Attachment  
 
1 
  Outline of draft legislation for software updates for motor vehicles in use 
“Special permit of Modification” 
 
1. Outline of the Special permit of Modification  
(1) Scope 
An original equipment manufacturer (OEM) or an importer shall get a “Special permit of 
Modification” before distributing software updates which affect a Type* to vehicle of Categories 
M, N, [O, R, S and T]** in use. 
* Criteria of “affect a Type” is defined by each United Nations Regulation (UNR) under the1958 agreement. 
**  The Scope of the permit is align with the draft of UNR on SU. When the UNR is adopted, Japan will apply it and the scope 
above will be replaced by the UNR. 
 
(2) Requirements for the permit 
① Applicants for the permit shall get Conformity of Certificate of Cyber Security Management 
System (CSMS) and Software Update Management System (SUMS) as follows; 
<Requirements for CSMS***> 
 Applicants shall demonstrate that their CSMS considers the following phases: 
- Development phase; 
- Production phase; 
- Post-production phase. 
 Applicants shall demonstrate that the processes used within their CSMS ensure security 
is adequately considered. This shall include: 
- The processes used within the applicants’ organization to manage cyber security; 
- The processes used for the identification of risks to vehicle types; 
- The processes used for the assessment, categorization and treatment of the risks 
identified; 
- The processes in place to verify that the risks identified are appropriately managed; 
- The processes used for testing the security of the system throughout its development and 
production phases; 
- The processes used for ensuring that the risk assessment is kept current; 
- The processes used to monitor for, detect and respond to cyber-attacks, cyber threats 
and vulnerabilities on vehicle types and the processes used to assess whether the cyber 
security measures implemented are still effective in the light of new cyber threats and 
vulnerabilities that have been identified; 
<Requirements for SUMS***> 
 Processes to be verified at initial assessment 
- A process whereby the applicant is able to identify target vehicles for a software update; 
- A process to verify, before a software update is issued, the compatibility of possible 
software/hardware configurations for the registered configuration or last known 
configuration of the target vehicles with the software update; Attachment  
 
2 
 - A process to assess, identify and record whether a software update will affect any type 
approved systems; 
- A process whereby the vehicle user is able to be informed about updates; 
- A process whereby information relevant to this requirements is documented and securely 
held at the applicants; 
- The process they will use to ensure that software updates will be protected to reasonably 
prevent manipulation before the update process is initiated; 
- The processes and procedures applicants will use to assess that over the air updates 
will not impact safety if conducted during driving (additional requirement for software 
updates over the air). 
*** Requirements for CSMS and SUMS are align with the drafts of UNRs on CS and SU. When the UNRs are 
adopted, Japan will apply them and the requirements for CSMS and SUMS above will be replaced by the UNRs. 
② Applicants shall have responsibility and ability to recall vehicles that they distribute software 
updates. 
③ Vehicles of which software has been updated shall meet the technical requirements of the 
relevant UNRs. 
 
(3) Compliance rule for those who got the permit 
① They shall notify Minister of Ministry of Land, Infrastructure, Transport and Tourism of any 
prescribed changes of application forms and their attached documents. 
② They shall ensure CS and appropriate SU for vehicles in use according to their CSMS and 
SUMS. 
 
2. Schedule  
  Issue: July, 2020 
Enforcement: Around November, 2020 
Application date of (2) ① : New Vehicle Types after January. 2022**** 
Application date of (2) ② and ③ : All software updates after November, 2020 
Application date of (3) ① : All software updates after November, 2020 
Application date of (3) ② : New Vehicle Types after January. 2022**** 
**** This application date may be postponed depending on adoption timing of the UNRs on CS and SU in UNECE 
World Forum for Harmonization of Vehicle Regulations (WP.29).