ISO 26262: automotive functional safety, 12 parts

Hugues Orgitello updated 7 Oct 2026 16 min read

ISO 26262 is the functional safety standard for electrical and electronic (E/E) systems in road vehicles: in the words of its own introduction, the adaptation of the IEC 61508 series to the sector-specific needs of road vehicles. The current edition, ISO 26262:2018, was published in December 2018 in twelve parts, not ten, and its third edition reached the Draft International Standard stage in August 2026. This page reads the scope, the part and clause structure, the ASIL determination table, the limits of ASIL decomposition and the confirmation measures from the published texts and the ISO catalogue records, shows where UN and EU vehicle regulations actually mention the standard, and lists the claims the texts contradict.

Status in October 2026: 2018 edition in force, edition 3 at DIS

The ISO catalogue gives a precise history. Every 2018 part went through systematic review and was marked "to be revised", and the third-edition drafts of all twelve parts are now registered as Draft International Standards.

Date	Event	Source
14 November 2011	ISO 26262:2011 (first edition) published, scope "series production passenger cars with a maximum gross vehicle mass up to 3 500 kg"	ISO 26262-1:2011 record
17 December 2018	ISO 26262:2018 (second edition), Parts 1 to 12, published; 2011 parts withdrawn the same day	ISO 26262-1:2018 and 26262-1:2011 records
8 July 2024	Parts 1 to 5 and 7 to 12 of the 2018 edition marked "to be revised" (stage 90.92) after systematic review	ISO records 68383 to 69605
24 July 2025	Part 6 marked "to be revised", after being confirmed on 6 November 2024	ISO 26262-6:2018 record
21 October 2024	Third-edition projects approved (stage 10.99) for all twelve parts	ISO/DIS 26262-1 to -12 records
4 to 7 August 2026	Drafts registered as DIS (stage 40.00): Parts 1 to 9 and 11 on 4 August, Part 10 on 5 August, Part 12 on 7 August	ISO/DIS 26262 records
7 October 2026	No DIS ballot (stage 40.20) initiated yet on any part; no publication date set	ISO/DIS 26262 records

The third edition keeps the twelve-part numbering. The only title change visible in the records is Part 3, which becomes "Product development at the item level" instead of "Concept phase". The draft abstract of Part 3 still lists item definition, hazard analysis and risk assessment and functional safety concept. ISO 26262:2018 remains the edition to work to until the third edition is published.

Scope: which vehicles and which hazards

The scope clause, identical in each 2018 part, applies the standard to safety-related systems that include one or more E/E systems installed in series production road vehicles, excluding mopeds. It does not address unique E/E systems in special vehicles, such as systems designed for drivers with disabilities. Systems released for production, or already under development, before the publication date are exempted; alterations to them are handled by tailoring the safety lifecycle.

The standard addresses hazards caused by malfunctioning behaviour of safety-related E/E systems, including their interaction. It does not address electric shock, fire, smoke, heat, radiation, toxicity, flammability, reactivity, corrosion, release of energy and similar hazards unless they are directly caused by such malfunctioning behaviour, and it does not address the nominal performance of E/E systems.

The 2018 foreword lists the main changes from 2011, including requirements for trucks, buses, trailers and semi-trailers (shortened to T&B in the text), requirements for motorcycles, guidance for semiconductors, references to cybersecurity, management of safety anomalies, objective-oriented confirmation measures and updated target values for hardware architecture metrics.

The twelve parts and what each one contains

Clause numbers below come from the 2018 tables of contents. Parts 10 and 11 are guidelines; Part 10 states that it "has an informative character only".

Part	2018 title	Clauses and annexes worth knowing
1	Vocabulary	Clause 3 terms (ASIL, ASIL decomposition, cascading and common cause failure, T&B terms such as base vehicle and body builder), Clause 4 abbreviations
2	Management of functional safety	5.4.2 safety culture, 5.4.3 safety anomalies, 5.4.5 quality management system, 6.4.8 safety case, 6.4.9 to 6.4.12 confirmation measures, 6.4.13 release for production, Annex E functional safety and cybersecurity
3	Concept phase	Clause 6 hazard analysis and risk assessment, Table 4 ASIL determination, 6.4.4 safety goals; item definition and functional safety concept
4	Product development at the system level	Clause 6 technical safety concept, Clause 7 system and item integration and testing, Clause 8 safety validation, Annex B hardware-software interface (HSI)
5	Product development at the hardware level	Clause 8 hardware architectural metrics, Clause 9 safety goal violations due to random hardware failures, Annex C (normative) hardware architectural metrics, Annex D diagnostic coverage
6	Product development at the software level	Clauses 6 to 11 from software safety requirements to testing of the embedded software, Annex C (normative) software configuration, Annex D freedom from interference
7	Production, operation, service and decommissioning	Requirements for production, operation, service and decommissioning
8	Supporting processes	Clause 5 distributed developments (Annex B DIA example), 6 safety requirements, 7 configuration, 8 change, 9 verification, 10 documentation, 11 confidence in software tools, 12 software component qualification, 13 hardware element evaluation, 14 proven in use
9	ASIL-oriented and safety-oriented analyses	Clause 5 requirements decomposition with respect to ASIL tailoring, dependent failure and safety analyses
10	Guidelines on ISO 26262	4.1 relationship with IEC 61508, 4.4 fault tolerant time interval, 8.4 PMHF units, Clause 9 Safety Element out of Context, Clause 11 ASIL decomposition example
11	Guidelines on application of ISO 26262 to semiconductors	4.5 intellectual property (IP), 4.6 base failure rate, 4.7 dependent failure analysis, 4.8 fault injection, Clause 5 specific technologies (digital, memories and others)
12	Adaptation of ISO 26262 for motorcycles	Clause 7 confirmation measures, Clause 8 HARA for motorcycles, Motorcycle Safety Integrity Level (MSIL), Controllability Classification Panel

Parts 3 to 7 form the V-model described in the introduction. For motorcycles, Part 12 Clause 8 supports Part 3, and Clauses 9 and 10 support Part 4; where Part 12 applies, its requirements supersede the corresponding ones in other parts.

A sector adaptation of IEC 61508

IEC 61508 is the generic functional safety standard, and several sectors adapt it: IEC 61511 for the process industry, IEC 62061 for machinery, and ISO 26262 for road vehicles. Railway software now has EN 50716:2023, which supersedes EN 50128 and EN 50657. Avionics software (DO-178C) is not part of that family. The IEC 61508 guide covers the parent standard and its sector table.

The automotive adaptation changes the method, not just the vocabulary:

• the integrity level comes from a hazard analysis of vehicle situations (severity, exposure, controllability), not from target failure measures per demand mode,
• customer and supplier relations are a stated goal of the series, with Part 8 Clause 5 on distributed developments and a development interface agreement (DIA),
• semiconductors get their own guideline part (Part 11),
• trucks, buses, trailers, semi-trailers and motorcycles have specific content.

An element assessed to IEC 61508 at a given SIL is therefore not automatically fit for an ISO 26262 item of a given ASIL: the transfer has to be argued.

ASIL determination (S, E, C)

ISO 26262-1 defines the ASIL as one of four levels, with D the most stringent and A the least. A note adds that QM is not an ASIL. During the HARA (Part 3 Clause 6), each hazardous event receives three classes.

Parameter	Classes	Meaning
Severity	S0 to S3	From no injuries (S0) to life-threatening injuries with uncertain survival, or fatal injuries (S3)
Exposure	E0 to E4	Probability of the operational situation, from incredible (E0) to high probability (E4)
Controllability	C0 to C3	From controllable in general (C0) to difficult to control or uncontrollable (C3)

Table 4 of ISO 26262-3:2018 then gives the ASIL.

Severity	Exposure	C1	C2	C3
S1	E1	QM	QM	QM
S1	E2	QM	QM	QM
S1	E3	QM	QM	A
S1	E4	QM	A	B
S2	E1	QM	QM	QM
S2	E2	QM	QM	A
S2	E3	QM	A	B
S2	E4	A	B	C
S3	E1	QM	QM	A (see 6.4.3.11)
S3	E2	QM	A	B
S3	E3	A	B	C
S3	E4	B	C	D

Three points from the text around the table:

• S3, E1, C3 carries a footnote to 6.4.3.11: if several unlikely situations combine so that exposure is lower than E1, QM may be argued for that combination.
• A safety goal is set for each hazardous event with an ASIL (6.4.4). Similar safety goals may be combined, and the combined goal takes the highest ASIL.
• The rating is per hazardous event, not per item: one item can carry safety goals with different ASIL values.

ASIL decomposition and its limits

ASIL decomposition is defined in Part 1 as apportioning redundant safety requirements to sufficiently independent elements contributing to the same safety goal, to lower the ASIL of those redundant requirements. Part 9 Clause 5 sets the requirements; Part 10 Clause 11 gives an example. The decomposed requirement is noted with the original ASIL in brackets.

Original ASIL	Decomposition options
D	C(D) + A(D), B(D) + B(D), D(D) + QM(D)
C	B(C) + A(C), C(C) + QM(C)
B	A(B) + A(B), B(B) + QM(B)
A	A(A) + QM(A)

The definition itself sets two limits that projects often miss:

• ASIL decomposition does not apply to random hardware failure requirements (Note 2): the hardware metrics are still evaluated against the ASIL of the safety goal.
• Confirmation measures remain at the level of the safety goal (Note 3), even when the elements are developed to a lower ASIL.

Independence between the decomposed elements has to be shown, which is where the dependent failure analysis of Part 9 comes in. Part 1 distinguishes cascading failures from common cause failures, and common mode failures as a case of common cause failure.

The safety lifecycle, part by part

Step	Where	Main work products
Item definition	Part 3	Functions, boundaries, interfaces, operating environment
Hazard analysis and risk assessment	Part 3 Clause 6	Hazardous events, S, E, C classes, ASIL, safety goals
Functional safety concept	Part 3	Functional safety requirements allocated to the architecture
Technical safety concept	Part 4 Clause 6	Technical safety requirements, system architecture, HSI
Hardware development	Part 5	Hardware safety requirements, design, architectural metrics (Clause 8), random hardware failure evaluation (Clause 9)
Software development	Part 6	Software safety requirements, architecture, unit design and verification, integration, embedded software testing
Integration and testing	Part 4 Clause 7	System and item integration test results
Safety validation	Part 4 Clause 8	Evidence that the safety goals are achieved at vehicle level
Confirmation and release	Part 2 6.4.9 to 6.4.13	Confirmation review reports, audit, assessment, release for production
Production, operation, service, decommissioning	Part 7	Production and field requirements

Part 2 6.4.8 makes the safety case a work product, built progressively from the work products of the lifecycle rather than written at the end. Part 5 Clauses 8 and 9 contain the hardware target values (single-point fault metric, latent fault metric, and the evaluation of safety goal violations due to random hardware failures); the 2018 foreword notes that these target values were updated from 2011, so figures quoted from 2011-era material need checking against the 2018 text.

Safety Element out of Context (SEooC)

A SEooC is an element developed without knowledge of the item it will be integrated into, typically a microcontroller, a sensor or a software component sold to many customers. Part 10 Clause 9 describes the approach: the supplier develops against assumed requirements and an assumed context of use, and the integrator checks that the assumptions hold for the real item. Part 10 being informative, SEooC is a way of applying the normative parts (and Part 8 Clauses 12 and 13 on qualification of software components and evaluation of hardware elements), not a separate compliance route.

For semiconductors, Part 11 adds the IP lifecycle (4.5), base failure rate estimation (4.6), dependent failure analysis inside the component (4.7) and fault injection (4.8). These are the clauses a chip supplier safety manual refers to.

Confirmation measures

Part 2 Clause 6.4.9 requires functional safety to be confirmed by three measures, each detailed in its own clause:

Measure	Clause	Object
Confirmation review	Part 2 6.4.10	Whether key work products listed in Table 1 provide sufficient and convincing evidence
Functional safety audit	Part 2 6.4.11	Whether the processes required for functional safety are implemented
Functional safety assessment	Part 2 6.4.12	Whether the achieved functional safety of the item, or the contribution of the developed elements, is sufficient

Table 1 sets the required independence per work product and per ASIL, on a scale from I0 to I3. Part 12 (motorcycles) repeats the structure with its own Table 1 and makes three useful clarifications: the aim of independence is an objective viewpoint free of conflict of interest; confirmation measures are repeated or supplemented if the item changes afterwards; and reviews and audits can be merged with the assessment to handle comparable variants of an item. Annex C of Part 2 gives guidance and Annex D an example assessment agenda for items with an ASIL D safety goal.

The standard asks for independence, not for a certificate issued by an outside body. A third-party "ISO 26262 certificate" is a commercial service, useful as evidence but not required by the text.

ISO 26262 and its neighbouring standards

Standard	Status on 7 October 2026	Relation to ISO 26262
IEC 61508	Edition 2 (2010)	Generic parent; ISO 26262 is its road vehicle adaptation
ISO 21448	2022 edition, published 30 June 2022, marked "to be revised" on 14 October 2025	Safety of the intended functionality: functional insufficiencies and performance limits. Excludes faults covered by ISO 26262 and cybersecurity threats. Replaced ISO/PAS 21448:2019
ISO/PAS 8800	Published 13 December 2024	Safety and artificial intelligence: output insufficiencies, systematic errors and random hardware errors of AI elements, mainly machine learning
ISO/SAE 21434	2021 edition, marked "to be revised" on 2 October 2026	Cybersecurity engineering; its only normative reference is ISO 26262-3:2018. Part 2 Annex E covers the safety and security interaction
IATF 16949	Automotive quality management	Quality system; ISO 26262-2 5.4.5 deals with the quality management system expected of the organisation, and functional safety sits on top of it

Where vehicle regulations mention ISO 26262

ISO 26262 is a voluntary standard. Type-approval texts mention it, but none of those read here makes conformity to it a requirement.

Text	What it says about ISO 26262
UN R155 (cybersecurity), paragraph 5.3.1 footnote	Names ISO 26262 with ISO/PAS 21448 and ISO/SAE 21434 as examples of knowledge expected of approval authority staff (see the cybersecurity guide)
UN R157 (ALKS), Annex 4 paragraph 7	Auditors and assessors of the functional and operational safety documentation must be competent for "ISO 26262-2018" and ISO/PAS 21448
Implementing Regulation (EU) 2022/1426 (ADS of fully automated vehicles, adopted under GSR Article 11(2)), Annex III Part 2 point 7.1	Same competence requirement for the assessors of the ADS safety concept and the auditors of the safety management system
UN R171 (DCAS, in force 22 September 2024), Annex 5 paragraph 3.5.5	Criticality assessment of the simulation toolchain "derived from ISO 26262", using its severity classes
Regulation (EU) 2019/2144 (GSR), applicable from 6 July 2022	Mandates systems such as intelligent speed assistance, driver drowsiness and attention warning, emergency stop signal and event data recorder (Article 6) and advanced emergency braking for M1 and N1 (Article 7), without citing ISO 26262

Regulation 2022/1426 also defines functional safety as the absence of unreasonable risk under hazards caused by malfunctioning behaviour, and operational safety as the absence of unreasonable risk from functional insufficiencies, disturbances or reasonably foreseeable misuse: the same split as ISO 26262 and ISO 21448. Vehicle approval runs through Regulation (EU) 2018/858 and UN regulations, not through CE marking, so there is no harmonised standard in the CE sense here.

Claims the texts contradict

Claim	What the texts say
"ISO 26262 has ten parts" (this page said so until October 2026)	The 2018 edition has twelve parts: Part 11 (semiconductors) and Part 12 (motorcycles) were published on 17 December 2018 with the others
"The 2018 edition extended the scope to trucks, buses and coaches"	The scope covers series production road vehicles excluding mopeds; the foreword lists requirements for trucks, buses, trailers and semi-trailers, and for motorcycles. The 2011 scope was passenger cars up to 3 500 kg
"The 2nd edition is the single reference, no revision under way"	All twelve parts of edition 3 were registered as DIS between 4 and 7 August 2026; the 2018 edition stays current until publication
"QM is the lowest ASIL"	Part 1, definition 3.6, Note 1: QM is not an ASIL
"S3, E1, C3 is always ASIL A"	Footnote to Table 4 and 6.4.3.11: QM may be argued when several unlikely situations combine below E1
"Decomposing ASIL D into B(D) + B(D) lowers every requirement to ASIL B"	Part 1 definition 3.3: decomposition does not apply to random hardware failure requirements, and confirmation measures stay at the level of the safety goal
"Part 10 makes SEooC a normative requirement"	Part 10 has an informative character only; the normative requirements are in Parts 2 to 9
"UN R157 and the EU ADS regulation require ISO 26262 certification"	They require assessors and auditors to be competent for ISO 26262 and ISO/PAS 21448 (R157 Annex 4 paragraph 7, 2022/1426 Annex III Part 2 point 7.1), not a certificate of the product
"DO-178C and EN 50128 are IEC 61508 sector derivatives alongside ISO 26262"	DO-178C is not derived from IEC 61508, and EN 50716:2023 supersedes EN 50128 and EN 50657
"R155 and R156 apply from July 2022 (new types) and July 2024 (all vehicles)"	Those are EU dates for R155 under the GSR. R156 follows Delegated Regulation (EU) 2022/2236, with further steps on 7 July 2026 and 7 July 2029

The automotive supply chain

Part 8 Clause 5 covers distributed developments: supplier selection criteria (5.4.2), initiation and planning (5.4.3), execution (5.4.4), functional safety assessment activities in a distributed development (5.4.5) and the agreement for production, operation, service and decommissioning (5.4.6). Annex B gives an example of a development interface agreement (DIA), which sets who does which safety activity and who delivers which work product.

In practice:

• the vehicle manufacturer usually owns the item definition, the HARA and the safety goals, and integrates the item,
• a Tier 1 supplier of a system or ECU usually owns the technical safety concept for its scope and passes requirements to its own suppliers,
• a component supplier (microcontroller, sensor, operating system) often develops a SEooC and delivers a safety manual with its assumptions.

The DIA is what makes this split auditable: without it, the functional safety assessment cannot tell which party is accountable for which work product.

Links with other pages

ISO 26262 does not replace the general regulatory framework. Several connections are relevant:

• for the CE marking framework of non-vehicle electronic products (radio, EMC, cyber), see the CE marking page;
• for project timelines and the combination of certification phases, see the certification timeline;
• for the full glossary of terms used here (ASIL, HARA, SEooC, Safety Goal, FSC, TSC, FSA), see the glossary.

See also

• IEC 61508: functional safety and SIL
• ECE R10: automotive EMC and the E-mark
• Automotive cybersecurity: 21434, R155, R156
• AEC-Q100 and AEC-Q101: automotive semiconductors
• IATF 16949: automotive quality
• EV charging: IEC 61851, ISO 15118 and OCPP conformity
• EN 50128 and EN 50657: railway software assurance
• DO-178C and DO-254: avionics software and hardware
• DO-326A and ED-202A: avionics cybersecurity airworthiness

Working on upstream normative scoping of an automotive electronics project for a real product? AESTECHNO can audit your design and certification plan. Get in touch

Common pitfalls observed in the field

• Conflating ASIL and SIL. The scales are built differently. Reusing a "SIL 2" component from an industrial project as ASIL B without a transfer argument is a gap an assessor will find.
• A HARA written after the design. The HARA is the input of the concept phase. Retrofitting ASIL values onto a frozen architecture leaves safety goals that the design was never built to meet.
• Unread safety manuals. Integrating a SEooC microcontroller without checking its assumptions of use against the real item breaks the safety argument at the integration step.
• Decomposition without independence. A decomposition is only valid with sufficient independence shown by dependent failure analysis, and it never lowers the hardware metric targets.
• FuSa and SOTIF mixed up. A sensor limitation in fog or glare is not a malfunction under ISO 26262. It belongs to ISO 21448, which excludes the faults ISO 26262 covers.
• Safety and security in separate silos. Part 2 Annex E and ISO/SAE 21434 expect information to flow between the two teams when a cyber threat can violate a safety goal.
• Using 2011 metric targets. The 2018 edition updated the hardware architecture metric target values; check figures against Part 5 Clauses 8 and 9 of the 2018 text.

Further pages

One adjacent area has its own page here: automotive cybersecurity, covering ISO/SAE 21434 and UNECE R155 and R156 from the type-approval angle.

Not covered on this site, and worth going to the standard itself for: HARA step by step with worked S, E and C ratings; the computation of the hardware metrics in Part 5 Annex C; ISO 21448 (SOTIF) and its articulation with ADAS and automated driving; and software tool qualification under Part 8 Clause 11, including the tool confidence level.

Sources & references

1. ISO 26262-1:2018, Part 1: Vocabulary (catalogue record, published 17 December 2018, stage 90.92 to be revised), ISO www.iso.org/standard/68383.html
2. ISO 26262-1:2018 preview, foreword (main changes from 2011), introduction and scope (preview hosted by iTeh Standards), ISO (via iTeh Standards) cdn.standards.iteh.ai/samples/68383/4e26ddadc54a4198bed652afe29669fa/ISO-26262-1-2018.pdf
3. ISO 26262-2:2018 preview, table of contents of Clauses 5 to 7 and Annexes A to E (preview hosted by iTeh Standards), ISO (via iTeh Standards) cdn.standards.iteh.ai/samples/68384/a48c82d694274496bcb249700a63ac2f/ISO-26262-2-2018.pdf
4. ISO 26262-3:2018, Part 3: Concept phase (catalogue record; Table 4, ASIL determination), ISO www.iso.org/standard/68385.html
5. ISO 26262-5:2018 preview, table of contents (hardware metrics Clauses 8 and 9, Annex C) (preview hosted by iTeh Standards), ISO (via iTeh Standards) cdn.standards.iteh.ai/samples/68387/4e38d919e3d4433fa18cb1b5482f13a0/ISO-26262-5-2018.pdf
6. ISO 26262-8:2018 preview, table of contents (DIA, tools, proven in use) (preview hosted by iTeh Standards), ISO (via iTeh Standards) cdn.standards.iteh.ai/samples/68390/8b6b8ddbf06b436e8ac60f72f63c17d9/ISO-26262-8-2018.pdf
7. ISO 26262-9:2018, Part 9: ASIL-oriented and safety-oriented analyses (catalogue record), ISO www.iso.org/standard/68391.html
8. ISO 26262-10:2018 preview, scope (informative character) and table of contents (preview hosted by iTeh Standards), ISO (via iTeh Standards) cdn.standards.iteh.ai/samples/68392/a4d0368c4ded438697d65e219e7c3477/ISO-26262-10-2018.pdf
9. ISO 26262-11:2018 preview, table of contents (semiconductors) (preview hosted by iTeh Standards), ISO (via iTeh Standards) cdn.standards.iteh.ai/samples/69604/4f41f01c856048f5b8861cf60daeebad/ISO-26262-11-2018.pdf
10. ISO 26262-12:2018 preview, motorcycles, Clauses 4 to 7 (preview hosted by iTeh Standards), ISO (via iTeh Standards) cdn.standards.iteh.ai/samples/69605/e46be4de4cff4189859cdaa382ae7cc6/ISO-26262-12-2018.pdf
11. ISO 26262-1:2011 (catalogue record, scope limited to passenger cars up to 3 500 kg, withdrawn 17 December 2018), ISO www.iso.org/standard/43464.html
12. ISO/DIS 26262-1, edition 3 (catalogue record, DIS registered 4 August 2026), ISO www.iso.org/standard/90020.html
13. ISO/DIS 26262-3, edition 3, Part 3: Product development at the item level (catalogue record, stage history), ISO www.iso.org/standard/90022.html
14. ISO 21448:2022, Road vehicles, Safety of the intended functionality (catalogue record), ISO www.iso.org/standard/77490.html
15. ISO/PAS 8800:2024, Road vehicles, Safety and artificial intelligence (catalogue record), ISO www.iso.org/standard/83303.html
16. ISO/SAE 21434:2021, Road vehicles, Cybersecurity engineering (catalogue record), ISO www.iso.org/standard/70918.html
17. UN Regulation No 157 (ALKS), Annex 4 paragraph 7, as published in OJ L 82 of 9 March 2021, EUR-Lex eur-lex.europa.eu/eli/reg/2021/389/oj
18. UN Regulation No 171 (DCAS), Annex 5 paragraph 3.5.5, as published in the OJ on 4 November 2024, EUR-Lex eur-lex.europa.eu/eli/reg/2024/2689/oj
19. Commission Implementing Regulation (EU) 2022/1426, ADS of fully automated vehicles, Annex III Part 2 point 7.1, EUR-Lex eur-lex.europa.eu/eli/reg_impl/2022/1426/oj
20. Regulation (EU) 2019/2144 (General Safety Regulation), Articles 6, 7, 11(2) and 19, EUR-Lex eur-lex.europa.eu/eli/reg/2019/2144/oj
21. IEC 61508-1:2010, Part 1: General requirements (catalogue record), IEC webstore.iec.ch/en/publication/5515
22. UNECE WP.29, UN vehicle regulations, UNECE unece.org/transport/vehicle-regulations