Two-Wheeler and EV Cybersecurity Before UNECE R155's 2027 L-Category Deadline

Passenger-car manufacturers met UNECE R155 between 2022 and 2024. Two- and three-wheeler manufacturers are next. The EU’s extension of R155 to L-category vehicles gives the industry a fixed date — 11 December 2027 for new types — and a requirement that most L-category programmes have never had to meet: an audited Cybersecurity Management System and vehicle-type evidence that the platform was engineered and tested for cybersecurity. This post sets out what changes, why these platforms are different from cars, and a roadmap that works back from the date.

What Changes, and When

Commission Delegated Regulation (EU) 2025/1455 extends the R155 cybersecurity requirements to L-category vehicles — L1e through L7e, except L1e vehicles designed to pedal. The dates are fixed:

• 11 December 2027 — new L-category vehicle types must comply to receive EU type approval.
• 11 June 2029 — existing types must comply.

The obligations are the ones passenger-car OEMs already know. At the manufacturer level, a Cybersecurity Management System — governance, risk management, supplier management, monitoring and incident response — assessed and certified. At the vehicle-type level, a risk assessment that considers the R155 Annex 5 threat catalogue, mitigations chosen against it, evidence that the mitigations were tested, and evidence from suppliers whose components carry security functions. Our UNECE R155 compliance page covers the regulation in full; what follows is what is different for two- and three-wheelers.

Who It Reaches

European L-category OEMs are the obvious audience, but they are not the largest. Much of the EU’s two-wheeler supply is built in India and elsewhere in Asia, and every one of those exporters needs EU type approval — so every one of them is inside R155 from December 2027. In India, AIS 189 excludes most two- and three-wheelers from its domestic scope; that does not matter for exports. The requirement is set by the market the vehicle is sold in, not by the country it is built in.

Suppliers are reached too. R155 regulates the OEM, but the OEM cannot evidence a connected cluster, a telematics unit or a BMS it did not build. Cybersecurity Interface Agreements under ISO/SAE 21434 Clause 7 push the corresponding work — and the testing evidence — to the supplier.

Where Two-Wheeler and EV Platforms Differ from Cars

The regulation is the same; the platforms are not. Five differences shape the risk assessment and the test scope.

• Cost-constrained ECUs. Many L-category controllers were specified without a hardware security module or secure storage, so mitigations that are routine on a car — hardware-backed Secure Boot, protected keys — need deliberate design decisions, and sometimes a hardware change.
• App-first features. Ride statistics, navigation, find-my-vehicle, remote immobilisation and subscription features often live in the companion app and its cloud rather than in the vehicle. That puts the back end and the app squarely in the vehicle-type risk assessment.
• Keyless and app-based keys. BLE keys, phone-as-a-key and keyless start replace mechanical keys on premium models — a convenience feature with a theft-scenario attached.
• Connected clusters.TFT clusters with Bluetooth, navigation projection and over-the-air updates have become the de-facto gateway on many platforms, often without the domain separation a car’s gateway provides.
• Batteries and charging. Electric two-wheelers add BMS diagnostics, on-board or off-board charging and, in some markets, swappable packs that authenticate to the vehicle and to swap stations. Findings here carry thermal and electrical safety consequence.

A Roadmap That Works Back from the Date

The sequence matters more than the speed. The CSMS certificate is a precondition for vehicle-type approval and is the longest item; testing needs implemented mitigations to test; remediation and retest need time after testing. An example plan for a programme starting in Q4 2026 with a new type targeted at the December 2027 date:

Programmes with several types in the pipeline should certify the CSMS once and run the vehicle-type work per type, reusing component evidence where the same cluster, telematics unit or BMS is shared across models.

Where Testing Fits

R155 paragraph 7.3.6 requires the manufacturer to test that the implemented security measures are effective. For an L-category platform that testing runs at three levels, the same way it does for cars:

• Component level — the key system, the bootloader and update path of the cluster, the BMS diagnostic interface — early, while design changes are cheap.
• ECU level — the cluster, telematics unit and BMS on the bench with production-representative firmware.
• Vehicle level — the integrated platform, including the companion app and cloud, because on many two-wheelers that is where the most consequential functions live.

The output is the same evidence a car programme produces: a coverage table against the Annex 5 categories with argued non-applicability, findings mapped to the TARA, and retest evidence. The Annex 5 penetration-testing checklist sets out the coverage structure; a simpler platform simply has more categories argued as not applicable, with the argument written down.

Charging Equipment and the Cyber Resilience Act

R155 covers the vehicle type. Charging equipment, swap stations and aftermarket connected accessories sold outside type approval can fall under the EU Cyber Resilience Act, Regulation (EU) 2024/2847, with its own conformity and vulnerability-handling obligations. The interface between the two — the vehicle’s charging or battery-authentication function on one side, the station on the other — is where the risk concentrates, so programmes that ship both should plan the two evidence chains together. The regulations map shows how the instruments fit.

Mistakes to Avoid

• Starting with testing. Without a CSMS and a TARA, there is nothing for the test evidence to attach to.
• Leaving the app out of scope. On many two-wheelers the companion app and cloud carry the functions with the largest consequence.
• Assuming no connectivity means no work. A platform without wireless interfaces still needs a TARA and argued non-applicability; it is a smaller job, not no job.
• Discovering the hardware gap late. If a key controller has no secure storage, that is a design decision to take in 2026, not a finding to receive in 2027.
• Treating suppliers as out of scope. Issue the Interface Agreements early; supplier evidence is usually the last thing to arrive.

Take-Aways

The L-category deadline is fixed and close. Certify the CSMS first, run a TARA per type that takes the app, the key system, the cluster and the battery seriously, issue supplier agreements early, and schedule component, ECU and vehicle-level testing so remediation and retest finish before the submission. Indian and Asian exporters are inside the rule regardless of domestic scope. For how we deliver that testing, see automotive penetration testing in Germany and Europe and in India.

Agnile Technologies supports two- and three-wheeler and EV programmes with ISO/SAE 21434 engineering, CSMS evidence and security testing at component, ECU and vehicle level. This article is not homologation advice; confirm dates and applicability against the official texts.