Manufacturers shall design, test and review vehicle units, motion sensors and tachograph cards put into production so as to detect vulnerabilities arising in all phases of the product life-cycle, and shall prevent or mitigate their possible exploitation. The frequency of tests shall be at least every two years.

Manufacturers shall submit the documentation necessary for vulnerability analysis to the person who, under Article 12, is responsible for issuing security certificates.

If, in the course of the tests referred to in paragraph 1, vulnerabilities in system elements (vehicle units, motion sensors and tachograph cards) are detected, no security certificate is to be issued and, accordingly, no type-approval application is to be considered (see Article 12(3)). If vulnerabilities are detected in the course of the tests referred to in paragraph 1 for elements already on the market, the manufacturer shall inform the Secretary of State. The Secretary of State shall take all measures necessary to ensure that the problem is addressed, in particular by the manufacturer (including, where necessary, the withdrawal of type-approval).