![Logo des Berliner Stadtmagazins [030]](https://berlin030.de/en/wp-content/uploads/2026/11/cropped-030_Logo_kurz_neu_gruen.png){kind=logo}
Why vehicle software is now more strictly regulated than in the past
Modern vehicles are no longer purely mechanical machines. Software controls braking systems, lane-keeping assistants and communication modules – and can be changed at any time via an over-the-air update (OTA) without the vehicle having to visit a workshop. This very characteristic has forced regulatory authorities and lawmakers worldwide to fundamentally rethink their requirements.
In the past, a vehicle was largely technically prescribed after type approval. Today, a manufacturer can change safety-relevant functions of all vehicles in operation within a few hours. This new paradigm significantly shifts responsibility – and thus also the regulatory framework.
Networking makes software a security factor
The networked vehicle is a cyber-physical system: It communicates permanently with backend services, mobile networks and other digital infrastructures. This means that software is no longer only considered as a means of assistance, but as a primary means of security. If a software component fails or is compromised, direct consequences can arise for road safety.
The fact that OTA updates can change security-relevant systems such as emergency braking systems or driver assistance functions without a technician checking the intervention is particularly critical. Classical safety standards such as ISO 26262 assume deterministic systems whose functionality remains unchanged after development. OTA-capable vehicles break this basic principle and thus force new certification and monitoring methods.
How type approval and OTA updates collide
The type approval has so far been a one-time testing process – hardware and software were evaluated together, the result was binding. OTA updates fundamentally question this model, because subsequent software changes can actually change the approved state of a vehicle. Authorities now have to decide which updates are subject to approval and which are not.
Similar categorization questions arise in many digital sectors. Financial supervisory authorities distinguish between regulated and unregulated investment forms. Telecommunications regulation distinguishes between licensed and unlicensed frequency bands. In the iGaming sector, overviews such as Top casinos without license — with clear differentiation according to license status and available game options — enabling consumers and professionals to quickly classify them according to different regulatory levels.
According to the KBA overview on cyber security and software update requirements In the future, manufacturers will no longer have to ensure and document the regulatory status of the delivery condition, but also the entire software life cycle of their vehicles – including annual reports on the effectiveness of the required management systems.
Regulatory gaps and international differences
Despite harmonized UN regulations, there are significant international differences in implementation. In Europe, the EU Type Approval Regulation (EU 2018/858) is considered a binding framework that is continuously adapted to software-based vehicle architectures. Other markets, such as the USA or parts of Asia, rely on their own standards, which pose complex compliance challenges for globally operating manufacturers.
This pressure becomes particularly clear when looking at new mandatory functions: From January 1, 2026, the installation of the “Next Generation eCall” will be mandatory for all newly developed vehicle types of classes M1 and N1, and from 2027, new cars without this software-based emergency call system will no longer be allowed to be registered, as Car, motor and sport Reports. At the same time, the EU General Safety Regulation prescribes emergency braking systems with pedestrian recognition, distraction warning systems and event data recorders for new cars – all functions with a high software component.
What workshops need to consider when updating software
For workshops, the development towards a software-defined vehicle means a profound change in everyday professional life. Classical mechanical repair expertise is no longer sufficient; workshops today need access to vehicle data, diagnostic interfaces and software update systems in order to remain operational at all. Those who do not have this access simply cannot carry out certain diagnoses and repairs anymore.
Regulatoryly, a field of tension arises: Independent workshops should have fair access to diagnostic data, while at the same time security and data protection requirements must not be violated. the BSI document on cybersecurity in road traffic Clearly indicates that any software-related intervention on the vehicle must be documented in a complete and understandable manner for authorities in the future. Workshops that carry out software updates therefore bear not only technical but also liability responsibility – a reality that the industry now has to prepare for.