OTA and Cyber Certification: Two Gates That Stop Cars

For importers of connected EVs the key 2026 issue is not screen size or chip power but whether the car holds complete cyber security and software update certificates, because one missing document means the car cannot be registered.

The rule picture is clear. UNECE R155 requires a cyber security management system and R156 requires a software update management system, and type approval only follows once both are certified.

Run the numbers. A batch of 30 connected SUVs held 60 days at port for missing certificates accrues storage at about 12 dollars per unit per day, roughly 21,600 dollars, and with an annualised capital cost of 8% plus customer default risk the loss can pass 50,000 dollars. If the model never gains approval, re-export at about 1,500 dollars per car means 45,000 dollars for 30 units. The same shipment either earns or bleeds depending on paperwork.

Two layers matter. First, the approval barrier keeps some low-price models out, so certified models hold stronger pricing power and sourcing strategy should follow the certificates.

Three steps to take. First, ask the maker for R155 and R156 certificate numbers and validity dates, then verify them in the official database rather than accepting a scan. Second, make certification a precondition in the contract, paying no deposit for uncertified models or agreeing a full refund if approval fails. Third, request the data processing statement and privacy policy in the local language and hand them to the customer at delivery. Clear the certificates before you talk stock levels and sailing dates.