SDV SectorNews and signals from the software-defined vehicle sector. Global coverage, daily.

Japan and the Netherlands would require odometer mitigations whatever the risk rating

A proposal before the World Forum's general safety working party would have manufacturers analyze odometer tampering as a vulnerability rather than a risk, so mitigations are required even where the risk assessment rates it low.

The experts from Japan and the Kingdom of the Netherlands put a joint proposal for Supplement 3 to the 02 series of amendments to UN Regulation No. 39, which governs speedometers and odometers, before the World Forum’s Working Party on General Safety Provisions. The document was tabled under the working party’s 132nd session, which ran in Geneva from September 28 to October 2.

Odometer protection already runs through UN R155. Paragraph 5.12 of the 02 series, in force since September 26, 2025, deems the anti-tampering requirement met when the manufacturer’s management system encompassing cyber security complies with UN R155 and proportionate mitigations are implemented. The proposal does not move the subject into R155. It changes how the test is applied.

The justification sets out why. The task force that wrote paragraph 5.12 treated odometer tampering as a non-conformity, and so as a high risk in the R155 process. Japanese experts later found that the R155 risk assessment sometimes rates odometer tampering low, which would leave the mitigation unrequired. The proposal answers that by requiring threats and associated vulnerabilities to be analyzed rather than risks, so that mitigations follow regardless of the risk value.

Two drafting changes carry it. The words limiting condition (a) to the distance values are struck out and re-imposed as a new sentence stating that neither condition requires the management system to extend beyond protecting those values. And threat 20.4, data manipulation to falsify a vehicle’s driving data, is named alongside the mitigation the paragraph already cited.

The experts state that the proposal clarifies the requirements without increasing the level of stringency. Nothing has been agreed; the report recording what the working party decided had not been published.

Why it mattersOdometer fraud has sat inside the cybersecurity management system for a year, and this proposal is aimed at the one route by which a manufacturer could satisfy that and still skip the mitigation.

Source: UNECE, GRSG-132-14rev1

The SDV Sector Brief

The month in vehicle software — top stories, what our readers read most, and an editor's take. First Tuesday of the month, 08:30 CET. Double opt-in, unsubscribe anytime.