Legalize
Legalize / European Union / Implementing Regulation

Commission Implementing Regulation (EU) 2025/1706 of 25 July 2025 laying down rules, procedures and testing methodologies for the application of Regulation (EU) 2024/1257 as regards exhaust and evaporative emission type-approval of vehicles of categories M1 and N1 and amending Implementing Regulation (EU) 2020/683

Type Implementing Regulation
Publication 2025-09-05
State In force
Department European Commission, GROW
Source EUR-Lex
articles 19
Reform history JSON API

5. DOCUMENTATION

6. CONFORMITY OF PRODUCTION

Appendix 1

MODEL

Information document No …

relating to the EU type-approval of replacement pollution control devices

The following information, if applicable, shall be supplied in triplicate and include a list of contents. Any drawings shall be supplied in appropriate scale and sufficient detail on size A4 or on a folder of A4 format. Photographs, if any, shall show sufficient detail.

If the systems, components or separate technical units have electronic controls, information concerning their performance shall be supplied.

0. GENERAL

1. DESCRIPTION OF THE DEVICE

Appendix 2

MODEL EU TYPE-APPROVAL CERTIFICATE

(Maximum format: A4 (210 mm × 297 mm))

EU TYPE-APPROVAL CERTIFICATE

Stamp of administration

Communication concerning the:

of a type of component/separate technical unit ([^E0056])

with regard to Regulation (EU) 2024/1257, as implemented by Regulation (EU) No 2025/1706

Regulation (EU) 2024/1257 or Regulation (EU) No 2025/1706 as last amended by …

EU type-approval number: …

Reason for extension: …

SECTION I

SECTION II
Attachments: Information package.

Appendix 3

Model of emission type-approval marks

(see point 3.2 of this Annex)

Image omitted; see official source

The above approval mark affixed to a component of a replacement pollution control device shows that the type concerned has been approved in France (e 2), pursuant to this Regulation. The first two digits of the approval number (00) indicate that this part was approved according to this Regulation. The following four digits (1234) are those allocated by the approval authority to the replacement pollution control device as the base approval number.

ANNEX XIV

ANTI-TAMPERING, SECURITY AND CYBERSECURITY

1. INTRODUCTION

This Annex lays down measures regarding the type-approval of anti-tampering, security and cybersecurity systems.

2. DEFINITIONS

For the purposes of this Annex, the definitions in UN Regulation No 155 ([^E0059]) shall apply.

‘Attacks’ shall be understood as comprising tampering attempts, attempts to circumvent security and cyber-attacks.

3. REQUIREMENTS FOR TYPE-APPROVAL

3.1.   Responsibilities of manufacturers

It is the responsibility of the manufacturer that the vehicle type (with regard to emissions) is equipped with sufficient anti-tampering, security and cybersecurity measures to make it resistant against tampering, cybersecurity and security threats arising in all phases of its life-cycle.

To fulfil this responsibility, the vulnerabilities that may lead to tampering shall be minimised to the fullest extent possible, based on the best available knowledge at the time of type-approval, for all systems listed in Article 4(7) of Regulation (EU) 2024/1257.

This shall be deemed to be complied with when:

Without prejudice to requirements of paragraph 7.2.2.2(g) of UN Regulation No 155, the manufacturer shall monitor for, detect, respond to and inform the approval authority on evidences of successful attacks on any of the systems listed in Article 4(7) of Regulation (EU) 2024/1257.

3.2.   Responsibilities of approval authorities

Without prejudice to the requirements of paragraph 5.1.1 of UN Regulation No 155, type-approval authorities shall verify whether the vulnerability/threat analysis and risk assessment conducted by the manufacturer is appropriate and sufficient. This verification shall ensure that the vulnerabilities and threats of the tables in Appendix 1 have been appropriately managed by the manufacturer. The examples in these tables shall be used as reference.

The type-approval authority may require additional documentation to verify that the proposed mitigation actions are correctly implemented.

Type-approval authorities are encouraged to exchange best practices and experiences within the framework of the Forum for Exchange of Information on Enforcement as established in Regulation (EU) 2018/858.

3.3.   Responsibilities of market surveillance authorities

Following the requirements in Article 8 to Regulation (EU) 2018/858 ([^E0062]), the market surveillance authorities shall carry out regular tests to verify whether anti-tampering, security and cybersecurity measures are sufficient. Market surveillance authorities shall be responsible for vehicle selection, application of testing methods, follow-up activities, reporting and corrective or restrictive measures.

3.3.1.   Vehicle selection for market surveillance

When carrying out market surveillance tests, the market surveillance authorities shall select the vehicle types with regards to emissions to be tested based on a risk assessment. Vehicle types (with regards to emissions) deemed to pose a greater risk according to the risk assessment shall be prioritised for testing according to paragraph 3.3.2.

The risk assessment shall consider the following aspects:

3.3.2.   Testing methods

Market surveillance authorities may employ any test method to establish whether vehicles belonging to a certain vehicle type with regard to emissions are sufficiently protected against attacks which could affect the proper operation of systems listed in Article 4(7) of Regulation (EU) 2024/1257. Market surveillance authorities are encouraged to exchange best practices and experiences within the framework of the Forum for Exchange of Information on Enforcement as established in Regulation (EU) 2018/858.

The good state of each test vehicle shall be verified before conducting the tests, ensuring in particular the proper operation of systems listed in Article 4(7) of Regulation (EU) 2024/1257 and that they have not been subject to attacks in the scope of the tests. The verification shall ensure that no relevant fault code is stored nor any relevant warning light is on, that none of the pollutant monitoring statuses is in ‘Error’ and that the tampering detection level as set out in Annex I to Implementing Regulation (EU) 2025/1707 reported by the OBM is ‘Level 0’.

This verification shall also include, where appropriate, the performance of an ex ante Type 1 or RDE test according to this Regulation. The attack test shall not proceed unless the emission results of the ex ante test fulfil the applicable emission limits.

The tests conducted by market surveillance authorities shall aim to reproduce the attacks likely to be experienced by certain vehicle types with regard to emissions in the field due to a high benefit-cost ratio. These may include attempts to tamper with vehicles by exploiting existing tampering, security and cybersecurity vulnerabilities, or by installing tampering products that are available on the market. The selection of attacks shall be based on the risk assessment described in paragraph 3.3.1.

3.3.3.   Test evaluation

The market surveillance authority shall determine the outcome of the test by evaluating the effects of the attack on exhaust emissions or on the integrity of the data used by the systems listed in Article 4(7) of Regulation (EU) 2024/1257, taking account of the response of the vehicle to the attacks. The authority shall come to a ‘pass’, ‘follow-up’ or ‘fail’ decision on one or both aspects, as appropriate according to the nature of the attack.

A ‘pass’ outcome requires no further action.

A ‘follow-up’ outcome shall be followed by the activities described in paragraph 3.3.4.

A ‘fail’ outcome shall be followed by the activities described in paragraph 3.3.5.

Following the attack, the market surveillance authority may condition the vehicle by driving it over a certain distance, over multiple trips, or in other conditions that are deemed appropriate for the attack to be detected.

3.3.3.1.   Evaluation of effects on exhaust emissions (pollutants monitored by OBM)

After the attack and optional conditioning, an ex post Type 1 or RDE test shall be performed. The ex ante and ex post tests shall be of the same type. If two RDE tests are driven, the tests shall be performed over the same route, with similar driving behaviour, and under comparable environmental and traffic conditions.

Following the ex post emissions test, the test outcome shall be determined for each pollutant monitored by the OBM system. The test outcome shall be considered a ‘pass’ if one of the following is observed:

If the test outcome is not a direct ‘pass’, the vehicle may be conditioned further to allow more evaluation time for the OBM system to transition the pollutant monitoring statuses and tampering detection level.

When, after further conditioning, the monitoring statuses or tampering detection level do not transition in such a way that they lead to a ‘pass’ outcome, the test outcome shall be considered a ‘follow-up’ if one of the following outcomes is observed:

If the outcome is neither a ‘pass’ nor a ‘follow-up’, it shall be considered a ‘fail’.

Vehicles not equipped with an OBM system shall be excluded from the evaluation of the effects on exhaust emissions according to this paragraph.

3.3.3.2.   Evaluation of effects on exhaust emissions (pollutants not monitored by OBM)

After the attack and optional conditioning, an ex post Type 1 or RDE test shall be performed. The ex ante and ex post tests shall be of the same type. If two RDE tests are driven, the tests shall be performed over the same route, with similar driving behaviour, and under comparable environmental and traffic conditions.

Following the ex post emissions test, for all pollutants not monitored by the OBM system, the test outcome shall be considered a ‘follow-up’ when the pollutants are substantially increased to a level above the applicable OBD threshold values as specified in paragraph 6.8.2 of UN Regulation No 154 while the malfunction indicator (MI) is not activated. In any other case, it shall be considered a ‘pass’.

If the test outcome is not a direct ‘pass’, the vehicle may be conditioned further to allow more evaluation time for the OBD system to activate the malfunction indicator.

3.3.3.3.   Evaluation of effects on the integrity of data

Following the attack and optional conditioning, the outcome shall be considered a ‘pass’ when the attack is unsuccessful in modifying data of the systems listed in Article 4(7) of Regulation (EU) 2024/1257.

If the attack is successful in modifying data of the systems listed in Article 4(7) of Regulation (EU) 2024/1257, the outcome shall be evaluated by the market surveillance authority on the following two criteria:

When the impact is regarded as insignificant, the outcome shall be considered a ‘pass’.

When the impact is regarded as significant, and the response is deemed adequate by the authority, the outcome shall be considered a ‘pass’.

When the impact is regarded as significant and the response is deemed inadequate, the outcome shall be considered a ‘follow-up’. In such cases, the market surveilance authority shall contact the manufacturer to inform them of the outcome of the test, the characteristics of the vehicle and the nature of the tests performed.

The manufacturer may propose further conditioning to allow additional time for the vehicle to respond to the attack, or repeated tests on similar vehicles. Following the further conditioning or repeated tests, the response of the vehicle shall be evaluated. If the vehicle response is still deemed inadequate by the market surveillance authority, the outcome shall be confirmed as a ‘follow-up’. If the response of the vehicle is deemed adequate, the outcome shall be considered a ‘pass’.

3.3.4.   Follow-up activities

In the case of an attack with an outcome considered as ‘follow-up’, it shall be investigated in detail, where necessary in cooperation with the manufacturer and the granting type-approval authority, to establish:

Without prejudice to requirements of Chapter XI of Regulation (EU) 2018/858, the manufacturer shall, within a period agreed with the market surveillance authority, propose a technical solution to the market surveillance authority to increase the resistance of the vehicle against attacks, either by effectively mitigating the exploitation of the vulnerability or by implementing methods to detect the attack and initiate an appropriate response, along with a plan to implement this technical solution. The market surveillance authority shall evaluate the technical solution and accompanying implementation plan and request modifications where appropriate.

When the technical solution and implementation plan are accepted by the market surveillance authority, the manufacturer shall proceed with the implementation of the technical solution as agreed with the market surveillance authority.

When the technical solution and implementation plan fail to satisfy the market surveillance authority, the outcome shall be considered a ‘fail’.

The results of the investigation of attacks with a ‘follow-up’ outcome shall be brought to the attention of to the Forum for Exchange of Information on Enforcement as established in Regulation (EU) 2018/858.

3.3.5.   Reporting, corrective and administrative measures following a ‘fail’ outcome

A ‘fail’ outcome upon an attack shall be investigated in detail, where necessary in cooperation with the manufacturer and the granting type-approval authority, to establish:

The details of tests with a ‘fail’ outcome shall be reported to the manufacturer, and the market surveillance authorities shall require the manufacturer to take measures in accordance with Chapter XI of Regulation (EU) 2018/858 to ensure that the exploited vulnerability is effectively mitigated, preferably by an over-the-air software update of the relevant vehicle systems according to UN Regulation No 156 ([^E0063]).

In determining the appropriateness of corrective measures, authorities shall consider the state of technology of the vehicle type with regard to emissions, the technical feasibility of possible mitigations and the likelihood of exploitation of the vulnerability (approximated by the benefit-cost ratio of the attack). The manufacturer may, with appropriate supporting evidence, demonstrate that a vulnerability cannot be effectively mitigated or that an appropriate response from the tampering detection cannot be realised, due to technical limitations of the vehicle’s architecture. If the manufacturer comprehensively demonstrates to the market surveillance authority that a mitigation is not technically feasible, the manufacturer shall not be required to provide corrective measures.

The results of the investigation of attacks with a ‘fail’ outcome shall be brought to the attention of to the Forum for Exchange of Information on Enforcement as established in Regulation (EU) 2018/858. In case of vulnerabilities that cannot be effectively mitigated due to technical limitations are identified, the Forum for Exchange of Information on Enforcement shall consider requesting corresponding additional mitigations in future type approvals.

3.4.   Roles and responsibilities for the Commission and recognised third parties

The Commission and recognised third parties may verify whether vehicles belonging to a certain vehicle type with regard to emissions are sufficiently protected against tampering attempts, security and cybersecurity attacks affecting the systems listed in Article 4(7) of Regulation (EU) 2024/1257 according to the methods described in paragraph 3.3.2.

4. ADMINISTRATIVE PROVISIONS

4.1.   Administrative provisions for anti-tampering, security and cybersecurity

Documentation to demonstrate compliance with paragraph 3.1 shall be made available by the manufacturer in two parts: (a) The formal documentation package for the approval, according to documentation requirements in UN Regulation No 155 paragraph 3.3, which shall be supplied to the type-approval authority at the time of submission of the type approval application. This documentation package shall be used by the type-approval authority as the basic reference for the approval process. The type-approval authority shall ensure that this documentation package remains available for at least 10 years counted from the time when production of the vehicle type (with regard to emissions) is definitively discontinued; (b) Additional material relevant to the requirements of this regulation may be retained by the manufacturer, but made open for inspection at the time of type-approval. The manufacturer shall ensure that any material made open for inspection at the time of type approval remains available for at least a period of 10 years counted from the time when production of the vehicle type (with regard to emissions) is definitively discontinued.

In cases where information is shown to be covered by intellectual property rights or to constitute specific know-how of the manufacturer or of their suppliers, the manufacturer or their suppliers shall make available sufficient information to enable the checks referred to in this Regulation to be made properly. Such information shall be treated on a confidential basis.

The manufacturer shall provide a manufacturer’s declaration of compliance with the anti-tampering, security and cybersecurity requirements of this Regulation for the purposes of type-approval. This declaration shall use the format provided in Appendix 2 to this Annex.

Appendix 1

HIGH-LEVEL VULNERABILITIES/THREATS, EXAMPLES OF VULNERABILITIES OR ATTACK METHODS, AND EXAMPLES OF MITIGATIONS

The manufacturers, while analysing the vulnerabilities/threats and assessing the risks for the systems listed in Article 4(7) of Regulation (EU) 2024/1257, shall consider all relevant vulnerabilities or attack methods associated with each high-level vulnerability/threat, and implement proportionate mitigations to protect the vehicle type with regard to emissions as appropriate. Examples of vulnerabilities or attack methods to be considered and examples of mitigations to be implemented are included in Table 4.1, Table 4.2 and Table 4.3 for each high-level vulnerability/threat of each system. The examples referring to Annex 5, Part A and Part B of UN Regulation No 155 shall be considered in the context of the specific system to which they apply.

Table 4.1
High-level vulnerabilities/threats, examples of vulnerabilities or attack methods and example of mitigations
System High-level vulnerability/threat Examples of vulnerabilities or attack methods Examples of mitigations
Pollution control systems Unauthorised modification of engine/sensor control unit (ECU/SCU) data or software code Vulnerabilities or attack methods in Annex 5, Part A of UN Regulation No 155: 9.1, 12.1, 17.1, 18.3 Corresponding mitigations in Annex 5, Part B of UN Regulation No 155
Pollution control systems Unauthorised modification of engine/sensor control unit (ECU/SCU) data or software code Unauthorised software injection via ECU flashing tools to disable or alter emission control components, suppress OBD/OBM inducement, or prevent DTCs Access control techniques/designs and secure software update procedures e.g., update authentication, integrity check, secure boot process
Pollution control systems Unauthorised access and modification to ECU/SCU hardware Vulnerabilities or attack methods in Annex 5, Part A of UN Regulation No 155: 28.2, 32.1 Corresponding mitigations in Annex 5, Part B of UN Regulation No 155
Pollution control systems Unauthorised access and modification to ECU/SCU hardware Unauthorised access to and modification of internal circuit of control units of emission-related components Access prevention or detection measures e.g., with tamper-resistant or tamper-evident hardware
Pollution control systems Manipulation of communication messages inside the vehicle through data modifications Vulnerabilities or attack methods in Annex 5, Part A of UN Regulation No 155: 11.3, 20.3, 23.1 Corresponding mitigations in Annex 5, Part B of UN Regulation No 155
Pollution control systems Manipulation of communication messages inside the vehicle through data modifications Injection, interception or alteration of vehicle communication messages (e.g., CAN), for example by emulators Measures to detect malicious internal messages or activity e.g., plausibility checks, timing analysis or certificate-based authentication to maintain emission data integrity
Pollution control systems Manipulation of signals inside the vehicle through hardware modifications Vulnerabilities or attack methods in Annex 5, Part A of UN Regulation No 155: 11.1, 25.1 Corresponding mitigations in Annex 5, Part B of UN Regulation No 155
Pollution control systems Manipulation of signals inside the vehicle through hardware modifications Unauthorised alteration or manipulation of emission-related signals (e.g., ambient or exhaust temperature) by physical modifications, for example by modifiers Diagnostic functions, plausibility checks or anomaly detection systems
Fuel and reagent system Unauthorised modification of ECU/SCU data or software code Vulnerabilities or attack methods in Annex 5, Part A of UN Regulation No 155: 9.1, 20.4, 23.1 Corresponding mitigations in Annex 5, Part B of UN Regulation No 155
Fuel and reagent system Unauthorised modification of ECU/SCU data or software code Unauthorised modification of engine control software to modify fuel or reagent injection e.g., altering injected quantity Access control techniques/designs and secure software update procedures e.g., update authentication, integrity check, secure boot process
Fuel and reagent system Unauthorised access and modification to ECU/SCU hardware Vulnerabilities or attack methods in Annex 5, Part A of UN Regulation No 155: 25.1, 27.1, 32.1 Corresponding mitigations in Annex 5, Part B of UN Regulation No 155
Fuel and reagent system Unauthorised access and modification to ECU/SCU hardware Unauthorised access to and modification of internal circuit of control units of fuel or reagent-related components Access prevention or detection measures e.g., with tamper-resistant or tamper-evident hardware
Engine and engine control units Unauthorised modification of ECU data or software code Vulnerabilities or attack methods in Annex 5, Part A of UN Regulation No 155: 9.1, 20.4, 23.1 Corresponding mitigations in Annex 5, Part B of UN Regulation No 155
Engine and engine control units Unauthorised modification of ECU data or software code Installing unauthorised firmware to modify engine functional parameters Access control techniques/designs and secure software update procedures e.g., update authentication, integrity check, secure boot process
Engine and engine control units Unauthorised access and modification to ECU hardware Vulnerabilities or attack methods in Annex 5, Part A of UN Regulation No 155: 11.3, 18.3, 32.1 Corresponding mitigations in Annex 5, Part B of UN Regulation No 155
Engine and engine control units Unauthorised access and modification to ECU hardware Unauthorised access to and modification of internal circuit of engine control units Access prevention or detection measures e.g., with tamper resistant or tamper evident hardware
Table 4.2
High-level vulnerabilities/threats, examples of vulnerabilities or attack methods and example of mitigations
System High-level vulnerability/threat Examples of vulnerabilities or attack methods Examples of mitigations
OBM system Unauthorised modification of ECU/SCU data or software code Vulnerabilities in Annex 5, Part A of UN Regulation No 155: 9.1, 20.4, 23.1 Corresponding mitigations in Annex 5, Part B of UN Regulation No 155
OBM system Unauthorised modification of ECU/SCU data or software code Modifying or disabling vehicle data reported by the OBM system Access control techniques/designs and secure software update procedures e.g., update authentication, integrity check, secure boot process
OBM system Unauthorised access and modification to ECU/SCU hardware Vulnerabilities in Annex 5, Part A of UN Regulation No 155: 25.1, 32.1 Corresponding mitigations in Annex 5, Part B of UN Regulation No 155
OBM system Unauthorised access and modification to ECU/SCU hardware Unauthorised access to and modification of internal circuit of control units of OBM-related components Access prevention or detection measures e.g., with tamper-resistant or tamper-evident hardware
OBD system Unauthorised modification of ECU/SCU data or software code Vulnerabilities in Annex 5, Part A of UN Regulation No 155: 19.1, 18.3, 20.4, 20.5, 23.1 Corresponding mitigations in Annex 5, Part B of UN Regulation No 155
OBD system Unauthorised modification of ECU/SCU data or software code Installing unauthorised firmware to modify diagnostic behaviour Access control techniques/designs and secure software update procedures e.g., update authentication, integrity check, secure boot process
OBD system Unauthorised access and modification to ECU/SCU hardware Vulnerabilities in Annex 5, Part A of UN Regulation No 155: 25.1, 32.1 Corresponding mitigations in Annex 5, Part B of UN Regulation No 155
OBD system Unauthorised access and modification to ECU/SCU hardware Unauthorised access to and modification of internal circuit of control units of OBD-related components Access prevention or detection measures e.g., with tamper-resistant or tamper-evident hardware
OBFCM device Unauthorised modification of ECU/SCU data or software code Vulnerabilities in Annex 5, Part A of UN Regulation No 155: 9.1, 20.4, 23.1 Corresponding mitigations in Annex 5, Part B of UN Regulation No 155
OBFCM device Unauthorised modification of ECU/SCU data or software code Modifying fuel consumption data reported by the device Access control techniques/designs and secure software update procedures e.g., update authentication, integrity check, secure boot process
OBFCM device Unauthorised access and modification to ECU/SCU hardware Vulnerabilities in Annex 5, Part A of UN Regulation No 155: 25.1, 32.1 Corresponding mitigations in Annex 5, Part B of UN Regulation No 155
OBFCM device Unauthorised access and modification to ECU/SCU hardware Unauthorised access to and modification of internal circuit of control units of OBFCM-related components Access prevention or detection measures e.g., with tamper-resistant or tamper-evident hardware
Table 4.3
High-level vulnerabilities/threats, examples of vulnerabilities or attack methods and example of mitigations
System High-level vulnerability/threat Examples of vulnerabilities or attack methods Examples of mitigations
Traction batteries and related management systems Unauthorised modification of ECU/SCU data or software code Vulnerabilities in Annex 5, Part A of UN Regulation No 155: 12.2, 20.3, 23.1 Corresponding mitigations in Annex 5, Part B of UN Regulation No 155
Traction batteries and related management systems Unauthorised modification of ECU/SCU data or software code Altering software to modify charging/discharging rates and battery durability data Access control techniques/designs and secure software update procedures e.g., update authentication, integrity check, secure boot process
Traction batteries and related management systems Unauthorised access and modification to ECU/SCU hardware Vulnerabilities in Annex 5, Part A of UN Regulation No 155: 27.1, 32.1 Corresponding mitigations in Annex 5, Part B of UN Regulation No 155
Traction batteries and related management systems Unauthorised access and modification to ECU/SCU hardware Unauthorised access to and modification of internal circuit of control units of battery-related components Access prevention or detection measures e.g., with tamper-resistant or tamper-evident hardware
Electric Motor and Related Control Units Unauthorised modification of ECU/SCU data or software code Vulnerabilities in Annex 5, Part A of UN Regulation No 155: 5.1, 9.1, 20.4, 23.1 Corresponding mitigations in Annex 5, Part B of UN Regulation No 155
Electric Motor and Related Control Units Unauthorised modification of ECU/SCU data or software code Installing unauthorised firmware to modify inverter or motor controllers Access control techniques/designs and secure software update procedures e.g., update authentication, integrity check, secure boot process
Electric Motor and Related Control Units Unauthorised access and modification to ECU/SCU hardware Vulnerabilities in Annex 5, Part A of UN Regulation No 155: 25.1, 32.1 Corresponding mitigations in Annex 5, Part B of UN Regulation No 155
Electric Motor and Related Control Units Unauthorised access and modification to ECU/SCU hardware Unauthorised access to and modification of internal circuit of control units of electric motor-related components Access prevention or detection measures e.g., with tamper-resistant or tamper-evident hardware
EVP Unauthorised modification of ECU/SCU data or software code Vulnerabilities in Annex 5, Part A of UN Regulation No 155: 9.1, 20.4, 23.1 Corresponding mitigations in Annex 5, Part B of UN Regulation No 155
EVP Unauthorised modification of ECU/SCU data or software code Modifying environmental data related to the EVP Access control techniques/designs and secure software update procedures e.g., update authentication, integrity check, secure boot process
EVP Unauthorised access and modification to ECU/SCU hardware Vulnerabilities in Annex 5, Part A of UN Regulation No 155: 25.1, 32.1 Corresponding mitigations in Annex 5, Part B of UN Regulation No 155
EVP Unauthorised access and modification to ECU/SCU hardware Unauthorised access to and modification of internal circuit of control units to modify environmental data related to the EVP Access prevention or detection measures e.g., with tamper-resistant or tamper-evident hardware

Appendix 2

MANUFACTURER’S DECLARATION OF COMPLIANCE WITH THE ANTI-TAMPERING, SECURITY AND CYBERSECURITY REQUIREMENTS FOR THE PURPOSES OF TYPE-APPROVAL

(Manufacturer): …..

(Address of the manufacturer): …..

Declares that:

Done at [….. Place ([^E0065]) ]

On [….. Date]

[Name and signature of person authorised by the Manufacturer or Manufacturer’s Representative( ([^E0066]) ?) ]

Attachments

Annex I: List of Vehicle Type(s), Family(ies) or other vehicle descriptor(s) with regard to emissions to which this declaration applies

Annex II: Anti-tampering, security and cybersecurity documentation package

Annex III: list of any exemptions and/or deficiencies applicable to these vehicles related to the anti-tampering, security and cybersecurity provisions laid down in this Regulation

ANNEX XV

(reserved)

ANNEX XVI

REQUIREMENTS FOR VEHICLES THAT USE A REAGENT FOR THE EXHAUST AFTER-TREATMENT SYSTEM

1. INTRODUCTION

2. GENERAL REQUIREMENTS

3. TECHNICAL REQUIREMENTS

Appendix 1

MANUFACTURER’S DECLARATION OF COMPLIANCE WITH THE REAGENT REQUIREMENTS

(Manufacturer): …..

(Address of the manufacturer): …..

Declares that:

For the vehicles covered by this approval/the vehicles listed in Annex I to this declaration ([^E0067]), are in compliance with, the requirements regarding the correct operation of systems using a consumable reagent in accordance with Annex XVI of this Regulation.

Done at [….. Place ([^E0068])]

On [….. Date]

[Name and signature of person authorised by the Manufacturer or Manufacturer’s Representative ([^E0069]) ]

Attachment(s)

Annex I: The Vehicle Type(s), Family(ies) or vehicles described by other vehicle descriptor(s) to which this declaration applies (if applicable).

ANNEX XVII

(reserved)

ANNEX XVIII

AMENDMENTS TO IMPLEMENTING REGULATION (EU) 2020/683

The explanatory notes in Annex I to Regulation (EU) 2020/683 are amended as follows:

Annex IV is amended as follows:

The Appendix to Annex VIII is amended as follows:

ANNEX XIX

(reserved)

ANNEX XX

MEASUREMENTS OF NET POWER AND THE MAXIMUM 30 MINUTES POWER OF ELECTRIC DRIVE TRAINS

1. INTRODUCTION

2. GENERAL SPECIFICATIONS

ANNEX XXI

WORLD HARMONIZED LIGHT VEHICLE TEST PROCEDURE (WLTP) – (TYPE 1 TEST)

1. INTRODUCTION

This Annex describes the procedure for determining the levels of emissions of gaseous compounds, particulate matter, particle number, CO2 emissions, fuel consumption, electric energy consumption and electric range from light- duty vehicles.

2. GENERAL REQUIREMENTS

3. TECHNICAL REQUIREMENTS

The technical requirements for conducting the type 1 test shall be those set out in paragraph 6.3 and Annexes Part B of UN Regulation No 154, with the exceptions described in the points below.

Energy efficiency class Range of RRC for C1 tyres Range of RRC for C2 tyres Range of RRC for C3 tyres
A RRC ≤ 6,5 RRC ≤ 5,5 RRC ≤ 4,0
B 6,6 ≤ RRC ≤ 7,7 5,6 ≤ RRC ≤ 6,7 4,1 ≤ RRC ≤ 5,0
C 7,8 ≤ RRC ≤ 9,0 6,8 ≤ RRC ≤ 8,0 5,1 ≤ RRC ≤ 6,0
D 9,1 ≤ RRC ≤ 10,5 8,1 ≤ RRC ≤ 9,0 6,1 ≤ RRC ≤ 7,0
E RRC ≥10,6 RRC ≥ 9,1 RRC ≥ 7,1
Energy efficiency class Value of RRC to be used for interpolation for C1 tyres Value of RRC to be used for interpolation for C2 tyres Value of RRC to be used for interpolation for C3 tyres
A RRC = 5,9 [^E0070] RRC = 4,9 [^E0070] RRC = 3,5 [^E0070]
B RRC = 7,1 RRC = 6,1 RRC = 4,5
C RRC = 8,4 RRC = 7,4 RRC = 5,5
D RRC = 9,8 RRC = 8,6 RRC = 6,5
E RRC = 11,3 RRC = 9,9 RRC = 7,5

In case the actual RRC value is lower than this value, the actual rolling resistance value of the tyre or any higher value up to the RRC value indicated here shall be used for interpolation.

‘4.3.1.2.1.3.Any other sampling configuration for the PTS for which equivalent solid particle penetration at 15 nm can be demonstrated shall be considered acceptable.’

‘4.3.1.2.1.5.Any other sampling configuration for the OT for which equivalent solid particle penetration at 15 nm can be demonstrated shall be considered acceptable.’

  • ‘(g) Achieve a particle concentration reduction factor fr(di) for particles of 15 nm, 30 nm and 50 nm electrical mobility diameters that is no more than 100 per cent, 30 per cent and 20 per cent respectively higher, and no more than 5 per cent lower than that for particles of 100 nm electrical mobility diameter for the VPR as a whole;’
  • ‘(i) Achieve more than 99,9 per cent vaporization of tetracontane (CH3(CH2)38CH3) particles with count median diameter > 50 nm and mass > 1 mg/m3, by means of heating and reduction of partial pressures of the tetracontane.’

‘Table A5/2

PNC counting efficiency
Nominal particle electrical mobility diameter (nm) PNC counting efficiency (per cent)
10 65 ± 15
15 > 90’

‘ Figure A5/14

Image omitted; see official source ’

‘The evaporation tube, ET, shall be catalytically active with a wall temperature of 350 °C (±10 °C).’

  • ‘(b) A second full flow PNC with counting efficiency above 90 per cent for 10 nm equivalent electrical mobility diameter particles that has been calibrated by the method described above. The second PNC counting efficiency shall be taken into account in the calibration.’

‘5.7.1.4.Calibration shall also include a check, according to the requirements of paragraph 4.3.1.3.4.(h) of this annex, on the PNC’s counting efficiency with particles of 10 nm electrical mobility diameter. A check of the counting efficiency with 15 nm particles is not required during periodical calibration.’

‘The VPR shall be characterised for particle concentration reduction factor with solid particles of 15, 30, 50 and 100 nm electrical mobility diameter. Particle concentration reduction factors fr(d) for particles of 15 nm, 30 nm and 50 nm electrical mobility diameters shall be no more than 100 per cent, 30 per cent and 20 per cent higher respectively, and no more than 5 per cent lower than that for particles of 100 nm electrical mobility diameter. For the purposes of validation, the arithmetic average of the particle concentration reduction factor calculated for particles of 30 nm, 50 nm and 100 nm electrical mobility diameters shall be within ±10 per cent of the arithmetic average particle concentration reduction factor fr determined during the latest complete calibration of the VPR.’

‘The test aerosol for these measurements shall be solid particles of 30, 50 and 100 nm electrical mobility diameter with a minimum concentration of 5 000 particles per cm3 and a minimum concentration of 3 000 particles per cm3 of 15 nm electrical mobility diameter at the VPR inlet. The test aerosol shall be thermally stable at the VPR operating temperatures. Particle number concentrations shall be measured upstream and downstream of the components.’

‘5.7.2.3.The VPR shall demonstrate greater than 99.9 per cent removal efficiency of tetracontane (CH3(CH2)38CH3) particles with count median diameter > 50 nm and mass > 1 mg/m3.’

Appendix 1

MANUFACTURER’S DECLARATION FOR THE AMBIENT TEMPERATURE CORRECTION TEST (ATCT)

(Manufacturer): …..

(Address of the manufacturer): …..

Declares that:

For the vehicles covered by this approval/the vehicles listed in Annex I to this declaration ([^E0071]), the following family correction factor(s) (FCFs) shall be considered for the postprocessing of the relevant WLTP type 1 tests at 23 °C.

This declaration is based on the testing conditions and settings as defined in UN Regulation No 154, Annexes B6a and B6 (Level 1A) as applicable:

Vehicle description (OEM to be defined) FCF [^E0072]
X
Y
Z

Manufacturers shall declare the Family Correction Factor rounded to four decimals.

Done at [….. Place ([^E0073])]

On [….. Date]

[Name and signature of person authorised by the Manufacturer or Manufacturer’s Representative ([^E0074]) ]

Attachment(s)

Annex I: The Vehicle Type(s), Family(ies) or vehicles described by other vehicle descriptor(s) to which this declaration applies (if applicable).

Appendix 2

MANUFACTURER’S DECLARATION FOR THE REGENERATION REQUIREMENTS

(Manufacturer): …..

(Address of the manufacturer): …..

Declares that:

For the vehicles covered by this approval/the vehicles listed in Annex I to this declaration, the following Ki factors in accordance with UN Regulation No 154, Annex B6, Appendix 1 shall be used:

Compression ignition engine regeneration factors (Ki)

([^E0075])

NOX CO THC+NOX PM CO2
Multiplicative [^E0076]
Additive 29

Delete what is not applicable.

Positive ignition engine regeneration factors (Ki) (28) NOX CO THC NMHC PM CO2
Multiplicative 29
Additive 29

Alternatively (if applicable):

[ ] Ki factors with a value of 1,0 as the periodic regeneration occurs at least once per Type 1 test and has already occurred at least once during vehicle preparation.

[ ] Ki factors with a value of 1,0 as the distance between two successive periodic regenerations is more than 4 000  km of driving repeated Type 1 tests.

[ ] CO2 Ki factors with a value of 1,05 as emission limits are fulfilled during regenerations.

In addition, for the purpose of WLTP Type 1 Charge Sustaining Tests conducted for the purpose of type-approval, conformity of production, in-service conformity and market surveillance, these Ki factors shall be applied for the vehicles listed in Annex I of this declaration.

Done at [….. Place ([^E0077])]

On [….. Date]

[ Name and signature of person authorised by the Manufacturer or Manufacturer’s Representative ([^E0078])]

Attachment(s)

Annex I: TheVehicle Type(s), Family(ies) or vehicles described by other vehicle descriptor(s) to which this declaration applies

ANNEX XXII

DEVICES FOR MONITORING ON BOARD THE VEHICLE, THE CONSUMPTION OF FUEL AND ELECTRIC ENERGY

1. INTRODUCTION

This Annex sets out the definitions and requirements applicable to the devices for monitoring on board the vehicle the consumption of fuel and/or electric energy.

2. GENERAL REQUIREMENTS

The general requirements for OBFCM devices shall be those set out in paragraph 6.3.9 of UN Regulation No 154.

3. TECHNICAL REQUIREMENTS

The technical requirements for the OBFCM device shall be those set out in Appendix 5 to UN Regulation No 154.

[^E0001]: Regulation No 85 of the Economic Commission for Europe of the United Nations (UN/ECE) – Uniform provisions concerning the approval of internal combustion engines or electric drive trains intended for the propulsion of motor vehicles of categories M and N with regard to the measurement of net power and the maximum 30 minutes power of electric drive trains (OJ L 323, 7.11.2014, p. 52, ELI: http://data.europa.eu/eli/reg/2014/85/oj).

[^E0002]: UN Regulation No 168 – Uniform provisions concerning the approval of light duty passenger and commercial vehicles with regards to real driving emissions (RDE) [2024/211] (OJ L, 2024/211, 12.1.2024, ELI: http://data.europa.eu/eli/reg/2024/211/oj).

[^E0003]: OJ L 77, 5.3.2021, p. 8, ELI: http://data.europa.eu/eli/reg_impl/2021/392/oj.

[^E0004]: Commission Implementing Regulation (EU) 2022/163 of 7 February 2022 laying down rules on the application of Regulation (EU) 2018/858 of the European Parliament and of the Council as regards functional requirements for market surveillance of vehicles, systems, components and separate technical units (OJ L 27, 8.2.2022, p. 1, ELI: http://data.europa.eu/eli/reg_impl/2022/163/oj).

[^E0005]: UN Regulation No 103 – Uniform provisions concerning the approval of replacement pollution control devices for power-driven vehicles (OJ L 207, 10.8.2017, p. 30, ELI: http://data.europa.eu/eli/reg/2007/103(2)/oj).

[^E0006]: Commission Implementing Regulation (EU) 2025/1707 of 25 July 2025 laying down rules for the application of Regulation (EU) 2024/1257 of the European Parliament and of the Council as regards specific methods, requirements and tests, including compliance thresholds, for OBFCM devices and OBM systems, characteristics and performance of driver warning systems and inducement methods and methods to assess their operation, EVP format and data and methods of communication of EVP data of motor vehicles of categories M1 and N1 (OJ L, 2025/1707, 22.8.2025, ELI: http://data.europa.eu/eli/reg_impl/2025/1707/oj).

[^E0007]: UN Regulation No 154 – Uniform provisions concerning the approval of light duty passenger and commercial vehicles with regards to criteria emissions, emissions of carbon dioxide and fuel consumption and/or the measurement of electric energy consumption and electric range (WLTP), 02 series of amendments (OJ L, 2022/2124, 10.11.2022, ELI: http://data.europa.eu/eli/reg/2022/2124/oj).

[^E0015]: UN Regulation No 83 – Uniform provisions concerning the approval of vehicles with regard to the emission of pollutants according to engine fuel requirements (OJ L, 2024/1312, 27.6.2024, ELI: http://data.europa.eu/eli/reg/2024/1312/oj).

[^E0016]: Regulation (EU) 2019/631 of the European Parliament and of the Council of 17 April 2019 setting CO2 emission performance standards for new passenger cars and for new light commercial vehicles (OJ L 111, 25.4.2019, p. 13, ELI: http://data.europa.eu/eli/reg/2019/631/oj).

[^E0028]: To be completed by Technical Services: delete what is not applicable and complete if necessary.

[^E0029]: See Annex III ‘ Declaration of Compliance’ of (EU) 2025/1707 – This insertion does not condition the granting of the Type Approval under this Regulation and is inserted by the granting Type-Approval Authority for traceability and document management purposes – The OBM Family Identifier should be the one provided in the First Declaration submitted by the Manufacturer under Annex III ‘ Declaration of Compliance’ of (EU) 2025/1707. Updates to the Declaration of Compliance should not lead to any modification of the OBM Family Identifier nor to an extension of the related Type Approvals.

[^E0030]: UN Regulation No 83 – Uniform provisions concerning the approval of vehicles with regard to the emission of pollutants according to engine fuel requirements (OJ L, 2024/1312, 27.6.2024, ELI: http://data.europa.eu/eli/reg/2024/1312/oj).

[^E0031]: Commission Implementing Regulation (EU) 2022/163 of 7 February 2022 laying down rules on the application of Regulation (EU) 2018/858 of the European Parliament and of the Council as regards functional requirements for market surveillance of vehicles, systems, components and separate technical units (OJ L 27, 8.2.2022, p. 1, ELI: http://data.europa.eu/eli/reg_impl/2022/163/oj).

[^E0032]: Directive 98/70/EC of the European Parliament and of the Council of 13 October 1998 relating to the quality of petrol and diesel fuels (OJ L 350, 28.12.1998, p. 58, ELI: http://data.europa.eu/eli/dir/1998/70/oj).’

[^E0033]: UN Regulation No 154 – Uniform provisions concerning the approval of light duty passenger and commercial vehicles with regards to criteria emissions, emissions of carbon dioxide and fuel consumption and/or the measurement of electric energy consumption and electric range (WLTP), 02 series of amendments (OJ L, 2022/2124, 10.11.2022, ELI: http://data.europa.eu/eli/reg/2022/2124/oj).’

[^E0035]: UN Regulation No 168 – Uniform provisions concerning the approval of light duty passenger and commercial vehicles with regards to real driving emissions (RDE) [2024/211] (OJ L, 2024/211, 12.1.2024, ELI: http://data.europa.eu/eli/reg/2024/211/oj).

[^E0036]: To be found in CIRCABC link: https://circabc.europa.eu/ui/group/f4243c55-615c-4b70- a4c8-1254b5eebf61/library/a0be83ba-89bd-4499-8189-2696362d2f72?p=1.

[^E0037]: Regulation (EU) 2024/1257, recital (26).

[^E0038]: As defined in Mutual Resolution No 2 (M.R.2) of the 1958 and 1998 Agreements of UNECE.

[^E0039]: Delete what is not applicable.

[^E0040]: Established in the Union.

[^E0041]: ‘Manufacturer's representative’ means any natural or legal person established in the Union who is duly appointed by the manufacturer to represent the manufacturer before the approval authority or the market surveillance authority and to act on the manufacturer's behalf in matters covered by the Regulation, as defined in Article 3(41) of Regulation (EU) 2018/858.

[^E0042]: Delete what is not applicable.

[^E0044]: Established in the Union.

[^E0045]: ‘Manufacturer’s representative’ means any natural or legal person established in the Union who is duly appointed by the manufacturer to represent the manufacturer before the approval authority or the market surveillance authority and to act on the manufacturer's behalf in matters covered by the Regulation, as defined in Article 3(41) of Regulation (EU) 2018/858.

[^E0046]: Commission Implementing Regulation (EU) 2021/535 of 31 March 2021 laying down rules for the application of Regulation (EU) 2019/2144 of the European Parliament and of the Council as regards uniform procedures and technical specifications for the type-approval of vehicles, and of systems, components and separate technical units intended for such vehicles, as regards their general construction characteristics and safety (OJ L 117, 6.4.2021, p. 1, ELI: http://data.europa.eu/eli/reg_impl/2021/535/oj).

[^E0047]: The manufacturer’s declaration of compliance with the OBD requirements in accordance with section 2.2 of this Annex shall replace the requirements for OBD demonstration tests and IUPR reporting requirements as set out in Appendix 1 to Annex C5 of UN Regulation No 154.

[^E0048]: Delete what is not applicable.

[^E0049]: Established in the Union.

[^E0050]: ‘Manufacturer's representative’ means any natural or legal person established in the Union who is duly appointed by the manufacturer to represent the manufacturer before the approval authority or the market surveillance authority and to act on the manufacturer’s behalf in matters covered by the Regulation, as defined in Article 3(41) of Regulation (EU) 2018/858.

[^E0051]: Delete where not applicable.

[^E0052]: Delete where not applicable.

[^E0053]: Delete where not applicable.

[^E0054]: Delete where not applicable.

[^E0055]: Delete where not applicable.

[^E0056]: Delete where not applicable.

[^E0057]: If the means of identification of type contains characters not relevant to describe the vehicle, component or separate technical unit types covered by this type-approval certificate such characters shall be represented in the document by the symbol:‘?’ (e.g. ABC??123??).

[^E0058]: Delete where not applicable.

[^E0059]: UN Regulation No 155 – Uniform provisions concerning the approval of vehicles with regards to cyber security and cyber security management system (OJ L, 2025/5, 10.1.2025, ELI: http://data.europa.eu/eli/reg/2025/5/oj).

Reading this document does not replace reading the official text published in the Official Journal of the European Union. We assume no responsibility for any inaccuracies arising from the conversion of the original to this format.

This text is published under EUR-Lex's own terms of reuse, not a Legalize or public-domain licence. EUR-Lex
Creative Commons Attribution 4.0 International (CC BY 4.0)
© European Union, https://eur-lex.europa.eu — Source: EUR-Lex (Publications Office of the European Union). Reused under the Creative Commons Attribution 4.0 International (CC BY 4.0) licence. Only EU legislation published in the printed Official Journal of the European Union is deemed authentic; consolidated texts are reproduced here for documentation purposes and have been reformatted to Markdown.