicle OBD information and vehicle repair and maintenance information is accessible through websites.  Compliance with the obligation for manufacturer to provide information about the vehicle OBD system and vehicle repair and maintenance information on their websites through a standardised format shall be presumed by conforming to Part 1 ‘General information and use case definition’, Part 2 ‘Technical requirements’, Part 3 ‘Functional user interface requirements’ and Part 4 ‘Conformance test’ of standard EN ISO 18541 – 2021 and Part 5 ‘Heavy duty specific provision’ ‘Road vehicles – Standardized access to automotive repair and maintenance information (RMI)’ of standard EN ISO 18541 – 2018. Access to vehicle OBD information and vehicle repair and maintenance information shall be granted in a readily accessible and prompt manner.

• 2.2. An approval authority shall only grant type-approval after receiving from the manufacturer a certificate on access to vehicle OBD information and vehicle repair and maintenance information.

• 2.3. The certificate on access to vehicle OBD information and vehicle repair and maintenance information shall serve as the proof of compliance with Article 64.

• 2.4. The certificate on access to vehicle OBD information and vehicle repair and maintenance information shall be drawn up in accordance with the model set out in Appendix 1.

• 2.5. The vehicle repair and maintenance information shall include the following:

• 2.5.1. an unequivocal identification of the vehicle and the resulting list of factory-fitted options, as well as of systems, components, separate technical units, parts or equipment for which the manufacturer is responsible;

• 2.5.2. service handbooks, including service and maintenance records, and technical specifications references regarding fluids including on lubricants, brake fluids and cooling liquids;

• 2.5.3. technical manuals;

• 2.5.4. information about systems, components, separate technical units, parts, equipment and diagnosis (including minimum and maximum theoretical values for measurements), including information about functions and capabilities necessary for calibration and repair of Advanced Driver Assistance Systems (ADAS) or Driver Control Assistance Systems (DCAS) and related components);

• 2.5.5. wiring diagrams;

• 2.5.6. diagnostic trouble codes, including manufacturer specific codes;

• 2.5.7. information required to determine whether a software update or variant coding is necessary for a specific repair and maintenance operation;

• 2.5.7a. information required for the identification of the correct software update or variant coding for each system, component, separate technical unit, part or equipment requiring a software update. By way of exception from point 2.1, if the determination of the correct software version or variant coding requires a backend connection, the manufacturer shall not be required to publish the information required for the identification of the correct software update or variant coding for each system, component, separate technical unit, part or equipment requiring a software update on the website;

• 2.5.8. information provided concerning, and delivered by means of, proprietary tools and equipment including the information of any additional tooling, equipment and the user instructions, that are required to carry out a component or system calibration;

• 2.5.9. data record information and two-directional monitoring and test data;

• 2.5.10. standard work units or time periods for repair and maintenance tasks if they are made available to authorised dealers and repairers of the manufacturer either directly or through a third party;

• 2.5.11. in case of multi-stage type-approval, the information required under point 3, and all other information necessary to comply with the requirements set out in Article 61.

• 2.5.12. information provided by the manufacturer to his authorised partners, dealers and repairers or used by the manufacturer for repair and maintenance purposes, necessary for the diagnosis and, where applicable, the repair of traction battery systems as well as its exchangeable units including battery modules;

• 2.5.13. vehicle type specific information necessary for the safe handling of parts and components, in particular information necessary for the protection against electric, thermic and chemical hazards from traction batteries; as available to the vehicle manufacturer or its partners.

• 2.6. The manufacturer shall make available to interested parties the following information:

• 2.6.1. relevant information to enable the development of replacement components that are critical to the correct functioning of the OBD system;

• 2.6.2. the following information:
• (a) diagnostic description data referred to in point 3 of appendix 2. The manufacturer shall ensure that this data meets the following requirements:
• (i) it is made available as electronic directly processable datasets;
• (ii) it is of the same level of detail as used by the vehicle manufacturer proprietary diagnostic tools;
• (iii) it is comprehensively documented;
• (b) descriptions of necessary off- and onboard interactions needed for the completion of any repair and maintenance job. The vehicle manufacturer shall make the information referred in point (a) available only for vehicle types for which the type-approval certificate was first granted after 1 September 2020;

• 2.6.3. information on how to acquire proprietary tools and equipment.

• 2.6a. The manufacturer shall make available to manufacturers of repair equipment and generic diagnostic tools all information, technical specification and user instructions for the repair, maintenance and diagnosis of ADAS/DCAS systems by diagnostic tools.

• 2.6b. The information referred to in points 2.6 and 2.6a shall be made available in accordance with the terms and conditions stipulated by the manufacturer in compliance with this Regulation, including payment terms and conditions or use limitations and fees required in accordance with Article 63(1).

• 2.7. For the purposes of point 2.6.1., the development of replacement components shall not be restricted by any of the following:

• 2.7.1. the unavailability of pertinent information;

• 2.7.2. the technical requirements relating to malfunction indication strategies if the OBD thresholds are exceeded or if the OBD system is unable to fulfil the basic OBD monitoring requirements of this Regulation;

• 2.7.3. specific modifications to the handling of OBD information to deal independently with vehicle operation on petrol or on gas;

• 2.7.4. the type-approval of gas-fuelled vehicles that contain a limited number of minor deficiencies.

• 2.8. For the purposes of point 2.6.2, where manufacturers use diagnostic and test tools in accordance with ISO 22900 – Modular vehicle communication interface (MVCI) – and ISO 22901 – Open diagnostic data exchange (ODX) in their franchised networks –, the ODX files shall be accessible to independent operators via the website of the manufacturer.

• 2.9. For the purpose of accessing vehicle OBD information, diagnostics, repair and maintenance, monitoring and inspection, vehicle manufacturer shall enable bi-directional access to the in-vehicle data stream, through all of the following means:

• (a) the serial data port on the standardised data link connector referred to in Appendix 1 paragraph 6.5.3 of Annex C5 to UN Regulation No 154 ([^E0048]) respectively in accordance with paragraph 4.7.3 of Annex 9B and the reference standard documents set out in Appendix 6 to that Annex to UN Regulation No 49 ([^E0049]);

• (b) any other in-vehicle means of access that is provided by the manufacturer to his authorised partners, dealers and repairers or is used by the manufacturer for repair and maintenance purposes, including Ethernet connectors, non-standardized pins on the standardized OBD port, application programming interfaces used for aftermarket service integration, and wireless local area networks;

• (c) any facility that is provided by the manufacturer to his authorized partners, dealers and repairers or is used by the manufacturer to enable remote access to vehicle OBD Information for repair and maintenance, including monitoring and inspection (where monitoring and inspection are performed for repair and maintenance) or remote repair and diagnostics services.

Where the vehicle is in motion, the manufacturer may choose to make the data stream available only for read-only functions, on condition that the manufacturer applies the same restriction to its own authorized partners, dealers and repairers.

The manufacturer may implement conditions for accessing the vehicle data stream, to the extent this is necessary and proportionate for compliance with Article 4(5)(d) and Annex II line D4 of Regulation (EU) 2019/2144 and Articles 4(7) 4(8) and Article 6(3) of Regulation (EU) 2024/1257. For access using the means described in 2.9 (a) and (b), such conditions shall not go beyond the conditions that the manufacturer is allowed to apply pursuant to Appendix 4 to this Annex.

3. Multi-stage type-approval

• 3.1. In the case of a multi-stage type-approval, the final manufacturer shall be responsible for providing access to vehicle OBD information and vehicle repair and maintenance information regarding its own manufacturing stage(s) and the link to the previous stage(s).

• 3.2. In addition, the final manufacturer shall on its website provide independent operators with the following information:

• 3.2.1. the website address of the manufacturer(s) responsible for the previous stage(s);

• 3.2.2. the name and address of all the manufacturers responsible for the previous stage(s);

• 3.2.3. the type-approval number(s) of the previous stage(s);

• 3.2.4. the engine number.

• 3.3. Each manufacturer responsible for a particular stage or stages of type-approval shall be responsible for providing through his website access to vehicle OBD and vehicle repair and maintenance information regarding the stage(s) of type-approval for which he is responsible and the link to the previous stage(s).

• 3.4. The manufacturer responsible for a particular stage or stages of type-approval shall provide the following information to the manufacturer responsible for the next stage:

• 3.4.1. the certificate of conformity relating to the stage(s) for which he is responsible;

• 3.4.2. the certificate on access to vehicle OBD information and vehicle repair and maintenance information, including its annexes;

• 3.4.3. the type-approval number corresponding to the stage(s) for which he is responsible;

• 3.4.4. the documents referred to in points 3.4.1, 3.4.2 and 3.4.3 as provided by the manufacturer(s) involved in the previous stage(s).

• 3.5. Each manufacturer shall authorise the manufacturer responsible for the next stage to pass the documents to the manufacturers responsible for any subsequent stages and the final stage.

• 3.6. In addition, on a contractual basis, the manufacturer responsible for a particular stage or stages of type-approval shall:

• 3.6.1. provide the manufacturer responsible for the next stage with access to vehicle OBD information and vehicle repair and maintenance information and interface information corresponding to the particular stage(s) for which he is responsible;

• 3.6.2. provide, at the request of a manufacturer responsible for a subsequent stage of type-approval, with access to vehicle OBD information and vehicle repair and maintenance information and interface information corresponding to the particular stage(s) for which he is responsible.

• 3.7. A manufacturer, including a final manufacturer, may only charge fees in accordance with Article 63 concerning the particular stage(s) for which he is responsible.

A manufacturer, including a final manufacturer, shall not charge fees for providing information relating to the website address or contact details of any other manufacturer.

4. Customer adaptations

• 4.1. By derogation from point 2, if the number of systems, components or separate technical units subject to a specific customer adaptation is lower than 250 units produced worldwide, repair and maintenance information for the customer adaptation shall be provided in a readily accessible and prompt manner, and in a manner which is non-discriminatory compared to the provisions given or access granted to authorised dealers and repairers.

For the servicing and reprogramming of the electronic control units relating to the customer adaptation, the manufacturer shall make the respective proprietary specialist diagnostic tool or test equipment available to independent operators as provided to authorised repairers.

The customer adaptations shall be listed on the manufacturer's repair and maintenance information website and mentioned in the certificate on access to vehicle OBD information and vehicle repair and maintenance information at the time of type-approval.

• 4.2. Manufacturers shall make the proprietary specialist diagnostic tool or test equipment to service the customer-adapted systems, components or technical units available to independent operators via sale and rent.

• 4.3. The manufacturer shall mention in the certificate on access to vehicle OBD information and vehicle repair and maintenance information, at the time of type-approval, the customer adaptations for which the obligation under point 2 to provide access to vehicle OBD information and vehicle repair and maintenance information in a standardised format is derogated from and any electronic control unit related to them.

Those customer adaptations and any electronic control unit related to them shall also be listed on the manufacturer's repair and maintenance information website.

5. Small volume manufacturers

• 5.1. By derogation from point 2, manufacturers whose worldwide annual production of a type of vehicle, system, component or separate technical unit subject to this Regulation is for vehicles of category M1 and N1 less than 1 000 vehicles or for vehicles of category M2, M3, N2, N3 and O less than 250 units, shall provide access to vehicle repair and maintenance information in a readily accessible and prompt manner, and in a manner that is non-discriminatory compared to the provisions given or access granted to authorised dealers and repairers.

• 5.2. The vehicle, system, component and separate technical unit subject to point 5.1 shall be listed on the manufacturer's repair and maintenance information website.

• 5.3. The approval authority shall inform the Commission of each type-approval granted to small volume manufacturers.

6. Requirements

• 6.1. Compliance with the obligation for manufacturer to provide vehicle repair and maintenance information on their websites through a standardised format shall be presumed by conforming with the Parts of standard ISO 18541-1:2021 to ISO 18541-4:2021 and ISO 18541-5:2018, as referred to in point 2.1.

Those requiring the right to duplicate or republish such information shall negotiate directly with the manufacturer concerned. Information for training material shall also be available, and it may be presented through other media than websites.

• 6.1.1. For the purpose of publishing repair and maintenance information, the manufacturer shall make the information available as files in the format which serves for direct electronic processing of the sets of data contained in those files. The information shall be of the same level of detail as is used by the manufacturer for repair and maintenance purposes. It shall be documented for the purposes of interpretation and updated at the frequency agreed with the independent operator Updates shall be available with the same frequency and timing as they are available to the authorised dealers and repairers. Information shall be offered in packages based on technical information by use case, as available to the manufacturer. The information referred to in the first sentence of this point shall be provided on the basis of terms and conditions stipulated by the manufacturer in compliance with this Regulation, such as payment terms and any compatible conditions or use limitations and the fees required in compliance with Article 63(1) of this Regulation. Information packages defined based on criteria reflecting the information requirements for Use Case 5.1.1., Use Case 5.1.2, Use Case 5.2, Use Case 5.3, Use Case 5.4, Use Case 5.5, Use Case 5.7, Use Case 5.8, Use Case 5.9, Use Case 8 and Use Case 11 of standard ISO 18541-1 2021 shall be presumed compliant. The manufacturer shall only provide, as from 23 June 2027, information packages defined based on criteria reflecting the information requirements needed for Use Case 5.3 and Use Case 5.4 in ISO 18541-1:2021 that are only available per vehicle identification number (VIN) where an independent repairer requests so via an Application Programming Interface (API ([^E0050])). In such cases, the independent repairer shall transmit a VIN-specific request to the manufacturer through a third party acting on the basis of an agreement with the manufacturer. Where the information packages are defined based on criteria reflecting the information requirements for Use Case 8 in ISO 18541-1:2021, the manufacturer shall provide to such a third party, as from 23 June 2027, an API that allows the independent repairer to view and update the electronic maintenance history subject to the additional conditions as specified in the ISO and, where appropriate, manufacturer’s conditions and processes used to obtain customer agreement. The manufacturer shall do so subject to the same or equivalent processes and required information as those specified in the manufacturer’s repair and maintenance information website. In such cases the independent repairer, with the customer’s agreement, may transmit a repair or maintenance record update request to the manufacturer through a third party acting on the basis of an agreement with the manufacturer. A certificate compliant with Recommendation ITU-T X.509 of the International Telecommunication Union may be used to verify the identity the independent repairer. Access to such APIs, including for updating electronic maintenance history entries shall be subject to Article 63(1). The information shall be structured in a way so that it is later possible to search and filter the information contained in the package by model type classification criteria and other classification criteria used by the vehicle manufacturer own network.

• 6.1.2. Information on all parts of the vehicle, with which the vehicle, as identified by the VIN and any additional criteria such as wheelbase, engine output, trim level or options, is equipped by the vehicle manufacturer and that can be replaced by spare parts offered by the vehicle manufacturer to its authorised repairers or dealers or third parties by means of reference to original equipment (OE) parts number, shall be made available, in the form of machine readable and electronically processable datasets, in a database that is easily accessible to independent operators. That database shall comprise the VIN, OE parts numbers, OE naming of the parts, validity attributes (valid-from and valid-to dates), fitting attributes and, where applicable, structuring characteristics. The information in the database shall be updated regularly. If this information is available to authorised dealers, the updates shall include all modifications to individual vehicles after their production.

• 6.2. Access to vehicle security features shall be made available to independent operators under protection of security technology in accordance with the following requirements:

• 6.2.1. data shall be exchanged ensuring confidentiality, integrity and protection against replay;

• 6.2.2. the standard https//ssl-tls (RFC5246) or any successor to this standard shall be used;

• 6.2.3. security certificates in accordance with international standard ISO/IEC 9594-8:2020 shall be used for mutual authentication of independent operators and manufacturers;

• 6.2.4. the independent operator's private key shall be protected by secure hardware.

• 6.3. The procedure for the approval and authorisation of independent operators to access vehicle security features as referred to in point 6.2 is set out in Appendix 3. The role and responsibilities of the bodies involved in the accreditation, approval and authorisation of independent operators are detailed through functional requirements consisting of examples and use cases laid down in Commission Notice. The independent operator shall be approved and authorised for this purpose on the basis of documents demonstrating that he pursues a legitimate business activity and has not been convicted of any relevant criminal activity.

For the purposes of that procedure, operators shall not be considered to pursue a legitimate business activity where they advertise or offer repair or maintenance operations that would negatively impact the emissions performance of the vehicle. This shall include:

• (a) deactivating or removing pollution control devices or emission control systems, or degrading their performance or concealing their malfunction;

• (b) installing defeat devices ([^E0051]), or defeat strategies ([^E0052]);

• (c) deactivating, removing or tampering with devices for the monitoring of the consumption of fuel or electric energy, or tampering with odometer readings;

• (d) tampering with the engine control unit, including the rated engine power.

• 6.4. Reprogramming of control units, variant coding and activation of replacement parts shall be conducted using non-proprietary hardware, without any dependency on manufacturer hardware in accordance with any of the following:

• (a) international standard ISO 22900-2;

• (b) SAE J2534-1;

• (c) SAE J2534-2;

• (d) TMC RP1210B;

• (e) SOVD-Standard ISO/DIS 17978-1.

Where conducted using Ethernet, reprogramming of control units, variant coding and activation of replacement parts shall be conducted in accordance with either ISO22900-2 or J2534-2.

For the validation of the compatibility of the manufacturer-specific application and the vehicle communication interfaces (VCI), complying with international standard ISO 22900-2 or with SAE J2534-1 or SAE J2534-2 or TMC RP1210B, the manufacturer shall offer either a validation of independently developed VCIs or the information and loan of any special hardware, required for a VCI manufacturer to conduct such validation.

The manufacturer may charge reasonable and proportionate fees for such validation or information and hardware. Those fees shall not discourage use of such validation or information and hardware.

• 6.4a. As from 23 December 2026, the vehicle manufacturer shall make available to independent diagnostic tool manufacturer any of the following software or information for vehicle type for which the type-approval certificate was first granted after 1 September 2020:

• (a) software or webservice interfaces to independent diagnostic tool manufacturers for their integration, that enables variant coding, pairing to a vehicle an original replacement part (including software and hardware compatible (as defined by the vehicle manufacturer) remanufactured or re-used part) or a vehicle manufacturer authorized replacement part, as well as the reprogramming of control units with a vehicle’s original equipment software according to vehicle manufacturer’s instructions, or;

• (b) necessary information, processes and resources necessary to implement variant coding and reprogramming in independent diagnostic tool of the independent diagnostic tool manufacturer.

However, by way of derogation from the time limit specified in the first sentence of this point, the vehicle manufacturer shall make available the software or information referred in points (a) and (b) above as from the following dates:

• (i) 23 June 2027, with regard to vehicles for which the type-approval was first granted after 1 September 2020 but before 6 July 2022;

• (ii) 23 June 2028 for any operation involving or dependent on performing software updates.

• 6.4b. Until the vehicle manufacturer makes available the software or information for vehicle type referred to in point 6.4a and for the period of two years following that date, the use of vehicle manufacturer’s diagnostic hardware and diagnostic software by remote service providers, as referred to in point 1.2 of Appendix 4, for the purposes of re-programming and variant coding or parts activation shall be subject to the same fees and payment conditions as those applicable to independent repairers, irrespective of whether the diagnostic tools are used remotely.

Furthermore, vehicle manufacturer shall share with any interested diagnostic tool manufacturers, as soon as they are available:

• (a) the information necessary for implementing the API between the relevant vehicle manufacturer’s and diagnostic tool manufacturers’ systems:
• (i) no later than 23 June 2027 for any operation involving or dependent on performing software updates; and
• (ii) for other operations, no later than 23 September 2026; or
• (iii) with regard to vehicles for which the type-approval was first granted before 6 July 2022, no later than 23 December 2026;

• (b) the information necessary for testing the update functionality and interaction for hardware, no later than 23 December 2027 for any operation involving or dependent on performing software updates.

• 6.4c. Decoupling of components, separate technical units, parts and equipment, except for those that have been originally designed not to be de-coupled, shall be done in accordance with the process set out in this point. It shall not be subject to any conditions other than those referred to in this point.

The manufacturer shall put in place a process for the de-coupling of components, separate technical units, parts and equipment. For the purpose of installation of a re-used component, separate technical unit, part or equipment, the vehicle manufacturer defined processes may include a requirement to provide the unique identifier (including, where relevant, a unit’s serial number) of this component, separate technical units, part or equipment concerned, and the VIN of the vehicle, as well as an a requirement to obtain an agreement from the owner or the lessee of the vehicle, where they are identifiable. Where an agreement is required, it may be provided asynchronously from the part deinstallation.

For the purpose of remanufacturing in an industrial process, whereby a worn or failed component, separate technical units, part or equipment is restored to its original specification, the VIN of the original vehicle will not be required for de-coupling from the original vehicle. In this case the unique identifier of the component and the agreement the owner or the lessee of the vehicle, where they are identifiable, may be required.

All independent operators, including remanufacturers and refurbishers, authenticated in accordance with the requirements specified in Appendix 4, shall have equal access to these processes.

For the purpose of authentication of such an operator, where the vehicle manufacturer decoupling process is to be completed on their off-board platforms, authentication credentials issued in accordance with point 9.2 of Appendix 4, or those used for access to the vehicle manufacturer RMI website shall be accepted.

• 6.5. The requirements of point 6.4. shall not apply in the case of reprogramming of speed limitation devices and recording equipment.

• 6.6. All emission-related DTCs shall be consistent with Annex XI to Regulation (EC) No 692/2008 and Annex X to Regulation (EU) No 582/2011.

• 6.7. For access to any vehicle OBD information and vehicle repair and maintenance information other than that relating to secure areas of the vehicle, registration requirements for use of the manufacturer's website by an independent operator shall require only such information as is necessary to confirm how payment for the information is to be made. For information concerning access to secure areas of the vehicle, the independent operator shall present a certificate in accordance with international standard ISO 20828 to identify himself and the organisation to which he belongs and the manufacturer shall respond with his own certificate in accordance with international standard ISO 20828 to confirm to the independent operator that he is accessing a legitimate site of the intended manufacturer. Both parties shall keep a log of any such transactions indicating the vehicles and changes made to them under this provision.

• 6.8. Manufacturers shall indicate in their repair information websites the type-approval number by model.

• 6.9. If the vehicle OBD information and vehicle repair and maintenance information that is available on a manufacturer's website does not contain specific relevant information to permit the proper design and manufacture of alternative fuels retrofit systems, any interested alternative fuels retrofit system manufacturer shall be able to obtain the information required by contacting the manufacturer directly with such a request. Contact details for that purpose shall be clearly indicated on the manufacturer's website and the information shall be provided within 30 days. It shall only be necessary to provide such information for alternative fuels retrofit systems that are subject to UN Regulation No 115 or for alternative fuels retrofit components that form part of systems subject to UN Regulation No 115. In addition, it shall only be necessary to provide such information in response to a request that clearly specifies the exact specification of the vehicle model for which the information is required and that specifically confirms that the information is required for the development of alternative fuels retrofit systems or components subject to UN Regulation No 115.

7. Requirements for type-approval

• 7.1. In order to receive a type-approval, the manufacturer shall submit the filled in certificate, the template of which is provided in Appendix 1.

• 7.4. On the basis of a completed certificate on access to vehicle OBD information and vehicle repair and maintenance information, the approval authority may presume that the manufacturer has put in place satisfactory arrangements and procedures with regard to access to vehicle OBD information and vehicle repair and maintenance information, provided that no complaint has been made.

• 7.5. The vehicle OBD information and vehicle repair and maintenance information shall be provided to independent operators at the latest on the date on which the vehicle is placed on the market.

Appendix 1

Manufacturer's certificate on access to vehicle OBD information and vehicle repair and maintenance information

Image omitted; see official source

Text of image

(Manufacturer): …

(Address of the manufacturer): …

Certifies that

it provides access to vehicle OBD information and vehicle repair and maintenance information in compliance with the provisions of:

Article 61 of Regulation (EU) 2018/858 of the European Parliament and of the Council (1) and Annex X to that Regulation

with respect to the types of vehicle, system, component or separate technical unit listed in an attachment to this certificate.

The following derogations are applied: Customer adaptations () — Small volume () —.

The principal website addresses through which the relevant information, which is hereby certified to be in compliance with those provisions, may be accessed, are listed in an attachment to this certificate along with the contact details of the responsible manufacturer’s representative who has signed this certificate.

Where applicable: The manufacturer hereby also certifies that he has complied with the obligation of Article 62 of Regulation (EU) 2018/858 to provide the relevant information concerning previous approvals of these types of vehicle no later than six months after the date of type-approval.

Done at … [Place]

On … [Date]

[Signature] [Position]

Annexes:

— Annex A: Website addresses;

— Annex B: Contact details;

— Annex C: Types of vehicle, system, component or separate technical unit.

Explanatory note:

(*) Delete where not applicable.

(1) Regulation (EU) 2018/858 of the European Parliament and of the Council of 30 May 2018 on the approval and market surveillance of motor vehicles and their trailers, and of systems, components and separate technical units intended for such vehicles, amending Regulations (EC) No 715/2007 and (EC) No 595/2009 and repealing Directive 2007/46/EC (OJ L 151, 14.6.2018, p. 1).

ANNEX A

WEBSITE ADDRESSES REFERRED TO IN THIS CERTIFICATE:

ANNEX B

CONTACT DETAILS OF THE MANUFACTURER'S REPRESENTATIVE REFERRED TO IN THIS CERTIFICATE:

ANNEX C

TYPES OF VEHICLE, SYSTEM, COMPONENT OR SEPARATE TECHNICAL UNIT:

Appendix 2

Vehicle OBD information

• 1. The vehicle manufacturer shall provide the information required in this Appendix for the purposes of enabling the manufacture of OBD-compatible replacement or service parts and diagnostic tools and test equipment.

• 1. Upon request, the following information shall be made available, on a non-discriminatory basis, to any interested manufacturer of components, diagnostic tools or test equipment:

• 2.1. a description of the type and number of the preconditioning cycles used for the original type-approval of the vehicle;

• 2.2. a description of the type of the OBD demonstration cycle used for the original type-approval of the vehicle for the component monitored by the OBD system;

• 2.3. a comprehensive document describing all sensed components with the strategy for fault detection and MI activation (fixed number of driving cycles or statistical method), including a list of relevant secondary sensed parameters for each component monitored by the OBD system and a list of all OBD output codes and format used (with an explanation of each code and format) associated with individual emission-related power-train components and individual non-emission related components, where monitoring of the component is used to determine MI activation. In particular, in the case of types of vehicles that use a communication link in accordance with ISO 15765-4 ‘Road vehicles — Diagnostics on controller area network (CAN) — Part 4: Requirements for emissions-related systems’, a comprehensive explanation for the data given in service $ 05 Test ID $ 21 to FF and the data given in service $ 06, and a comprehensive explanation for the data given in service $ 06 Test ID $ 00 to FF, for each OBD monitor ID supported, shall be provided. In case other communication protocols standards are used, equivalent comprehensive explanation shall be provided. This information may be provided in the form of a table, with the following column and row headings: Component Fault code; Monitoring strategy; Fault detection criteria; MI activation criteria; Secondary parameters; Preconditioning Demonstration test. Catalyst P0420 Oxygen sensor; 1 and 2 signals; Difference between sensor 1 and sensor 2 signals; 3rd cycle Engine speed; engine load; A/F mode; catalyst temperature; Two Type 1 cycles; Type 1.

• 1. Information required for the manufacturing of diagnostic tools

In order to facilitate the provision of generic diagnostic tools for multi-make repairers, vehicle manufacturer shall make available the information referred to in points 3.1, 3.2 and 3.3. That information shall include all diagnostic tool functions and all the links to repair information and troubleshooting instructions. The access to the information may be subject to the payment of a reasonable fee.

3.1.   Communication protocol information

The following information shall be required indexed against vehicle make, model and variant, or another workable definition such as the VIN or the vehicle and systems identification:

• 3.1.1. any additional protocol information system necessary to enable complete diagnostics in addition to the standards prescribed in paragraph 4.7.3 of Annex 9B to UN Regulation No 49 and in paragraph 6.5.1.4 of Annex 11 to UN Regulation No 83, including any additional hardware or software protocol information, parameter identification, transfer functions, ‘keep alive’ requirements, or error conditions;

• 3.1.2. details of how to obtain and interpret all the fault codes that do not comply with the standards prescribed in paragraph 4.7.3 of Annex 9B to UN Regulation No 49 and in paragraph 6.5.1.4 of Annex 11 to UN Regulation No 83;

• 3.1.3. a list of all available live data parameters, including scaling and access information;

• 3.1.4. a list of all available functional tests, including device activation or control and the means to implement them;

• 3.1.5. details of how to obtain all component and status information, time stamps, pending DTC and freeze frames;

• 3.1.6. resetting adaptive learning parameters, variant coding and replacement component setup, and customer preferences;

• 3.1.7. Electronic control unit (ECU) identification and variant coding;

• 3.1.8. details of how to reset service lights;

• 3.1.9. location of diagnostic connector and connector details;

• 3.1.10. engine code identification.

3.2.   Test and diagnosis of OBD monitored components

The following information shall be required:

• 3.2.1. a description of tests to confirm the functionality, at the component or in the harness;

• 3.2.2. information concerning the test procedure, including test parameters and component information;

• 3.2.3. connection details, including minimum and maximum input and output and driving and loading values;

• 3.2.4. values to be expected under certain driving conditions, including idling;

• 3.2.5. electrical values for the component in its static and dynamic states;

• 3.2.6. failure mode values for each of the scenarios;

• 3.2.7. failure mode diagnostic sequences, including fault trees and guided diagnostics elimination.

3.3.   Data required to perform the repair

The following information shall be required:

• 3.3.1. ECU and component initialisation (in the event of replacements being fitted);

• 3.3.2. initialisation of new or replacement ECU's where relevant using pass-through (re-) programming techniques.

Appendix 3

Procedure for the approval and authorisation of independent operators to access vehicle security features ([^E0053])

1. Scope

This Appendix contains the requirements for the purposes of approval and authorisation of independent operators requiring access to security-related vehicle repair and maintenance information (RMI).

It specifies in detail the process and the bodies required to approve and authorise independent operators to be granted access to security-related vehicle repair and maintenance information for light passenger and commercial vehicles and heavy duty vehicles.

2. Definitions and abbreviated terms

2.1.   Definitions

For the purposes of this Appendix, the following definitions shall apply:

2.1.1.   ‘Accreditation’

‘accreditation’ shall mean accreditation as defined in Article 2, point 10 of Regulation (EC) No 765/2008

2.1.2.   ‘IO employee’

‘IO employee’ shall mean the employee of an approved independent operator (IO) who, upon authorisation from his or her conformity assessment body (CAB), will have access to security-related RMI

2.1.3.   ‘Security-related repair and maintenance information’ or ‘security-related RMI’

‘security-related repair and maintenance information’ or ‘security-related RMI’ shall mean the information, software, functions and services required to repair and maintain the features that are included in a vehicle by the manufacturer to prevent the vehicle from being stolen or driven away and to enable the vehicle to be tracked and recovered.

2.1.4.   ‘Approval inspection certificate’

‘approval inspection certificate’ shall mean the certificate issued by the CAB to IOs complying with the approval criteria set out in this Appendix and which confirms that those IOs are approved and that IO employees can request the authorisation to access security-related RMI.

2.1.5.   ‘Authorisation inspection certificate’

‘authorisation inspection certificate’ shall mean the certificate issued by the CAB to IO employees complying with the authorisation criteria set out in this Appendix and which confirms that those employees are authorised to access security-related RMI on the website of a vehicle manufacturer.

2.1.6.   ‘Trust centre’ or ‘TC’

‘trust centre’ or ‘TC’ shall mean the body designated by SERMI and approved by the Commission and that is responsible for:

• (a) managing the digital certificates and authorisation status of the IO employees and for providing to the CAB the necessary security tokens and digital certificates for authorised IO employees;

• (b) providing a vehicle manufacturer with information regarding the authorisation status of an IO employee.

2.1.7.   ‘Security token’

‘security token’ shall mean a device that allows a secure authentication of an IO.

2.1.8.   ‘Digital certificate’

‘digital certificate’ shall mean a digital certificate which requires a digital signature of the issuing trust centre to bind a public key to the identity of the IO employee in accordance with the standard ISO 9594.

2.1.9.   ‘Authorisation database’

‘authorisation database’ shall mean a database held by the trust centre and which contains the authorisation details of the anonymised authorised IO employees and the registration of approved IOs.

2.1.10.   ‘Certification database’

‘certification database’ shall mean a database held by the trust centre to manage the digital certificate validity and the identifiers of authorised IO employees.

2.1.11.   ‘European cooperation for Accreditation’ or ‘EA’

‘European cooperation for Accreditation’ or ‘EA’ shall mean the body recognised by the Commission in accordance with Article 14 of Regulation (EC) No 765/2008 and which is responsible for the development, maintenance and implementation of accreditation in the Union.

2.1.12.   ‘Forum for Access to Security-Related Vehicle RMI’ or ‘SERMI’

The ‘Forum for Access to Security-Related Vehicle RMI’ or ‘SERMI’ means the entity that is in charge of coordinating and advising the Commission on the implementation of the procedures of accreditation, approval and authorisation for the purpose of accessing security-related RMI.

2.1.13.   ‘Relevant authorities’

‘relevant authorities’ shall mean those public authorities that have a legal mandate to act in the area of vehicle security crime protection, investigation and prosecution.

2.1.14.   ‘Remote Service Supplier (RSS)’

‘remote service supplier (RSS)’ shall mean a service provider performing remotely, as a service provided to the IO in the context of its SERMI related activities, the programming, fitting or activating of parts and equipment on a vehicle.

2.1.15.   ‘RSS employee’

‘RSS employee’ shall mean the employee of an approved RSS who, upon authorisation by the CAB, will have access to security-related RMI.

3. Accreditation of CABs, approval of IOs and authorisation of IO employees

Only CABs that are accredited by the national accreditation body (‘NAB’), as defined in Article 2, point 11 of Regulation (EC) No 765/2008, of the Member State in which they are established shall issue approval inspection certificates certifying that an IO has been approved and authorisation inspection certificates certifying that an IO employee is to access security-related RMI.

The approval of the IO and the authorisation of the IO employee shall be granted for a period of 60 months starting from the date of issuance of the relevant inspection certificates.

IOs wishing to receive security-related RMI shall obtain an approval inspection certificate from an accredited CAB.

IO employees who are to handle security-related RMI shall obtain an authorisation inspection certificate from an accredited CAB.

CABs shall inform TCs of any approval inspection certificates or authorisation inspection certificates issued, upon which TCs shall create an authorisation record and issue a security token and a digital certificate containing details that allow IO employees to be uniquely identifiable to the vehicle manufacturer RMI website. CABs shall provide individual IO employees with a security token and the digital certificate.

Vehicle manufacturers may demand a fee for the registration of IO employees on those vehicle manufacturers’ RMI websites and for access to security-related RMI. Such fee shall be proportionate to the cost for such registration and provision of access. The fees due shall be specified on the vehicle manufacturers’ RMI websites. All digital data transfers between IOs, TCs and CABs shall be carried out via business to business (B2B) transactions using secure protocols and in a timely manner.

Image omitted; see official source Figure 1

The bodies involved in the accreditation of CABs, approval of IOs and authorisation of IO employees and their relationship

A declaration that certifies that the IO pursues a legitimate business activity as referred to in point 6.3 of this Annex shall be signed by the IO requesting to be authorised by the CAB. An IO shall only be approved after an inspection by the CAB that shall verify that this declaration has been signed and that shall assess whether the IO and its individual employees comply with the requirements laid down in this Appendix.

Individual IO employees shall only be authorised after an inspection by a CAB. CABs shall check the documents submitted and shall verify whether the IO employee concerned made a previous request for authorisation that has been rejected by the CAB concerned or any other CAB at Union level.

CABs shall send all data to the TC that are necessary for the TC to produce the digital certificate and the security token, which the CAB shall send to the IO employees..

IO employees that have been authorised shall receive from their CABs the PIN associated with the digital certificate.

Image omitted; see official source Figure 2

IO approval and IO employee authorisation process

3.1.   Overview of the access to security-related RMI

Vehicle manufacturers shall provide access to security-related RMI through their RMI website, provided that the IO employees are authorised and are able to produce the authorisation inspection certificate, and that the IO on whose behalf the IO employees are working has an approval inspection certificate.

Manufacturers may offer access to an on-line ordering facility for security-related parts using a specialised application linked to the RMI website to authorised IO employees that work for approved IOs.

Upon receipt of a request for access to an RMI website, the vehicle manufacturers’ websites shall require identification through the IO employee unique identifier and request authentication. Authentication of IO employees shall be carried out exclusively using digital certificates. Upon receipt of a digital certificate, vehicle manufacturer RMI websites shall verify the IO employee unique identifier and the current status of the digital certificate and authorisation, by communicating with the TC identified in the digital certificate.

All digital data transfers between IOs, vehicle manufacturers, TCs and CABs shall be carried out via business to business (B2B) transactions, using secure protocols and in a timely manner. Once the IO employee unique identifier and authorisation status of the IO employee have been verified, access to the required security-related RMI shall be provided by the vehicle manufacturer through its website.

Image omitted; see official source Figure 3

Access to security-related RMI

4. Detailed rules concerning access to security-related RMI

4.1.   The role of SERMI

4.1.1.   Responsibilities and obligations

SERMI shall monitor the implementation of the accreditation process across the Member States and inform the Commission accordingly. SERMI shall advise the Commission on requests for changes to the accreditation process.

• (a) SERMI shall advise the Commission on requests for changes to the accreditation process. SERMI shall monitor the implementation of the accreditation process across the Member States and inform the Commission accordingly;

• (b) SERMI shall consult the Commission on the creation of the TC selection criteria;

• (c) SERMI shall advise the Commission on the introduction of technical implementation guidelines for interaction between the entities involved in the process;

• (d) SERMI shall follow the EA’s rules on scheme ownership;

• (e) the members of the SERMI shall be represented by the stakeholders engaged in the process of accreditation, approval and authorisation for the purpose of accessing security-related RMI;

• (f) SERMI shall manage a list of sanctioned interpretations, to be used exclusively for the purpose of interpreting the scheme.

4.1.2.   Trust centre selection

The TC shall be selected by SERMI and be notified to the Commission for approval.

Selected TC shall comply with standard ETSI TS 319 411 -3, fulfil the requirements on electronic signatures laid down in Regulation (EU) No 910/2014 of the European Parliament and of the Council ([^E0054]) and the requirements laid down in point 4.6 of this Appendix.

In addition, the TC shall:

• — have the technical and managerial competence, and the financial viability and experience relevant to the accreditation process;

• — have key personnel that has the skills, experience and availability necessary for the accreditation process;

• — be able to operate across Member States;

• — have in place a quality assurance process at operational level.

4.2.   The role of NABs

The NAB shall be responsible for the accreditation of CABs for the purposes of approving IOs and authorising IO employees for access to security-related RMI.

4.2.1.   Responsibilities and requirements

The responsibilities and requirements of the NAB are set out in Articles 8 to 12 of Regulation (EC) No 765/2008.

4.2.2.   Criteria for CAB accreditation

CABs shall be accredited as type A inspection bodies in accordance with ISO/IEC 17020:2012. CABs shall comply with the requirements concerning the highest level of independence.

Additionally, the NAB shall assess CABs’ capability to comply with the requirements laid down in points 4.3.1 to 4.3.4.

The personnel in charge of IO inspections shall have a level of knowledge in the automotive vehicle repair and maintenance business and of the automotive aftermarket specifics that is appropriate for the tasks they are performing.

4.3.   The role of CABs

The CAB shall be responsible for the inspection of IOs and their respective IO employees and for issuing approval and authorisation inspection certificates in accordance with this Appendix, and for revoking such certificates.

4.3.1.   Responsibilities and requirements

• (a) CABs shall keep the data submitted for the approval of an IO;

• (b) CABs shall establish a secure communication channel with the TC and provide the inspection results to the TC in order to issue the security token with a digital certificate;

• (c) CABs shall notify IO employees 6 months before their authorisation expires;

• (d) CABs shall maintain a database containing data submitted for the authorisation of IO employees;

• (e) CABs that refuse to approve an IO or authorise an IO employee shall communicate the inspection results concerning that IO or that employee to the TC;

• (f) CABs shall only collect and use data required for the approval or authorisation process;

• (g) CABs shall keep all data relating to IO and IO employees confidential and shall ensure that only authorised employees have access to such data;

• (h) CABs shall provide once a year statistics on the number of approval and authorisations issued and also on the number of refusals to SERMI and the Commission;

• (i) CABs shall retain secure records of approval and authorisation inspections for a period of 5 years;

• (j) CABs shall inform all other CABs in the Member State in which it is established about negative inspection results of an IO;

• (k) IOs and IO employees that have received a negative inspection result may provide the CAB with additional information correcting minor deficiencies within 15 working days from receiving the negative inspection result. CABs shall accordingly determine whether the inspection result is to be changed;

• (l) CABs shall notify IOs 6 months before their approval expires;

• (m) CABs shall make random und unannounced on-site inspections of IOs within the 60 months approval validity period, and subject each approved IO to at least one random, on-site inspection over the 60 months approval validity period;

• (n) On the basis of a complaint against an approved IO or an authorised IO employee, CABs shall check that the concerned IO or IO employee are in compliance with the criteria against which they were respectively approved or authorised. The CAB shall determine during its investigation whether an on-site inspection is required;

• (o) For the purposes of on-site inspections, CABs may request the assistance of market surveillance authorities from the Member State they are established;

• (p) CABs shall revoke IO approvals and IO employee authorisations where they no longer comply with the criteria against which they were respectively approved or authorised. CABs shall accordingly request the TC to suspend and repeal digital certificate of the concerned IO employees.

4.3.2.   Renewal of the approval

CABs shall, upon request by an IO or 6 months prior to the expiry of validity of the approval, make an on-site inspection, and in case of a positive inspection result, renew the approval.

CABs shall issue a new approval inspection certificate for IO that fulfils the approval criteria.

CABs shall assess applications for renewals of authorisations and issue an authorisation inspection certificate to IO employees fulfilling the authorisation criteria.

4.3.3.   Criteria for IO approval by the CAB

Before approving an IO and during any on-site inspection during the approval validity period, CABs shall check the following:

• (a) documented ownership of IO, name of managing director;

• (b) the list provided by the IO of employees to be authorised;

• (c) information about the responsibility and the function of employees referred to in point (a);

• (d) whether the IO has a liability insurance with a minimum amount of coverage of 1 million Euro for bodily injury and 0,5 million Euro for property damage;

• (e) whether the approval of the IO has been revoked for reasons of misuse;

• (f) whether the IO has provided proof of activity in the automotive area;

• (g) whether the declaration certifying that the IO pursues a legitimate business activity as referred to in point 6.3 has been signed by the IO and during an on-site inspection whether the IO effectively conducts a legitimate business activity;

• (h) whether the IO or the IO employees have a clean criminal record;

• (i) whether there is declaration signed by the IO legal representative that compliance with the procedural requirements laid down in point 4.3.4 is ensured for all operations related to vehicle security.

4.3.4.   Criteria for IO employee authorisation by the CAB

Before authorising an employee as an IO employee, and during any on-site inspection during the approval validity period, CABs shall verify the following:

• (a) that the employee concerned did not have a previous authorisation which has been revoked because of misuse of that authorisation;

• (b) that the employee has a clean criminal record;

• (c) that there is an employment agreement between the employee concerned and an approved IO;

• (d) that the employee concerned has a valid country specific identity card or an equivalent document.

4.4.   Role of the IOs

4.4.1.   Responsibilities and requirements

• (a) IOs shall request an inspection from their CAB to obtain approval;

• (b) IOs shall inform their CAB about changes in their contact details;

• (c) IOs shall inform their CAB when their business is dissolved;

• (d) IOs shall record every security related RMI transaction and operation;

• (e) IOs shall inform their CAB of any termination of employment of any of their authorised employees;

• (f) IOs shall report to the relevant authorities any offence or misconduct that has been committed by their authorised employees and that concerns security related RMI;

• (g) IOs shall ensure that their authorised employees only use their own authorisation inspection certificates;

• (h) IOs shall ensure that all fees relating to their IO employee’s authorisation have been paid;

• (i) IOs shall ensure that their IO employees are trained for repair activities concerning automotive maintenance, reprogramming and security and safety functions;

• (j) IO shall request their CAB for an on-site inspection in the six months prior to the expiration of their approval inspection certificate.

• 4.4.2. RSS shall be subject to the responsibilities and requirements laid down in point 4.4.1.

4.5.   Role of IO employees

4.5.1.   Responsibilities and requirements

• (a) IO employees shall request their CAB for authorisation;

• (b) IO employees shall register themselves on the vehicle manufacturer’s RMI system;

• (c) IO employees shall access security-related RMI in accordance with EN ISO standard 18541 – 2014;

• (d) IO employees shall ensure that all records of security related RMI downloaded from the vehicle manufacturer RMI system shall not be stored any longer than necessary for performing the operation for which the information is needed;

• (e) where applicable, IO employees shall notify their IO employer that their digital certificate is no longer required;

• (f) IO employee shall not share with any third party the security token, the digital certificate or the PIN;

• (g) IO employees shall be responsible for using the personal security token and PIN correctly;

• (h) IO employees shall inform their IO and their TC about any loss or misuse of their security token within 24 hours of such loss or misuse;

• (i) IO employees shall report to the relevant authorities any request or act from other IO employees relating to security-related RMI that does not constitute a legitimate business activity as referred to in point 6.3 of this Annex.

• 4.5.2. RSS employee shall be subject to the responsibilities and requirements laid down in point 4.5.1.

4.6.   Role of the trust centre

TCs shall create and send the digital certificates to the IOs via the respective CABs to the IOs and the IO employees. TCs shall maintain a database of issued authorisation inspection certificates. TCs shall provide vehicle manufacturers access to an interface to verify the status of the digital certificates and the authorisation inspection certificates.

TCs shall keep the information regarding IO employees in the authorisation database for an additional period of maximum 60 months. That period shall not be longer than the remaining validity period of the approval granted to the IO where the IO employee is working.

4.6.1.   Responsibilities and requirements

• (a) TCs can suspend and repeal digital certificates upon request from the CAB;

• (b) TCs shall provide the software to use the digital certificates to the IO and IO employees;

• (c) TCs shall operate 24 hours a day, 7 days a week.

4.7.   Role of vehicle manufacturers

Vehicle manufacturers shall provide to all approved IOs and authorised IO employees access to security-related repair and maintenance information. Vehicle manufacturers shall communicate with TCs to verify the authorisation and authentication status of IO employees seeking access to such information.

4.7.1.   Responsibilities and requirements

• (a) vehicle manufacturers shall ensure that their websites are adapted to support the access of IOs to security-related RMI;

• (b) vehicle manufacturers shall ensure that they download the technical specifications made available on the SERMI website.

4.7.2.   Procedural requirements for vehicle manufacturers

Vehicle manufacturers shall not grant access to security-related RMI, unless all of the following procedural requirements have been complied with:

• (1) Procedural requirements for stolen vehicles Vehicle manufacturers shall keep a record of all vehicles of its brand reported by the authorities as stolen. Vehicle manufacturers shall put in place a process that provides clear traceability and accountability and enables the relevant authorities to trace the data supplied by the vehicle manufacturer to the IO employee who was granted access to the information related to the stolen vehicle.