CLCCR Group Discussion on Cybersecurity Challenges in Multistage Vehicle Manufacturing

Small CLCCR group discussing Cybersecurity UN R155/6 and Multistage vehicles

AGENDA 1)Welcome 2) Tour de table 3) Context 4) Issue 5) Objective of this Working Group 6) CLCCR recommendation Table with conversions Definitions 7) Next steps 2

Context : Context : Multistage vehicle manufacturing The regulations target full cybersecurity control of the vehicle for a vehicle manufacturer (even) in the scenario of the multistage commercial vehicle with a chain of manufacturers 1st, 2nd, 3rdstage, etc. producing a completed vehicle Two issues It is not possible for a single actor in the multistage chain to have full control or integral responsibility, back and forth in the chain 2ndstage manufacturers are integrating software and E/E components, being developed and produced by suppliers that themselves are not vehicle manufacturers and cannot be compliant 3

Context : Context : UN Regulations 155 & 156 The legislation is open in nature and concerns a new homologation subject 1. The technical services and approval authorities are accustomed to test and audit with closed regulation, struggle with the open nature and created closed ruling to match the modus operandi, compromising the pragmatic audit 2. The technical services and approval authorities assigned resources with cybersecurity specialism that have limited automotive bodybuilders experience. This leads to the cyber specialist misjudging the risks of bodybuilding and demanding disproportionate measures to be safe. 4

Issue Issue Taking into account this complexity: It is not possible to comply to the UN Regulations 155 and 156 for manufacturers of 2ndand following stages if they have to have there own R155 and or R156 homologation . 80% of the CLCCR members are small & medium enterprises (mom-and-pop businesses) and the effort and resources to comply could be larger than their annual turnover 5

Objective of this Working Group Objective of this Working Group to refine the interpretation of the R155/R156 framework, ensuring its application is limited to valid vehicle transformations, thereby reducing the potential workload, particularly for SME converters. To have One CLCCR vision , on which bases we can adapt the different proposals To have a group of people that can respresent CLCCR on this topic 6

Inclusion of Multistage Manufacturing and Risk-Based Scoping Proposition Proposition Timing: To apply R155 & R156 for Multi-Stage Manufacturers as of January 20, 2027. Reason: R155 & R156 are set to apply to all M & N, vehicles starting from July 20, 2024 & R156 is set to apply to O vehicles for new types as of July 2026 . However, ongoing discussions regarding their application have created uncertainty and confusion. Accessories such as cranes and tail lifts will need to comply with EU 2023/1230 (the Machine Regulation) effective from January 20, 2027. Aligning the application dates for accessories and conversions will prevent further disputes over regulatory interpretation. Overview of Common Conversions: An appendix should be added to the regulation providing an overview of the most common conversions. This overview should detail: The various types of conversions. Whether they have electrical and/or electronic connections to the base vehicle. Whether there is an extra ECU present on the conversion itself that has any connection to the outside world. If there is a "Safe Mode" that mitigates any potential risks in case of hacking attempts affecting the safety of both the vehicle (including its conversion) and its surroundings. If a TARA (Threat Analysis and Risk Assessment) and CSMS (Cyber Security Management System) are necessary for that conversion. A "Safe Mode" refers to any equipment on the conversions capable of cutting off the power supply (such as a main switch, Power Take Off (PTO), or an electronic connection through the Bodybuilder Module) under any circumstances (e.g., while driving or if any danger is detected). 7

Proposition Proposition Definition of the A , B and C Type A Type: Changes which are not cyber relevant and do not relate to the E/E Architecture of the Stage-1 OEM (e.g., by adding pure hardware or devices which are not connected to the E/E Architecture of the Stage-1 OEM). The Original R155 Homologation remains valid. B Type: Changes that are cyber relevant or related to the E/E Architecture with Read & Write access . The Write access is only permitted for those signals, and within the scope , specified in the Bodybuilder Instructions of the Base Vehicle. If the conversion is mentioned in the Appendix added for Multi Stage Conversions, it will define whether a risk assessment by the Stage-2-OEM is necessary, thereby determining if the Original R155 Homologation remains valid. If not mentioned in the Appendix added for Multi Stage Conversions, the Stage-2-OEM must provide a justification based on a risk assessment explaining why the changes are not relevant, ensuring that the Original R155 Homologation remains valid. C Type: Changes that are cyber relevant. A new R155 homologation is necessary. 8

Proposition Proposition Please Note: In the appendix, the following are mentioned: Conversions Accessories Usage of the vehicle If any of these three (if applicable) demand a new R155 homologation, then this applies. The appendix only covers electrical connections through the R155 secured Body Builder Module of the Stage 1 Vehicle. If this is not the case , a TARA (Threat Analysis and Risk Assessment) and CSMS (Cyber Security Management System) must be applied, and the appendix is not applicable. 9

Definitions Definitions Axle conversions: Modifying a vehicle to change its axle configuration, such as from single to dual axles or vice versa. Cab adaptations (cutting roof): Altering the cab of a vehicle by modifying its roof, typically for increased headroom or specific functionality. Transformation of Driveline (to EV, FCEV, H2EV): Converting a vehicle's driveline to electric (EV), fuel cell electric (FCEV), or hydrogen electric (H2EV) propulsion systems. Rail / Road adaption: Modifying a vehicle to operate both on rail tracks and regular roads. Conversion Rigid => Tractor unit for semi-trailer: Transforming a rigid truck into a tractor unit capable of hauling semi-trailers. Driving school: Vehicles modified or equipped for use in driving instruction and training. Hydraulic Tipper: A vehicle fitted with a hydraulic mechanism that allows the cargo bed to be tilted for easy unloading of materials like sand, gravel, etc. Hydraulic Hook Lift / Demountable Container system (chain): A system where containers can be loaded and unloaded from vehicles using hydraulic hooks or chains. Recovery Vehicle: Vehicles equipped with equipment to tow or transport disabled, immobile, or damaged vehicles from one location to another. Conversion for Disabled people: Adapting vehicles with features like ramps, lifts, hand controls, etc., making them accessible and drivable by individuals with disabilities. Animal Transport: Vehicles designed specifically for safely transporting animals while ensuring their comfort and safety during transit. Camper Conversion: Transforming standard vehicles into recreational vehicles (RVs) equipped with living quarters suitable for camping. Flatbed: A vehicle with a flat, open cargo area without sides or a roof, used for transporting large or heavy items that do not need protection from the elements. Pick-Up: A light-duty truck with an enclosed cab and an open cargo area with low sides and tailgate. Drop-side: A type of truck body where the sides can be folded down to facilitate easier loading and unloading of goods. Box Body: An enclosed cargo area with rigid walls, used for transporting goods that need to be protected from the weather. Conditioned body with insulated walls and equipment to maintain interior temperature: A vehicle equipped with insulation and temperature control systems to transport perishable goods that require specific temperature conditions. Conditioned body without temperature-maintaining equipment: An insulated vehicle body without active temperature control systems, used for transporting goods that benefit from passive insulation. Concrete mixer: A vehicle equipped with a rotating drum used to mix and transport concrete to construction sites. 10

Definitions Definitions Concrete pump vehicle: A vehicle fitted with a pump system designed to transfer liquid concrete from a mixer truck to the desired location on a construction site. Timber Transport: Vehicles specifically designed for carrying logs or timber, often featuring reinforced frames and securing mechanisms for safe transport of heavy loads. Refuse collection vehicle: A truck designed for collecting and transporting household or commercial waste to disposal facilities, typically equipped with compacting mechanisms. Street sweeper: A vehicle fitted with brushes and vacuum systems to clean streets by sweeping up debris into an onboard storage container. Mobile Crane: A crane mounted on a mobile platform (vehicle) capable of lifting and moving heavy materials at different locations within a worksite. Aerial work platform (AWP): Also known as a cherry picker or boom lift, this is a mechanical device used to provide temporary access for people or equipment to inaccessible areas at height. Digger derrick: A specialized piece of heavy machinery equipped with an auger for drilling holes in the ground, often used in utility installation projects such as poles for power lines. Glazing transporter: Vehicles adapted for safely transporting glass sheets or windows, usually featuring padded racks or other protective mechanisms to prevent damage during transit. Boat carrier: Vehicles modified or specially built to transport boats over land, typically featuring secure cradles or supports tailored to different boat sizes/shapes. Glider carrier: Specialized vehicles designed for transporting gliders (non-motorized aircraft), ensuring safe handling/loading/unloading processes while protecting delicate structures during transit. Retail/Display Purposes: Vehicles modified to serve as mobile retail stores or display units at events, exhibitions, and fairs. These modifications often include shelving, lighting, and other features that facilitate the display and sale of products. Ladder Vehicle: Vehicles equipped with extendable ladders commonly used by fire departments and emergency services to enable firefighters and workers to access high places quickly and safely. Curtain-sided/Drop Side Tarpaulin: Vehicles featuring a flexible side covering (curtain) or drop sides that can be easily opened for loading and unloading. They provide easy access to the cargo area while protecting the load from weather conditions. Vehicle Transporter: Specialized vehicles designed for efficiently transporting multiple cars simultaneously. They typically feature multi-level platforms to maximize space utilization. Container Carrier: Vehicles designed to transport standardized shipping containers securely. These carriers have robust support systems to handle the weight and dimensions of containers effectively. Swap Body: A system involving interchangeable cargo units that can be swapped between different vehicles without unloading the contents, facilitating flexible logistics operations. Tank: Vehicles fitted with tanks for transporting liquids or gases, including those intended for carrying dangerous goods under regulated conditions. 11

Definitions Definitions M1=>N1 Conversion: The process of converting a passenger car (M1 category) into a light commercial vehicle (N1 category). This involves altering technical parameters such as weight and load capacity to comply with commercial regulations. Hearse: Modified vehicles specifically designed for carrying deceased bodies in caskets to funeral homes, mortuaries, cemeteries, or burial grounds. Crane : Vehicles equipped with cranes to facilitate the loading and unloading of heavy equipment or materials efficiently on-site. Taillift : is an electric-powered mechanical device installed on the rear of trucks, vans, or other delivery vehicles. Its main function is to assist in the loading and unloading of heavy or bulky items from the ground level to the vehicle s cargo area. Compressor: is a specialized air compressor installed on or in a vehicle to provide compressed air for various applications while on the move. Vehicle-mounted compressors draw power from the vehicle's engine or an auxiliary battery and are designed for portability and ease of use in remote locations. . . 12

Next Steps Next Steps - Is this the right approach ? If not what approach would be better ? - If so need to correct , adapt , add conversions to the table - Can we make the proposal more official ? - Share content via Teams group ? - Next meeting Friday 28 th of February ? . 13

Founded in 1961, CLCCR is the International Association of the Body and trailer building industry. CLCCR advocates the various interests of trailer manufacturers and body builders and Non-captive OEM Bus & Coach builders. It functions as an international forum, through which its members discuss issues of common interest and develop mutual positions, It offers a liaison between its members and the different international und European organizations, It represents approved CLCCR positions to different international and European organizations, It provides information services to its members and interested parties. Legal adress: BluePoint Brussels Bd A. Reyers Ln 80 B-1030 Brussel / Bruxelles http://clccr.vda.de/ http://clccr.vda.de/ 14

CLCCR: represents and advocates the interests of multistage manufacturers (i.e. bodywork builders), trailer manufacturers and non-captive OEM bus & coach builders. CLCCR members include the national associations from 14 countries: Austria Belgium Finland France Germany Italy Netherlands Norway Poland Portugal Spain Sweden Turkey United Kingdom