The European Union — technology neutral by accident, and the only working multi-root trust list in the world.
Europe has the largest deployed V2X fleet, the most mature multi-party PKI governance, and no C-ITS delegated act. The 2019 attempt was killed by the Council on technology-neutrality grounds and has never been replaced. What filled the gap is more interesting than what was blocked.
Adopted March 2019, objected to in July 2019, never in force.
The Commission adopted a C-ITS Delegated Regulation on 13 March 2019. It never entered into force: the Council of the European Union objected in July 2019, principally on the grounds that the text favoured ITS-G5 over C-V2X. The Parliament's TRAN committee had earlier declined to object; the Council's objection was decisive.
No replacement C-ITS delegated act has been adopted as of August 2026.
Directive (EU) 2023/2661, and a legal basis for the credential system.
Directive (EU) 2023/2661 of 22 November 2023, amending the ITS Directive 2010/40/EU, entered into force 20 December 2023. It mandates digital availability of key road, travel and traffic data — speed limits, traffic circulation plans, roadworks — and requires essential safety-related services to be available to drivers along the TEN-T network.
Its significance for V2X is legal rather than technical. The CAR 2 CAR Communication Consortium's assessment is that the Directive “creates a legal basis for the already now operational EU security credential management system, which will run under the responsibility of the European Commission.” That is the anchoring the 2019 delegated act failed to deliver.
The ITS Directive Working Programme 2024–2028, Commission Implementing Decision C/2024/6798, adopted 12 November 2024, schedules C-ITS common specifications — including specifications for the EU C-ITS security credential management system — for 2024–2027. The Commission's delegated-act empowerment runs to 20 December 2028.
The transposition deadline for Directive 2023/2661 and the Annex III mandatory-data dates could not be confirmed and are therefore not stated. Adoption and entry into force are confirmed.
60 MHz, technology-neutral, with urban rail sharing the top of the band.
Commission Implementing Decision (EU) 2020/1426 of 7 October 2020 extended the ITS band from 5875–5905 MHz to 5875–5935 MHz, with member states required to designate it no later than 30 June 2021. The top 10 MHz (5925–5935) is designated on a shared basis for urban rail ITS, with at least 20 MHz harmonised for CBTC.
The decision is written technology-neutrally, explicitly acknowledging both ITS-G5 and LTE-V2X, and noting ETSI work on co-channel and adjacent-channel coexistence.
The live spectrum file in 2026 is not the ITS-G5-versus-C-V2X question but adjacent-band coexistence: Commission Implementing Decision (EU) 2025/913 of 20 May 2025 relaxed very-low-power out-of-band emissions below 5935 MHz from −45 to −37 dBm/MHz, conditional on frequency-selection mechanisms prioritising blocks above 6105 MHz, expressly to protect urban rail ITS in 5905–5935 MHz. All seven jurisdictions compared →
Governance per the C-ITS Certificate Policy, Release 3.0, May 2024.
- CPA — Certificate Policy Authority; owns the policy, authorises PKI participants, approves or rejects root CAs on audit.
- TLM — Trust List Manager; a single entity appointed by the CPA, compiling and cryptographically signing the European Certificate Trust List.
- CPOC — C-ITS Point of Contact, operated by the Joint Research Centre; receives root CA certificate submissions and publishes the ECTL. The CPOC Protocol is at Release 1.1.
- Root CAs → EA → AA → C-ITS stations. Multi-root by design; the Certificate Policy deliberately fixes no number of root CAs.
A companion C-ITS Security Policy was issued in December 2017.
This is the model we think India should adopt. Trust is a list, not a single root. That property is worth more than any technical detail in the whole architecture. Why →
ETSI ITS Release 2, and the two UNECE regulations that already bind.
ETSI ITS Release 2 is the current baseline and is actively maintained into 2026: TS 103 300-3 V2.3.1 (December 2025) for VRU awareness, TS 103 301 V2.3.1 (April 2026) for infrastructure services, TS 103 900 V2.3.1 (May 2026) for cooperative awareness, TS 103 097 V2.2.1 (March 2026) for security, and TS 103 759 V2.2.1 (January 2026) for misbehaviour reporting. Release 2 adds collective perception, VRU awareness, manoeuvre coordination and multi-channel operation over Release 1's CAM and DENM core. The message set →
UNECE R155 and R156 both entered into force January 2021. Under EU Regulation 2019/2144, R155 became mandatory for new whole-vehicle type approvals in July 2022 and extended to all new vehicles registered in the EU in July 2024. R155 requires a certified Cybersecurity Management System; R156 requires a Software Update Management System and provides the legal basis for OTA updates. They apply across the 1958 Agreement contracting parties, including the UK, Japan and South Korea. An on-board unit sits squarely inside both. What that means for the device →
C-Roads, and the largest deployed fleet in the world.
C-Roads Platform, founded 2016. Figures published on c-roads.eu, dated 19 February 2026:
- 6,000+ roadside units deployed
- 30% of the TEN-T road network covered
- 3,500+ public transport vehicles equipped
- 850+ C-Roads experts
The C-ITS Specification Release 3.2.1 was published 6 July 2026. On 26 March 2026 C-Roads formally recognised Australia's adoption of C-Roads specifications, with Queensland as an associated member — a genuinely significant development for a European harmonisation body. A C-Roads X-Test cross-border testing event is scheduled for Vienna, 20–22 October 2026. The Australian position →
C2C-CC claimed 1.5 million V2X-equipped vehicles and over 20,000 km of equipped motorway in Europe as of December 2023. Volkswagen alone passed two million Car2X-equipped vehicles produced in October 2025. Europe's installed base remains predominantly ITS-G5, with hybrid ITS-G5-plus-cellular as the C-Roads architecture. Who ships what →
Where this fits.
SCMS vs CCMS
The CCMS entity map, and the argument for a trust list over a single root.
DSRC vs C-V2X
Why Europe's installed base is on the other radio.
Message sets
ETSI Release 2, message by message and version by version.
The OEM landscape
Volkswagen's two million, and what the rest of Europe has done.
Spectrum
The 60 MHz band, and the urban rail sharing arrangement.
Test and certification
C-Roads cross-border testing and ETSI Plugtests.
Last reviewed: 17 August 2026. The C-ITS common specifications are scheduled within a 2024–2027 window; this page should be reviewed quarterly.
Questions this page answers.
Is V2X mandatory in the EU?
No. There is no fleet fitment mandate. Directive (EU) 2023/2661 mandates the digital availability of road and traffic data and requires safety-related services along the TEN-T network, but does not require vehicles to carry V2X radios.
Which technology does the EU use, ITS-G5 or C-V2X?
Both are legally permitted; the EU is formally technology-neutral, a position cemented when the Council rejected the 2019 delegated act on those grounds. The deployed installed base is overwhelmingly ITS-G5, with Volkswagen's two million Car2X vehicles the largest single contribution.
What is the ECTL?
The European Certificate Trust List — a list of approved root certificate authorities, compiled and cryptographically signed by the Trust List Manager and published by the C-ITS Point of Contact operated by the Joint Research Centre. It is what makes a multi-root V2X trust model work: a receiver trusts a certificate because its chain terminates at a root that appears on a TLM-signed list, and the whole chain resolves offline from locally held material.