The debate comes as operators are already absorbing the cost of rolling out second-generation smart tachographs (G2V2). These units are being introduced in international transport under the timeline set by the Mobility Package. In IRU’s view, carriers should not be charged for compulsory updates to type-approved tachographs.
The dispute centres on who should pay
IRU notes that second-generation smart tachographs are a key tool for enforcing EU road transport rules. That makes reliability and cybersecurity essential, both for enforcement authorities and for companies that rely on the equipment to remain compliant.
After the devices entered the market, security vulnerabilities were identified in some type-approved tachographs. Manufacturers developed fixes, but adopted different funding models for the required work.
Stoneridge Electronics decided to cover the cost of the required security updates. Continental (Aumovio), meanwhile, introduced a voucher system, with the expense falling on carriers. Those differing approaches prompted IRU to intervene.
“Operators should not bear the costs”
According to IRU, transport companies buy equipment that is type-approved and meets the technical requirements in force at the time of sale. From the organisation’s perspective, addressing security gaps identified only after approval should remain the manufacturer’s responsibility.
As a matter of principle, IRU believes that road transport operators, as end users of devices that have already been type-approved and placed on the market, should not have to pay for mandatory updates addressing security issues identified after approval — stresses Raluca Marian, IRU EU advocacy director.
IRU also argues that transport firms are already facing substantial spending linked to mandatory technology upgrades. Additional, difficult-to-forecast charges, it says, make planning and budgeting harder.
Two manufacturers, two different models
For IRU, the current situation highlights the lack of a consistent approach to implementing mandatory security updates.
The association argues that the fact that one manufacturer funds the updates itself while another passes the cost to users shows the outcome is not an unavoidable consequence of regulation, but a commercial decision.
IRU compares the situation to other industries: when cybersecurity risks are found in consumer mobile devices, manufacturers typically cover the cost of the fix. In its view, tachographs should follow the same logic.
IRU calls for an EU-wide approach
IRU says the issue is likely to recur. As tachographs become more digital, security-related updates may be needed more frequently. Without harmonised rules, companies using devices from different brands could face different costs for meeting the same legal requirements.
That is why the organisation is calling for EU-wide harmonisation of rules for mandatory tachograph security updates, so operators are treated consistently regardless of the device manufacturer installed in their vehicles.
In IRU’s view, only clear and consistent rules that define responsibilities for manufacturers, operators and public authorities will protect confidence in the tachograph system and provide businesses with greater legal certainty.
From tomorrow: tachographs also for light commercial vehicles
IRU’s appeal comes as another Mobility Package milestone takes effect. From 1 July 2026, the requirement to use second-generation smart tachographs (G2V2) will also apply to vehicles with a permissible gross weight between 2.5 and 3.5 tonnes used in international commercial carriage of goods and cabotage. This means that any future disputes over who pays for mandatory security updates may soon affect not only truck fleets, but also businesses operating vans.
