Regulation (EU) No 165/2014 of the European Parliament and of the CouncilShow full title

Article 20 Security

1. Manufacturers shall design, test and review vehicle units, motion sensors and tachograph cards put into production so as to detect vulnerabilities arising in all phases of the product life-cycle, and shall prevent or mitigate their possible exploitation. The frequency of tests shall be laid down by the Member State which granted the approval certificate, within a limit which shall not exceed two years.

2. For this purpose, manufacturers shall submit the documentation necessary for vulnerability analysis to the certification body referred to in Article 12(3).

3. For the purposes of paragraph 1, the certification body referred in Article 12(3) shall conduct tests on vehicle units, motion sensors and tachograph cards to confirm that known vulnerabilities cannot be exploited by individuals in possession of publicly available knowledge.

4. If, in the course of the tests referred to in paragraph 1, vulnerabilities in system elements (vehicle units, motion sensors and tachograph cards) are detected, those elements shall not be put on the market. If vulnerabilities are detected in the course of the tests referred to in paragraph 3 for elements already on the market, the manufacturer or the certification body shall inform the competent authorities of the Member State which granted the type-approval. Those competent authorities shall take all measures necessary to ensure that the problem is addressed, in particular by the manufacturer, and shall inform the Commission without delay of the vulnerabilities detected and of the measures envisaged or taken, including where necessary the withdrawal of type-approval in accordance with Article 16(2).