OTA upgrades are no longer something OEMs can push at will – they are now strictly regulated. China has GB 44495 and GB 44496 – internationally, UN R155 and UN R156 apply. R155 covers vehicle cybersecurity – R156 covers software updates. GB 44495 covers vehicle cybersecurity – GB 44496 covers software‑update management. This article explains the two standard systems' core OTA compliance requirements.
1.1 UN R156 – what it covers
UN R156 is a UN regulation covering vehicle software updates and SUMS (Software Update Management System). OEMs must establish SUMS – ensuring OTA upgrades are fully controlled – with pre‑upgrade risk assessments and complete activity records. R156's legal responsibility rests with the OEM – component suppliers provide supporting assessments. The regulation is mandatory in EU, Japan, and other contracting parties – new type approvals must satisfy it.
1.2 GB 44496 – what it covers
GB 44496-2024 General technical requirements for vehicle software update is China's mandatory national standard for software‑update management – effective 1 January 2027. OEMs must establish software‑update management systems – conducting safety assessments, version control, and rollback plans for OTA updates. GB 44496 is embedded in whole‑vehicle CCC review – no independent certificate – component suppliers work within the vehicle CCC framework.
1.3 GB 44495 and OTA
GB 44495-2024 Technical requirements for vehicle cybersecurity covers whole‑vehicle information security – OTA systems are a key control point. OTA transport channels are high‑risk attack surfaces – package tampering, communication hijacking, and malicious rollback are typical risks. The standard requires OTA systems to have authentication, package integrity verification, and anti‑rollback protection.
1.4 R155 and OTA
UN R155 covers whole‑vehicle cybersecurity – OTA systems are a key audit focus. When implementing R155, the TARA analysis must cover the full OTA chain: cloud servers, communication channels, vehicle‑side receivers, and ECU flashing. R155 focuses on OTA security capability – R156 focuses on OTA process management – they are complementary in OTA scenarios.
2. OTA Compliance – Technical Requirements
2.1 Pre‑upgrade assessment
Both R156 and GB 44496 require assessment before upgrade push – covering impact scope, security risks, rollback feasibility, and execution constraints (speed, battery, network). If assessment fails – the upgrade cannot be pushed. Assessment documents must be fully retained.
2.2 Integrity and authenticity
GB 44495 requires digital signatures for OTA packages – the vehicle verifies the signature before flashing. Under R155, TARA must also assess tampering risks. Recommended: RSA/ECDSA signatures – hash algorithm ≥SHA‑256. Upgrade packages must be transmitted over TLS encrypted channels – plain HTTP is prohibited.
2.3 Anti‑rollback
Anti‑rollback prevents attackers from downgrading ECU firmware to vulnerable old versions. The system records firmware version numbers – the vehicle refuses to install versions below the current valid version.
Clarification: the standard prevents malicious downgrade attacks – it does not prohibit authorised service‑centre downgrades for repair purposes.
2.4 Upgrade interruption handling
If power, network, or ECU faults occur during upgrade – the vehicle must remain safe and drivable. R156 requires that after upgrade failure, the vehicle does not lose basic driving capability – no "bricking." A/B partitioning is a mainstream implementation – but not the only mandatory approach – any recoverable design is acceptable.
3. SUMS – Software Update Management System
3.1 System requirements
R156 requires OEMs to establish SUMS – covering software identification, change control, configuration management, risk assessment, release approval, deployment monitoring, and rollback. GB 44496 requirements are aligned. SUMS is a management system – not something you can complete with a few test reports.
3.2 Audit bodies
CAV (China Automotive Technology and Research Center) is an industry co‑ordination platform – not a SUMS certification body. Qualified domestic vehicle testing institutions with UN R156 test capability can conduct SUMS audits. During CCC review, auditors check SUMS completeness and operational effectiveness – system gaps block CCC certification.
3.3 Software record retention
R156 and GB 44496 both require long‑term retention of software‑update records. R156 requires at least 10 years after the model is discontinued, while GB 44496 requires 10 years after the vehicle lifecycle ends. Archived records include version numbers, upgrade time, affected ECU lists, risk assessment reports, and upgrade execution results.
4. Type Approval and CoP
4.1 Type approval
During new‑model type approval, auditors check R156 and GB 44496 compliance. OEMs submit SUMS documents, OTA technical solutions, TARA reports, and test reports – upon approval, these are included in the type‑approval documentation.
4.2 Conformity of Production (CoP)
After certification, annual CCC CoP surveillance audits are required. Focus: OTA operational compliance – whether version management follows SUMS, upgrade records are complete, and change‑assessment processes are implemented. CoP failures risk certificate suspension.
Note: CoP is a China CCC term – not applicable to UN R155/R156 overseas surveillance.
4.3 Change management
Any OTA‑related software/hardware changes must be assessed. TCU hardware replacement, firmware iteration, rollback logic changes, supplier changes – all must be evaluated for potential retesting.
There is no statutory "minor‑change fast‑track exemption" – fast‑track is an internal process – any safety‑function changes require full review.
5. China vs. International – Differences
5.1 GB vs. R – mapping
GB 44495 maps to R155 (vehicle cybersecurity), while GB 44496 maps to R156 (software updates). Overall approaches are similar – but technical details differ – GB standards are adapted for China's road and network conditions – test scenarios and limits differ. Vehicles exported overseas must meet both.
5.2 No direct mutual recognition
GB 44495/44496 test reports and audit conclusions cannot be directly used for R155/R156 type approval – vehicles sold to Europe must separately complete R155/R156. Conversely, R‑regulation materials cannot substitute for GB – the two systems are independent.
5.3 Exemptions
L‑class motorcycles, special‑purpose vehicles, and non‑OTA models have partial exemptions. GB 44495/44496 apply to M‑class, N‑class, and O‑class trailers. Check applicable clauses – don't blanket‑apply everything.
6. Practical Recommendations
6.1 Build SUMS early
SUMS cannot be rushed before certification. Start building at the product‑definition stage – run the OTA process and accumulate operational records. At least 6 months of stable operation are needed for sufficient audit evidence.
6.2 TARA must cover the full OTA chain
When conducting R155 TARA, OTA is a key assessment target – cloud servers, communication links, vehicle‑side receivers, ECU flashing, anti‑rollback – each step must have threats and risks identified. TARA gaps will block both R155 and GB 44495 reviews.
6.3 Supplier co‑ordination
TCU, OTA module, and communication‑module suppliers are key parts of the OTA compliance chain. OEMs require suppliers to deliver complete security evidence packages – covering signature schemes, anti‑rollback implementation, and change‑management processes. Missing supplier evidence creates gaps in the SUMS evidence chain.
7. FAQs
7.1 Do component suppliers need standalone R156?
No. The legal obligation rests with the OEM – component suppliers work within the vehicle CCC framework. However, OEMs require TCU/OTA module suppliers to provide security evidence – complete materials speed up whole‑vehicle SUMS audits.
7.2 Are GB 44495 and GB 44496 two certificates?
No – they are not independent certificates. Both mandatory national standards are verified within the whole‑vehicle CCC certificate – no separate certificate is issued. The CCC certificate notes compliance with both – and they are included in annual CoP surveillance.
7.3 How do OEMs and suppliers co‑ordinate?
OEMs break down OTA compliance requirements to TCU and communication‑module suppliers – suppliers deliver evidence packages. OEMs consolidate all materials, build the SUMS system, and use them for type approval and CoP. Define deliverables and milestones early – reducing friction.
For OTA compliance, contact BlueAsia at 13534225140 (King) or email king.guo@cblueasia.com.
Related News
