Designing a Reference Process for Regulatory Compliance: The Case of Automotive Software Update Management Systems

The implementation of regulations and industrial standards remains a significant challenge across highly regulated domains. While these mandates define what requirements must be achieved to ensure compliance, they often remain abstract regarding the how. This gap between regulatory theory and operational practice leads to inconsistent implementations, increased compliance risks, and fragmented process landscapes. Reference process models serve as an instrument to bridge this gap, providing an approach to operationalize abstract requirements into reproducible organizational workflows. This challenge is visible in the automotive industry, which is undergoing a paradigm shift toward the Software-Defined Vehicle. While this evolution enables continuous functional enhancement, it introduces significant risks
regarding functional safety and cybersecurity. Consequently, regulatory bodies have introduced mandatory requirements, most notably UN Regulation No. 156 (UNECE R156) for Software Update Management Systems (SUMS) and its supporting technical standard, ISO 24089.
This paper applies a reference process development model to the specific use case of automotive software updates. Based on an analysis of these regulatory mandates, a framework is developed to translate the abstract requirements of UN R156 and ISO 24089 into processes. The resulting description of reference process design and process retrieval offers a scalable solution for Original Equipment Manufacturers (OEMs).