ISO/PAS 25090:2026

• Abstract:

  This document provides guidance on how to determine the relevant vehicle configuration information for software update engineering according to ISO 24089. This document contains definitions of elements of vehicle configuration information, relationships between such elements and examples of usage. This document does not prescribe formats for elements of vehicle configuration information or how such information can be collected, stored and exchanged.

• Status: Published
• Publication Date: 20-Oct-2026
• ICS: 43.040.15 - Car informatics. On board computer systems
• Technical Committee: ISO/TC 22/SC 32 - Electrical and electronic components and general system aspects
• Drafting Committee: ISO/TC 22/SC 32/WG 12 - Software update
• Current Stage: 6060 - International Standard published
• Start Date: 21-Oct-2026
• Completion Date: 21-Oct-2026

ISO/PAS 25090:2026 is an ISO document for road vehicles that supports software update engineering by defining vehicle configuration information (VCI). It gives guidance on how to identify the relevant VCI needed under ISO 24089, including the main elements of VCI, how those elements relate to each other, and examples of how they are used in update work. It is written for organizations that plan, prepare, and carry out software update engineering across the vehicle supply chain.

What does ISO/PAS 25090:2026 specify?

ISO/PAS 25090:2026 specifies guidance for determining the relevant VCI for software update engineering according to ISO 24089. It defines VCI elements, shows how those elements relate to each other, and gives examples of how they are used.

The document does not prescribe data formats or tell users how VCI is collected, stored, or exchanged. In practice, that means it helps organizations decide what information matters for an update, while leaving the implementation method open.

Part	What it covers
Clause 4	Organizational responsibilities and process control
Clause 5	Elements of VCI and how they are assigned and managed
Clause 6	Relationships between VCI elements and an information model
Clause 7	Selecting relevant VCI for projects, packages, and campaigns
Annex A	Informative examples of selecting relevant VCI

What are the key requirements of ISO/PAS 25090:2026?

ISO/PAS 25090:2026 focuses on controlled identification, traceability, and selection of VCI so software update engineering can be planned and checked against vehicle configuration. The main practical effect is that update teams need consistent identifiers and documented relationships before they can decide what to target, what depends on what, and what must change.

• Clause 4 requires the organization to establish, implement, and maintain software update engineering activities in line with ISO 24089, and to maintain the processes needed to conform to this document. It also says audits of software update engineering processes shall include these requirements and recommendations. In practice, VCI handling becomes part of normal process control and internal audit.

• Clause 5.2.1 requires processes for managing VCI elements, including naming, identifying what the data means, and managing changes. It also requires processes for assigning vehicle system, hardware, software, and supplemental data identifiers. In practice, the organization needs a governed identifier scheme, not ad hoc naming.

• Clause 5.2.1 allows reuse of supplier-assigned VCI elements and requires additions, deletions, or changes to VCI elements to be identified and documented. This matters because update projects often span multiple suppliers, so the organization must know what came from whom and what changed during the project.

• Clause 5.2.2 assigns a vehicle identifier to each vehicle and says it is immutable once assigned. It also allows vehicle group identifiers for groups of vehicles. In practice, teams can trace one vehicle precisely and also work with groups such as model or trim-based populations.

• Clause 5.2.2 assigns identifiers to each ECU, hardware item, vehicle system, and software item, and makes the vehicle identifier, ECU identifier, hardware identifier, software identifier, and vehicle system identifier immutable once assigned. It also assigns version identifiers to versions of those elements. In practice, this gives a stable way to compare the current configuration with the configuration needed after an update.

• Clause 5.2.2 requires supplemental data identifiers for data identified as supplemental, including metadata, data used to determine conditions or dependencies, serial numbers, configuration parameters, and calibration data. In practice, update engineering can include more than just code and hardware - it can also include the configuration data that affects whether the update works.

• Clause 6 provides an information model and recommends using identified relationships between VCI elements to support dependency and compatibility analysis. It also recommends using those relationships to communicate with relevant parties, such as suppliers and vehicle users. In practice, the relationships help answer whether one update can be applied alone or requires other changes.

• Clause 7 says the organization responsible for a software update project selects the relevant VCI, identifies changes to immutable identifiers, determines the relevant VCI for targets, dependencies, and compatibility, and specifies/document the relevant VCI changed by the campaign. In practice, the document separates planning at project, package, and campaign level so the right vehicles and dependencies are handled before release.

What terms does ISO/PAS 25090:2026 define?

• Vehicle configuration information (VCI) - a comprehensive accounting of hardware versions, software versions, and configuration parameters in a vehicle.

• Relevant VCI - the subset of VCI needed to meet ISO 24089 and this document during a specific software update campaign.

• Hardware - a physical part of a vehicle system.

• ECU identifier - a unique designation for an electronic control unit, including a virtual ECU.

• Vehicle identifier - a unique designation for an individual vehicle, and once assigned it is immutable.

• Vehicle group identifier - a unique designation that represents characteristics of a set of vehicles.

• Supplemental data identifier - a unique designation for data used to support or enable software update engineering that is not covered by other VCI elements.

• VCI - the abbreviated form used throughout the document for vehicle configuration information.

Who uses ISO/PAS 25090:2026?

ISO/PAS 25090:2026 is used by organizations involved in road vehicle software update engineering, including vehicle manufacturers, system integrators, and suppliers that contribute ECUs, hardware, software, or related data. It is also relevant to configuration management, update project planning, campaign planning, and audit teams.

The document is especially useful when a team needs to identify targets, check dependencies, confirm compatibility, or describe what changed in a software update campaign. It also supports communication with suppliers and vehicle users where configuration relationships matter.

Which standards are used with ISO/PAS 25090:2026?

ISO/PAS 25090:2026 refers to ISO 24089 as the base document for road vehicle software update engineering. This document extends ISO 24089 by adding VCI definitions, relationships, and selection guidance.

The bibliography and examples also cite ISO/SAE 21434:2021, ISO 3779:2009, and ISO 14229-1:2020. In the document, these support examples such as supplier-built components, VIN structure, and diagnostic-related context.

What does the ISO/PAS 25090:2026 document contain?

ISO/PAS 25090:2026 contains a foreword, introduction, seven main clauses, one informative annex, and a bibliography. Clause 6 includes two figures: one showing an example information model of a vehicle and one showing possible relationships among VCI elements.

Annex A gives worked examples for a vehicle configuration and for selecting relevant VCI at software update project, software update package, and software update campaign levels. Those examples show how identifiers and relationships are used to identify targets, dependencies, compatibility, recipients, and affected elements without prescribing a fixed data format.

Publicly
Available
Specification
ISO/PAS 25090
First edition
Road vehicles — Software
2026-10
update engineering — Vehicle
configuration information
Véhicules routiers — Ingénierie de mise à jour du logiciel —
Informations sur la configuration des véhicules
Reference number
© ISO 2026
All rights reserved.
This ISO publication is protected by copyright and is owned by ISO and/or its licensors.
The content of this ISO publication is provided under licence, not sold. Use is subject to the applicable licence terms issued by ISO,
an ISO member body, or an authorized third-party distributor.
Except as required for implementation or expressly permitted by a separate licence, no part of this ISO publication may be
reproduced, distributed, modified, used, or made available in any form or by any means – electronic or mechanical, including
photocopying, scanning, recording, or posting on internal or external digital platforms.
Any use beyond the scope of the granted rights is prohibited and may result in legal action.
ISO copyright office
CP 401 • CH-1214 Vernier, Geneva
Phone: [phone]
Email: [e-mail]
Website: www.iso.org
Published in Switzerland
ii
Contents Page
Foreword .iv
Introduction .v
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 1
3.1 General terminology .1
3.2 Terms related to vehicle configuration information .2
3.3 Abbreviated terms .3
4 Organizational level responsibilities. 3
4.1 General .3
4.2 Requirements and recommendations .3
4.2.1 Software update engineering responsibilities .3
4.2.2 Organizational processes .3
5 Elements of VCI . 3
5.1 General .3
5.2 Requirements and recommendations .3
5.2.1 Element management . .3
5.2.2 Element assignments .4
6 Relationships between elements of VCI. 6
6.1 General .6
6.2 Information model .6
6.3 Recommendations .7
6.3.1 Identification of relationships between elements of VCI .7
6.3.2 Communication of relationships between elements of VCI .7
7 Selection of relevant VCI . 7
7.1 General .7
7.2 Requirements and recommendations . .7
7.2.1 Software update project level . .7
7.2.2 Software update package level .8
7.2.3 Software update campaign level .8
Annex A (informative) Examples of selection of relevant VCI . 9
Bibliography .13

iii
Foreword
ISO (the International Organization for Standardization) is a worldwide federation of national standards
bodies (ISO member bodies). The work of preparing International Standards is normally carried out through
ISO technical committees. Each member body interested in a subject for which a technical committee
has been established has the right to be represented on that committee. International organizations,
governmental and non-governmental, in liaison with ISO, also take part in the work. ISO collaborates closely
with the International Electrotechnical Commission (IEC) on all matters of electrotechnical standardization.
The procedures used to develop this document and those intended for its further maintenance are described
in the ISO/IEC Directives, Part 1. In particular, the different approval criteria needed for the different types
of ISO documents should be noted. This document was drafted in accordance with the editorial rules of the
ISO/IEC Directives, Part 2 (see www.iso.org/directives).
ISO draws attention to the possibility that the implementation of this document may involve the use of (a)
patent(s). ISO takes no position concerning the evidence, validity or applicability of any claimed patent
rights in respect thereof. As of the date of publication of this document, ISO had not received notice of (a)
patent(s) which may be required to implement this document. However, implementers are cautioned that
this may not represent the latest information, which may be obtained from the patent database available at
www.iso.org/patents. ISO shall not be held responsible for identifying any or all such patent rights.
Any trade name used in this document is information given for the convenience of users and does not
constitute an endorsement.
For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and expressions
related to conformity assessment, as well as information about ISO's adherence to the World Trade
Organization (WTO) principles in the Technical Barriers to Trade (TBT), see www.iso.org/iso/foreword.html.
This document was prepared by Technical Committee ISO/TC 22, Road vehicles, Subcommittee SC 32,
Electrical and electronic components and general system aspects.
Any feedback or questions on this document should be directed to the user’s national standards body. A
complete listing of these bodies can be found at www.iso.org/members.html.

iv
Introduction
ISO 24089 requires the use of vehicle configuration information when performing software update
engineering activities. Vehicle configuration information is essential for software update engineering.
ISO 24089 does not define elements of vehicle configuration information or describe any relationships
between such elements. ISO 24089 does not mention how to determine relevant vehicle configuration
information for a given software update engineering activity.
This document extends ISO 24089 by providing:
— definitions of elements of vehicle configuration information;
— relationships between elements;
— selection of relevant vehicle configuration information;
— examples of usage of elements of vehicle configuration information.
This document will also facilitate communications about software update engineering activities that involve
vehicle configuration information throughout the supply chain.

v
Publicly Available Specification ISO/PAS 25090:2026(en)
Road vehicles — Software update engineering — Vehicle
configuration information
1 Scope
This document provides guidance on how to determine the relevant vehicle configuration information for
software update engineering according to ISO 24089. This document contains definitions of elements of
vehicle configuration information, relationships between such elements and examples of usage.
This document does not prescribe formats for elements of vehicle configuration information or how such
information can be collected, stored and exchanged.
2 Normative references
The following documents are referred to in the text in such a way that some or all of their content constitutes
requirements of this document. For dated references, only the edition cited applies. For undated references,
the latest edition of the referenced document (including any amendments) applies.
ISO 24089, Road vehicles — Software update engineering
3 Terms and definitions
For the purposes of this document, the terms and definitions given in ISO 24089 and the following apply.
ISO and IEC maintain terminology databases for use in standardization at the following addresses:
— ISO Online browsing platform: available at https:// www .iso .org/ obp
— IEC Electropedia: available at https:// www .electropedia .org/
3.1 General terminology
3.1.1
hardware
material physical part of a vehicle system
[SOURCE: NIST Special Publication 800-53 rev 5, modified — Term "vehicle" has been added and term
"component" has been deleted.]
3.1.2
relevant VCI
relevant vehicle configuration information
subset of vehicle configuration information (3.1.3) necessary to conform to ISO 24089 and this document
during a specific software update campaign
3.1.3
vehicle configuration information
VCI
comprehensive accounting of hardware versions, software versions and configuration parameters in a
vehicle
[SOURCE: ISO 24089:2023, 3.1.24, modified — The preferred term "VCI" has been added.]

3.2 Terms related to vehicle configuration information
3.2.1
ECU identifier
electronic control unit identifier
unique designation for an electronic control unit
Note 1 to entry: An ECU can be virtual.
Note 2 to entry: See ISO 24089:2023, 3.1.7 for a definition of "ECU".
3.2.2
ECU version identifier
electronic control unit version identifier
unique designation for a version of an electronic control unit
3.2.3
hardware identifier
unique designation for hardware (3.1.1)
3.2.4
hardware version identifier
unique designation for a version of hardware (3.1.1)
3.2.5
software identifier
unique designation for software
3.2.6
software version identifier
unique designation for a version of software
3.2.7
supplemental data identifier
unique designation assigned to any piece of data that is used to support or that is necessary for software
update engineering and is not covered by other defined vehicle configuration information elements
3.2.8
vehicle group identifier
unique designation that represents characteristics about a set of vehicles
3.2.9
vehicle identifier
unique designation for an individual instance of a vehicle
3.2.10
vehicle system identifier
unique designation for a vehicle system
Note 1 to entry: See ISO 24089:2023, 3.1.25 for a definition of "vehicle system".
3.2.11
vehicle system version identifier
unique designation for a version of a vehicle system
Note 1 to entry: See ISO 24089:2023, 3.1.25 for a definition of "vehicle system".

3.3 Abbreviated terms
App application
ECU electronic control unit
MCU microcontroller unit
SoC system on a chip
SUV sport utility vehicle
VCI vehicle configuration information
VDS vehicle descriptor section
VIN vehicle identification number
4 Organizational level responsibilities
4.1 General
This clause details requirements and recommendations for organizational responsibilities and processes
for achieving the requirements and recommendations of this document while engaging in software update
engineering.
4.2 Requirements and recommendations
4.2.1 Software update engineering responsibilities
4.2.1.1 The organization shall establish, implement, and maintain software update engineering activities in
accordance with ISO 24089.
4.2.2 Organizational processes
4.2.2.1 The organization shall establish, implement and maintain processes necessary to conform to the
requirements of this document.
4.2.2.2 An audit of organizational processes for software update engineering shall include the requirements
and recommendations of this document.
NOTE Such audits include audits under ISO 24089:2023, 4.3.5.
5 Elements of VCI
5.1 General
This clause describes the requirements and recommendations for management and assignment of elements
of VCI.
5.2 Requirements and recommendations
5.2.1 Element management
5.2.1.1 The organization shall establish, implement and maintain processes for the management of
elements of VCI.
NOTE 1 These processes include how to nam
...