A new compliance task has emerged for European transport operators: security vulnerabilities have been identified in certain second-generation smart tachographs, meaning that the software of the affected devices must be updated.
In July 2026, the European Commission’s Joint Research Centre, or JRC, published a list of tachographs requiring a mandatory security software update. The official list currently includes one Continental/VDO model and several Stoneridge variants.
Official information from the European Commission’s Joint Research Centre
Not Every Tachograph Needs to Be Updated
The news has sometimes been summarised by saying that “every tachograph must be updated.” However, this is not accurate.
The newly announced requirement does not automatically apply to every analogue, digital or smart tachograph. The European Commission’s notice identifies specific models, device revisions and software versions.
Continental/VDO DTCO 1381 4.1
The affected device has the following specifications:
- Model: Continental DTCO 1381
- Device version: 4.1
- Affected software version: 04.01.26
- Required software version: 04.01.41
- Device version after the update: DTCO 4.1b
- Start of the mandatory update period: 15 July 2026
According to information published by VDO, the DTCO 4.1 device does not need to be replaced completely. It can be upgraded to the DTCO 4.1b version through the appropriate software update.
Stoneridge SE5000-8.1
The requirement applies to revisions B, C, D and E of the Stoneridge SE5000-8.1:
- Revision B with software version 1214: update to version 2424
- Revision C with software version 1214: update to version 2525
- Revision D with software version 1619: update to version 2424 or 2525
- Revision E with software version 1619: update to version 2626
For the affected Stoneridge devices, the mandatory update period begins on 1 September 2026.
When Must the Update Be Completed?
Transport operators do not need to take every affected vehicle to a workshop immediately and outside the normal inspection schedule solely because of the announcement.
According to the European Commission’s official information, the update must be completed no later than:
- the device’s next periodic inspection, or
- the first installation, in the case of a device that has not yet been installed.
Under Regulation (EU) No 165/2014, tachographs must undergo a periodic inspection at an approved workshop at least once every two years. The inspection includes checking whether the device operates correctly, has the appropriate type approval and has intact seals.
Consolidated text of Regulation (EU) No 165/2014 on EUR-Lex
In practical terms, this means that a vehicle fitted with an affected but functioning tachograph does not need to be removed from service immediately solely because of the notice. However, the update must not be omitted during the next scheduled tachograph calibration or periodic inspection.
Why Has the Update Become Mandatory?
The legal basis for the requirement is provided by Article 20 of Regulation (EU) No 165/2014 on tachographs in road transport.
The regulation requires manufacturers to assess potential security vulnerabilities throughout the entire lifecycle of a tachograph. When a vulnerability is discovered in a device that has already been placed on the market, the manufacturer or certification body must notify the authority that granted the type approval.
The authority must then take the necessary measures to resolve the problem and inform the European Commission.
The JRC notice refers to security vulnerabilities but does not provide detailed technical information about their precise nature. It would therefore be inaccurate to claim that the issue has been proven to cause data loss, incorrect driving-time calculations or widespread manipulation.
The information officially confirmed at this stage is that the listed software versions are considered vulnerable and must be updated to the specified newer versions.
What Should Transport Companies Do Now?
The first step is to identify the tachographs installed across the company’s fleet. The manufacturer and model alone are not sufficient: the device revision, software version and type-approval number may also be relevant.
Transport operators should:
- record the tachograph model and software version for each vehicle;
- check the date of the next periodic inspection or calibration;
- contact an approved tachograph workshop in advance;
- ensure that the completed update is documented on the workshop report or invoice;
- verify that any newly installed device already contains the required software version.
Under EU rules, the installation, repair and necessary servicing of tachographs may only be performed by an approved fitter, workshop or vehicle manufacturer.
What Should Operators Pay Particular Attention To?
This security update must not be confused with the previous tachograph replacement requirements.
The replacement of older analogue tachographs, first-generation digital tachographs and first-version smart tachographs used in international transport was governed by separate EU deadlines.
The current measure concerns security updates for specific software versions installed on certain second-generation smart tachographs that may already be operating in vehicles.
Summary
The news is therefore genuine: the European Commission has published an official list of mandatory tachograph security software updates. However, not every tachograph needs to be updated.
The devices currently affected are:
- Continental/VDO DTCO 1381 4.1 with software version 04.01.26;
- Stoneridge SE5000-8.1 Revisions B–E with software version 1214 or 1619.
For devices that have already been installed, the update must be completed no later than the next periodic inspection. Transport operators should therefore focus on identifying the affected devices in their fleets, planning workshop appointments and documenting the completed updates.
Important: the official notice does not currently support claims that every tachograph is affected, that every vehicle must immediately be taken to a workshop, or that the vulnerability has been proven to cause incorrect driving-time calculations.
