AV cybersecurity and software updates: evidence before passenger service

Cybersecurity starts with accountability

Verified official guidance · DfT principles 1–4

The Department for Transport’s vehicle cybersecurity principles address board-level accountability, proportionate risk assessment, supply-chain cooperation and security throughout a system’s life. They include lifetime support and incident response. This is published guidance, not a certificate awarded to a passenger-service proposal. [1]

That guidance treats security as an organisational responsibility as well as a technical one. It calls for organisations to work together across the supply chain, including arrangements for aftercare and incident response. A vehicle supplier’s controls are therefore not the only evidence a proposed service needs to consider. [1]

Software changes need a controlled lifecycle

Verified official guidance · DfT principle 6 and pilot conditions

DfT principle 6 addresses code management, auditing and testing. It says software and firmware versions and configurations should be identifiable. Software should be updated safely and securely, with a return to a known good state if it becomes corrupt. These are lifecycle expectations, not a guarantee that any particular update is safe. [1]

The self-driving pilot guidance asks for documented maintenance and software-management procedures, pre-deployment checks and evidence that procedures are implemented, including third-party arrangements. Some hardware or software modifications require advance notification to the VCA. The notifiable changes are determined case by case through Vehicle Special Order conditions; the guidance does not say every update always needs prior approval. [3]

Vehicle approval is not the same as operator assurance

Verified approval context · manufacturer frameworks and operator evidence

The VCA describes UN Regulation 155 as addressing vehicle cybersecurity and its management system, and UN Regulation 156 as addressing software updates and their management system. It states that only vehicle manufacturers can obtain approval under R155. Suppliers should consult the manufacturers they supply about applicable requirements; this is not evidence that a platform developer or service proposer is R155 approved. [2]

Great Britain legislation introduced phased R155 and R156 vehicle-approval requirements. Application depends on the vehicle category, approval route, build stage and relevant date. Those rules should not be presented as a universal requirement applying identically to every vehicle already on Scottish roads. A future proposal must establish which requirements apply to its actual vehicles. [4]

For a proposed self-driving pilot, the official applicant guidance separates vehicle cybersecurity and software-update assessment from operator cybersecurity. The operator must provide a detailed self-assessment and supporting evidence against the National Cyber Security Centre’s Cyber Assessment Framework. Providing a self-assessment is not the same as demonstrating independent certification. [3]

A Scottish service must identify the route that applies

Verified geographic scope · pilot guidance and passenger-permit regulations

The pilot guidance applies across Great Britain, but the passenger-permit scope is not identical everywhere. It distinguishes bus-like services across Great Britain from taxi- and private-hire-like services in England. The passenger-service regulations likewise distinguish public-service-vehicle services in England, Wales and Scotland from other automated passenger services in England. An England-specific route must not be treated as automatic permission for a Scottish proposal. [3] [5]

What this means for SaveMe Scotland

SaveMe’s stated approach · founder-provided proposal, not verified implementation

SaveMe Scotland is developing a modular white-label platform for safer, more accessible mobility and connected local services. Under its proposed partner-led model, operating partners would bring local assets, people and day-to-day delivery capability. SaveMe would steward the configurable platform, central RideCam capability and evidence-led deployment framework. These are proposed roles, not a claim to manufacture or authorise an automated driving system.

SaveRide remains a proposed capability, not a live or authorised autonomous passenger service. No council has approved a SaveMe Scotland pilot or deployment. Inverclyde is a worked reference case only. Any future service would depend on suitable partners, defined operating boundaries, evidence, funding, insurance and the applicable authorisations, permits, licences and local processes. None of the official sources above verifies SaveMe’s technical controls or grants it approval.

Questions for a local AV proposal

A proposed feasibility checklist informed by the official sources, not an exhaustive legal test or a claim that these controls are implemented.

1. Who owns security decisions across the vehicle supplier, platform provider and operating organisation?
2. Which software versions and configurations would be recorded, and who could authorise a change?
3. How would testing, release decisions and any applicable notification conditions be evidenced?
4. What secure recovery or service-suspension response would apply if an update could not be used safely?
5. How would incidents be detected, escalated and reviewed with the relevant organisations?
6. Which vehicle-approval, operator-assurance and passenger-permit requirements apply to this specific Scottish case?

References

1. [1] Department for Transport: The key principles of vehicle cyber security for connected and automated vehicles. Checked 6 November 2026.
2. [2] Vehicle Certification Agency: Cyber Security and Software Updating. Checked 6 November 2026.
3. [3] Department for Transport and CCAV: Self-driving vehicle pilot scheme: information for applicants. Checked 6 November 2026.
4. [4] UK legislation: Road Vehicles Type-Approval Amendment No. 3 Regulations 2025 — SI 2025/1110. Checked 6 November 2026.
5. [5] UK legislation: Automated Vehicles Permits for Automated Passenger Services Regulations 2026 — SI 2026/439. Checked 6 November 2026.