HVIA members have expressed support for harmonising Australian Design Rules with the current United Nations Regulations on Cyber Security and Software Update, but have raised concerns about significant compliance costs.
The draft ADR 115 and ADR 116, provided by the Department of Infrastructure, Transport, Regional Development, Communication, Sport and the Arts earlier this month are based on the current UN155 and UN156 regulations on Cyber Security and Software Update, respectively.
As outlined in previous communications, members welcome the Department’s harmonisation approach, noting Australia is a contracting party to the UN1958 Agreement, however, since the first round of consultation, many members have begun investigating what compliance would involve — and are finding the implications may be more significant than first anticipated.
Given the absence of an Impact Analysis and a full understanding of how this legislation will affect industry, particularly truck and trailer manufacturers, members are not comfortable committing to a compliance timeframe until an assessment has been completed.
In light of this, the latest member submission calls for a pause and asks the Department to consider completing an Impact Analysis — formerly known as a Regulatory Impact Statement (RIS) — on both proposed ADRs, to ensure a clear understanding of the true cost impact and a reasonable implementation timeframe for these regulations locally.
Members are also seeking further clarification from the Department on ADR 116, specifically around how trailer manufacturers can manage risk with suppliers of electronic control units — particularly braking systems — given they don’t control the underlying architecture, diagnostics or software platforms. For example, if a Trailer Electronic Braking System (TEBS) provider goes out of business, how should a trailer builder manage the assets already in the field, and what are their legal obligations in that scenario?
It’s also not yet clear which subsystems will fall under ADR 116’s compliance requirements. Under the UN regulation, coverage typically extends to systems subject to Type Approval.
Members would like the Department to provide a direct impact list so they can assess whether they’re affected.
Systems where the impact remains unclear — as they may not currently fall under an ADR mandate — include tyre pressure monitoring, lighting and on-board mass systems, among others.
Given that these regulations concern cyber security and data, industry also believes the Impact Assessment should examine how sovereign capability may be affected, and whether strategic action is needed to preserve — or develop — local capability where critical gaps are identified.
Members wishing to understand the detail on any of the proposed changes to any of the listed ADRs are invited to contact HVIA Chief Engineer Rachel Michaud at r.michaud@hvia.asn.au, who will provide the draft ADRs for confidential review.