IRU calls for clarity on the cost of tachograph security updates in the EU

A harmonised EU-wide approach to mandatory security updates for tachographs is needed, with legal certainty, equal treatment of operators, and consistent implementation across the bloc.

The tachograph and its security architecture are a cornerstone of the EU road transport enforcement framework. Their reliability, integrity and security are essential for the effective enforcement of social and other relevant transport rules, as well as for maintaining trust among all stakeholders involved in the system.

This trust is particularly important given that the European tachograph market is effectively supplied by only two manufacturers: Stoneridge Electronics and Continental (Aumovio). In such a market structure, legal certainty, consistency of treatment and confidence in the functioning of the type-approval framework are critical for transport operators, enforcement authorities and manufacturers alike.

The latest generation of the smart tachograph (G2V2) represents a significant technological advancement and provides operators with a more modern and user-friendly tool. Following its deployment, however, certain security vulnerabilities were identified in type-approved equipment.

IRU welcomes the efforts made by manufacturers to address technical- and security-related issues. At the same time, the different approaches adopted to remedy these security vulnerabilities have created uncertainty among transport operators and other stakeholders. While Stoneridge Electronics decided to bear the costs associated with the required security updates, Continental (Aumovio) introduced a system under which operators ultimately bear those costs through the purchase of security update vouchers.

IRU EU Advocacy Director Raluca Marian said, "As a matter of principle, IRU believes that road transport operators, as end users of equipment that has already been type-approved and placed on the market, should not be required to bear the costs of mandatory security updates addressing vulnerabilities identified after type approval."

"Operators already make significant investments to equip their vehicles with mandatory technologies and need cost certainty to plan their businesses effectively," she added.

This principle is consistent with the approach applied in other sectors. For example, where cybersecurity risks are identified in smart mobile devices, corrective actions are normally carried out at the manufacturer's expense. The same logic should apply to tachographs. End users should not be expected to bear the financial consequences of vulnerabilities identified in type-approved equipment.

The differing approaches taken by the two tachograph manufacturers also demonstrate that passing such costs on to operators is not an inherent consequence of addressing security vulnerabilities. The fact that one manufacturer absorbed the costs while the other transferred them to operators shows that charging operators is a matter of choice rather than necessity.

This issue extends beyond the specific cases currently under discussion. As tachographs become increasingly digital and security-related updates become more frequent, it is essential to establish a clear, predictable and harmonised approach for the future. A uniform application of the rules across the EU is necessary to ensure legal certainty, avoid divergent practices and maintain a level playing field for transport operators - irrespective of the equipment installed in their vehicles.

IRU therefore calls on all stakeholders involved to ensure that road transport operators are not required to bear the costs of mandatory security updates linked to vulnerabilities identified after type approval, both in the current cases and in any similar situations that may arise in the future. IRU further calls for a harmonised EU-wide approach to the management of such vulnerabilities and associated corrective actions, ensuring equal treatment of operators and consistent implementation of the legal framework.

Maintaining confidence in the tachograph system requires legal certainty, consistency of treatment, a fair allocation of responsibilities among all actors involved, and a uniform application of the rules across the EU.