1.   

Scope

1.1.   

This Appendix contains the conditions for access that the manufacturer shall only be allowed to set out and procedures that the vehicle manufacturer shall apply or shall only be allowed to require other parties to apply, while implementing the security measures for access to OBD information referred to in points 2.9.(a) and (b) of this Annex.

1.2.   

Any reference in this Appendix to independent operators or to manufacturer’s authorised partners, dealers and repairers, as well as to a vehicle manufacturer acting for repair and maintenance purposes in this Appendix shall include any person or operator acting on their behalf, such as a service provider performing remotely, as a service provided to the independent operator, the programming, fitting or activating of parts and equipment on a vehicle (remote service suppliers).

2.   

Obligations of the manufacturer

2.1.   

The vehicle manufacturer shall be responsible for ensuring that all technical prerequisites for the application of the procedures referred to in this Appendix are in place, including access credentials such as certificates or software tokens and necessary arrangements with diagnostic tool manufacturers.

2.2.   

The vehicle manufacturer shall demonstrate to the approval authority that the vehicle is designed to enable access to OBD information, in compliance with the requirements of this Appendix, using multi-brand diagnostic tools.

2.3.   

The vehicle manufacturer shall provide to the manufacturers of diagnostic tools the information referred to in point 11 of this Appendix.

2.4.   

Vehicle manufacturer shall ensure that any server used for the purpose of enabling access under point 2.9 of this Annex is accessible without interruption, except for exceptional and unforeseeable circumstances outside the vehicle manufacturer’s control and not attributable to negligence on its part, or as required for maintenance purposes of the information system. In case of maintenance, the period of unavailability shall not exceed the period of maintenance of any other server used by the manufacturer to enable access for the purposes referred to in point 2.9 of this Annex. The information of the planned maintenance shall be made available to the manufacturers of diagnostic tools sufficiently in advance.

The vehicle manufacturer shall make yearly server availability statistics information available to the approval authority upon request. Cases of server unavailability shall be promptly reported by the vehicle manufacturer to the OBD Forum defined in point 12.

2.5.   

The vehicle manufacturer shall not restrict access to OBD information beyond the restrictions laid down in this Appendix unless specifically provided otherwise in this Regulation. Furthermore, the vehicle manufacturer shall not restrict access by independent operators to OBD information beyond the restrictions applicable to its authorised partners, dealers and repairers or to the vehicle manufacturer accessing the OBD information for repair and maintenance purposes.

2.6.   

The Vehicle manufacturer shall ensure that the cybersecurity measures they implement, including the compatibility requirements referred to in point 6.2, do not result in restricting or obstructing access to OBD information under this Appendix beyond what is necessary and proportionate to comply with Article 4.5(d) and Annex II line D4 of Regulation (EU) 2019/2144. Such measures may address future risks and threats where the vehicle manufacturer can demonstrate their impact and probability.

2.7.   

Any measures implemented by vehicle manufacturer to prevent emissions tampering and the odometer fraud shall not restrict or obstruct access to the OBD information beyond what is necessary and proportionate to comply with Articles 4(7) and 4(8) of Regulation (EU) 2024/1257 of the European Parliament and of the Council (*4).

3.   

Authentication

3.1.   

3.2.   

Whenever access to OBD information involves changes to the vehicle, the vehicle manufacturer may, as a condition for issuing the access credentials, require authentication of the operator. In the case of devices used for monitoring purposes, where data is only read and autonomously reported to the diagnostic tool manufacturers server without any human interaction, the vehicle manufacturer shall not require authentication of the operator.

3.3.   

Where access to OBD information involves a change of the vehicle software or its configuration/its parameters consisting in reprogramming of the vehicle software code, resulting in alteration of the intended behaviour of the vehicle and persisting beyond the repair and maintenance operation, so that it can only be reversed or overwritten by the performance of an equivalent operation, the vehicle manufacturer may require authentication of the employee of the operator who is seeking to access OBD information, unless the manufacturer of the diagnostic tool attests to the vehicle manufacturer that, based on the result of an independent audit performed no earlier than 3 years before the request, the operator has a system in place allowing for unambiguous identification of the employee seeking such access.

3.4.   

Cases of access referred to in point 3.2 shall include such repair and maintenance operations as activation of actuators and functional test routines, clearing of diagnostic trouble codes, resetting of service lights, resetting of adaptive learning parameters, and replacement of parts including initialisation of non-smart component and reading data by identifier, except where it is used for the purposes of Periodic Technical Inspection with values comparable to the values defined in ISO20730-3, Annex B, provided that these values are available in the vehicle.

3.5.   

Cases of access referred to in point 3.2 shall include calibration, understood as a process of adjusting or aligning vehicle software and hardware parameters as prescribed by the vehicle manufacturer and without variant coding or modifying the vehicle software.

3.6.   

3.7.   

In cases referred to in point 3.6, points (b) and (c), the identity of the operator and, where relevant, the employee of the operator and their compliance with the authorization requirements referred to in points 8.1 and 8.2 shall be verified by the manufacturer of the diagnostic tool used to access the OBD information or established based on an authorization certificate referred to in point 9.2.

3.8.   

No fees shall be required by the vehicle manufacturer for enabling access under point 2.9 of Annex X. However, vehicle manufacturer may charge justified and proportionate fees for the use of the remote facility referred to in point 2.9, point (c).

4.   

Connection requirements

4.1.   

Except for cases of access referred to point 3.1, points (a) to (c), the vehicle manufacturer may require one-time online connection from the diagnostic tool through diagnostic tool manufacturer’s server to vehicle manufacturer’s server to receive credentials. After the provision of access credentials, access shall not require online connection.

4.2.   

Whenever access to OBD information involves a change of the vehicle software or its configuration or its parameters resulting in alteration of the intended behaviour of the vehicle that persists beyond the repair and maintenance operation and that can only be reversed or overwritten by the performance of an equivalent operation, the vehicle manufacturer may require a continuous online connection at the time of performing the repair from the diagnostic tool to diagnostic tool manufacturer’s server as well as from the diagnostic tool manufacturer to the vehicle manufacturer server.

4.3.   

4.4.   

Cases of access referred to in in point 4.2 shall not include repair and maintenance operations enumerated in points 3.4 and 3.5.

4.5.   

However, by way of derogation from the point 4.4., cases of access referred to in point 4.2 include repair and maintenance operations referred to in point 3.5 where it is necessary to validate calibration values which are subject to regulatory requirements or where calibration cannot be completed without individual component or separate technical unit specific data necessary to complete the repair process and retrieved from the manufacturer’s server as part of a variant coding process.

5.   

Traceability requirements

5.1.   

Except for cases of access referred to in points (a) to (c) of point 3.1, the vehicle manufacturer may require the diagnostic tool manufacturer to collect and store the vehicle VIN and the unique diagnostic tool identifier.

5.2.   

Whenever access to OBD information involves changes to the vehicle, the vehicle manufacturer may require the diagnostic tool manufacturer to collect and store information on all executed diagnostic jobs (e.g. service-ID and sub-function) and used parameters/attributes UTC date and time stamps for each interaction with the vehicle.

5.3.   

Cases of access referred to in point 5.2 shall include such repair and maintenance operations as those referred to in points 3.4, 3.5, 4.3 and 4.5.

5.4.   

Whenever access to OBD information involves a change of the vehicle software or its configuration/its parameters consisting in reprogramming of the vehicle software code, resulting in alteration of the intended behaviour of the vehicle and persisting beyond the repair and maintenance operation, so that it can only be reversed or overwritten by the performance of an equivalent operation, the vehicle manufacturer may require the diagnostic tool manufacturer to collect and provide the results of the vehicle network topology inspection, initial vehicle state upon connection, including hardware/software versions of all electronic control units installed in the vehicle, results of all module interaction and routines run (e.g. return parameters) and results of the post-repair final vehicle health check readout.

5.5.   

Cases of access referred to in point 5.4 shall include such repair and maintenance operations as pairing an original replacement part (including software and hardware compatible (as defined by the vehicle manufacturer) remanufactured or re-used part) or a vehicle manufacturer authorized replacement part to a vehicle by using an independent diagnostic tool and reprogramming a module by using original equipment vehicle software and original equipment programming software in accordance with the vehicle manufacturer’s instructions. It shall also include cases of decoupling or deregistering a part from a vehicle.

5.6.   

Cases of access referred to in in point 5.4 shall not include repair and maintenance operations enumerated in points 3.4, 3.5, 4.3 and 4.5.

6.   

Cybersecurity requirements applicable to diagnostic tool

6.1.   

Except for cases of access referred to in points (a) to (c) of point 3.1, the vehicle manufacturer may require that the diagnostic tool used to access the OBD information comply with the relevant requirements of Regulation (EU) 2024/2847 of the European Parliament and of the Council (*7) and that the diagnostic tool manufacturer comply with either Trusted Information Security Assessment Exchange (TISAX), to the level specified by the vehicle manufacturer in compliance with point 2.5, or ISO 27001.

6.2.   

Whenever access to OBD information involves changes to the vehicle referred to in point 3.2, the vehicle manufacturer may require that the diagnostic tool used to access the OBD information and the diagnostic tool manufacturer comply with the requirements of the vehicle manufacturer’s security implementation.

6.3.   

The requirements of the vehicle manufacturer’s security implementation shall not exceed the requirements imposed on vehicle manufacturer’s own diagnostic tool, tool suppliers and own organisation and shall be applied on a non-discriminatory basis.

6.4.   

The vehicle manufacturer may require the diagnostic tool manufacturer to perform tests to verify the compliance of the diagnostic tool with the specified requirements. A Service Level Agreement shall ensure that any verification of the results of these tests performed by the vehicle manufacturer is done in a timely manner. In case a diagnostic tool manufacturer’s compliance with the requirements of this section is not confirmed, a clear statement of the reasons for non-compliance shall be provided by the vehicle manufacturer, together with the required measures to be implemented by the diagnostic tool manufacturer.

6.5.   

Cases of access referred to in point 6.2 shall include such repair and maintenance operations as those referred to in points 3.4 and 3.5.

6.6.   

Whenever access to OBD information involves change of the vehicle software or its configuration/its parameters resulting in alteration of the intended behaviour of the vehicle persisting beyond the repair and maintenance operation, so that it can only be reversed or overwritten by the performance of an equivalent operation, the vehicle manufacturer may require that the diagnostic tool used to access the OBD information and the diagnostic tool manufacturer comply with the relevant requirements of the vehicle manufacturer’s Software Updates Management System (as defined in UN Regulation No 156 (*8) implementation. Those requirements shall not exceed the requirements imposed on the vehicle manufacturer’s own diagnostic tool, tool suppliers and own organisation and shall be applied on a non-discriminatory basis.

6.7.   

Cases of access referred to in point 6.6 shall include such repair and maintenance operations as those referred to in points 4.3, 4.5 and 5.5 and shall not include those referred to in points 3.4 and 3.5.

7.   

Access credentials

7.1.   

Where all the conditions referred to in sections 3, 4 and 6 are complied with, the vehicle manufacturer shall, without delay, provide the diagnostic tool manufacturer with access credentials sufficient to enable the access to the required OBD information.

7.2.   

Access credentials may be VIN-specific.

7.3.   

Access credentials shall be valid for at least 30 days from the time of provision.

7.4.   

However, whenever access to OBD information involves a change to the vehicle, the vehicle manufacturer may limit the validity of access credentials to 24 hours.

7.5.   

Cases of access referred to in point 7.4 shall include such repair and maintenance operations as those referred to in points 3.4, 3.5, 4.3, 4.5 and 5.5.

8.   

Authorisation criteria and authorization certificates

8.1.   

No other conditions for issuing access credentials shall be imposed by the vehicle manufacturer than those specified in points(a) and (b).

8.2.   

In cases referred to in point 5.4, where the vehicle manufacturer requires the authentication of the employee of the operator and unless the manufacturer of the diagnostic tool attests to the vehicle manufacturer, in compliance with the conditions set out in point 3.3, that the operator has a system in place allowing for unambiguous identification of the employee seeking such access, the vehicle manufacturer may refuse to issue access credentials if the manufacturer of the diagnostic tool used to access the OBD information does not attest, in addition to the conditions referred to in point 8.1, that the employee seeking access to OBD information holds an employment agreement with the operator seeking access to OBD information and that the employee concerned has a valid country specific identity card or an equivalent document.

8.3.   

To be eligible for the authentication procedure under this Appendix, the diagnostic tool manufacturer shall have committed in the general conditions of contracts with operators to accept on request by the independent operator, for the purpose of attesting the compliance with the requirements referred to in points 8.1 and 8.2, a certificate referred to in point 9.2 of this Appendix and issued not earlier than 60 months before the request for access. However, where the operator does not request to be authenticated based on such a certificate, the diagnostic tool manufacturer may, for the purpose of authentication, choose to verify the identity of the operator or the operator’s employee and the compliance with the authorization criteria by its own processes.

9.   

Conformity Assessment Body and Trust Centre

9.1.   

Certificates referred to in points 3.7 and 8.3 shall be issued by a Trust Centre referred to in point 2.1.6 of Appendix 3 based on the findings of a conformity assessment body as referred to in point 4.2.2 of Appendix 3 with regard to the circumstances referred to in point 9.2.

9.2.   

9.3.   

10.   

Vehicle manufacturer’s access to information concerning the operator

10.1.   

In cases referred to in points (b) and (c), this information shall include, where applicable, the information regarding the operator and/or its employees. In cases where the manufacturer of the diagnostic tool relied for the authentication on a certificate provided by the Trust Centre, the relevant CAB shall provide the required information based on its assessment of a documented request by the vehicle manufacturer.

The vehicle manufacturer shall ensure that the information regarding an individual repair or maintenance operation accessed for the purposes referred to in points (a) to (c) shall not be used for any other purpose.

10.2.   

In cases referred to in point 10.1, the manufacturer of the diagnostic tool shall inform, without delay, the independent operator and, where relevant, the employee of the independent operator, about the access to the information regarding an individual repair or maintenance operation or to the information concerning the operator and/or its employees.

10.3.   

In cases referred to in points (a) and (c) of point 10.1 and where this is necessary and proportionate to prevent further misuse or address cybersecurity risk, the vehicle manufacturer may temporarily suspend or restrict access of the diagnostic tool concerned or request the involved manufacturer of the diagnostic tool to take immediate measures to temporarily restrict the access of the concerned operator, diagnostic tool, or employee to the OBD information concerning the vehicles of this manufacturer.

10.4.   

In exceptional cases, in response to a significant present or imminent cybersecurity incident a Vehicle Manufacturer may suspend access to the OBD information, at the most granular level possible, where it is necessary and proportionate to respond to the incident concerned.

10.5.   

The Approval Authority shall, within 10 days from the day of the notification, review the grounds for suspension and, if the suspension is manifestly unjustified or disproportionate, request the vehicle manufacturer or the involved manufacturer of the diagnostic tool to restore access.

The Approval Authority may, at any time, request the vehicle manufacturer and the involved manufacturer of the diagnostic tool to restore access where it considers that the grounds for suspension ceased to exist.

11.   

Information to be provided to diagnostic tool manufacturers

11.1.   

11.2.   

11.3.   

11.4.   

11.5.   

The information referred to in points 11.1 to 11.3 shall be provided together with the application for a type approval.

12.   

OBD Forum

12.1.   

12.2.   

12.3.   

The members of the OBD-Forum shall be represented by vehicle manufacturers and independent operators engaged in the implementation and use of procedures and processes described in paragraph 12.1.

12.4.   

The OBD Forum shall operate under the common legal and organizational structure as the ‘Forum for Access to Security-Related Vehicle RMI. referred to in paragraph 2.1.12 of Appendix 3.