Porsche Killed Its Best-Selling Model Because Fixing It Cost Half a New Car

A cybersecurity law just killed Porsche's best-selling model. The company's own math explains why.

In brief:

• UN Regulations No. 155 and No. 156 became binding across the European Union on 1 July 2024, requiring an audited Cybersecurity Management System in every new vehicle.
• Porsche confirmed it will discontinue European sales of the ICE Macan, its historically top-selling regional vehicle, plus the 718 Boxster and 718 Cayman.
• Porsche stated that retrofitting the 718's electrical architecture would have consumed roughly half the budget required to design an entirely new model from scratch.

Regulatory compliance costs money. That's usually just a line item automakers absorb and move on from. What happened to Porsche in 2024 was different in kind, not just degree: a single regulation made continuing to sell an existing, profitable, popular vehicle less economically viable than simply not selling it anymore.

What UN R155 and R156 actually require

UN Regulation No. 155 requires vehicle manufacturers to demonstrate an audited, certified Cybersecurity Management System spanning the complete vehicle architecture, from initial development through production and ongoing post-production operation. UN Regulation No. 156 requires a parallel Software Update Management System, ensuring that over-the-air firmware updates can't compromise vehicle safety or quietly invalidate a car's existing type-approval. Both became legally binding for all new vehicles produced and registered across the European Union on 1 July 2024. Sell a non-compliant vehicle after that date, and the manufacturer faces fines of up to EUR 30,000 per vehicle. Both regulations sit under the broader UNECE World Forum for Harmonization of Vehicle Regulations framework, which coordinates statutory vehicle standards across UN member states.

The key detail is what counts as compliance: not a bolt-on security patch, but demonstrable, hardware-level architectural separation between safety-critical systems and everything else, encrypted communication buses throughout the vehicle, and a fully traceable, auditable software dependency structure covering the entire vehicle lifecycle.

The regulation didn't just add a cost to selling the car. It made selling the car the more expensive option.

— Marqstats Analyst Team

Why retrofitting wasn't actually an option

Both the Macan and the 718 platform were engineered years before UN R155 existed. The Macan launched in 2014, the 718 in 2016 - long before anyone was building electrical architectures around a cybersecurity certification framework that hadn't been written yet. Retrofitting that kind of hardware-level separation and encrypted bus protocol into an already-designed vehicle platform isn't a software patch. It requires re-engineering the physical electrical architecture itself.

Porsche's own public statement made the economics explicit: adapting the 718's electrical architecture to meet the new requirements would have consumed roughly half the budget required to design an entirely new model from the ground up. Given that both the Macan and the 718 were already scheduled for full battery-electric successor generations, spending that much to extend the life of a platform already headed for retirement simply didn't make financial sense.

This wasn't only a Porsche problem

Volkswagen AG faced the identical calculus and made the identical call, retiring the VW Up, the e-Up, and the Transporter T6.1 for the same underlying reason: legacy electrical architectures that couldn't be economically retrofitted to meet UN R155 and R156's requirements. Two of Germany's largest automotive brands, working from independent internal cost analyses, arrived at the same conclusion about the same category of vehicle. These are not niche vehicles - the Up and e-Up served as Volkswagen's entry-level city car offerings, meaning the affected volume across both companies extended well beyond a single low-volume specialty line.

The counter-argument: was this really about cybersecurity, or a convenient excuse to retire aging platforms?

A fair skepticism here is whether the cybersecurity regulation was the genuine cause, or whether it provided convenient legal and public-relations cover for retiring platforms that automakers wanted to phase out anyway, given that electric successors were already planned for both the Macan and the 718. This is a reasonable question to ask of any corporate statement citing regulatory compliance as the reason for a business decision. What weighs against pure convenience-framing here is the specificity of Porsche's own figure - claiming a retrofit would cost roughly half of an entirely new model's development budget is a concrete, falsifiable financial claim, not a vague regulatory complaint, and it's consistent with the genuine architectural difficulty of retrofitting hardware-level cybersecurity separation into a vehicle platform not designed for it. The timing, aligning precisely with the regulation's binding date rather than a broader product-planning cycle, also supports the stated explanation over a purely opportunistic one.

What this means for automakers and suppliers

• Automakers with legacy vehicle platforms still years from a planned successor should model UN R155/R156 retrofit costs explicitly against full redesign costs, using Porsche's roughly 50% benchmark as a starting comparison point.
• Digital twin synthesis software investment should be treated as a genuine hedge against this exact scenario, since virtual ECU testing can identify architectural compliance gaps years before a regulation's binding date, when redesign is still economically viable.
• Suppliers delivering electrical architecture components should proactively flag cybersecurity certification feasibility during early platform design, rather than leaving automakers to discover retrofit infeasibility only once a regulation takes binding effect.

The specific exemption that saved part of the 718 lineup

It's worth noting the discontinuation wasn't total. The Cayman GT4 RS and Boxster Spyder RS, the highest-performance, lowest-volume variants within the 718 lineup, were explicitly exempted from the rule due to their limited production numbers. UN R155's compliance requirements scale with production volume in certain respects, meaning a genuinely low-volume specialty variant can sometimes remain commercially viable to certify even when the broader platform it's built on cannot. This detail is instructive: it suggests the calculus isn't simply about whether a given vehicle can technically comply, but whether the volume of vehicles sold justifies the certification investment relative to that volume - a genuinely different economic threshold for a low-volume performance variant than for a mainstream production model.

This distinction matters for how other automakers might approach similar situations: a blanket platform discontinuation isn't always the only outcome available. Where a low-volume, high-margin variant exists within a broader model line facing compliance difficulty, that variant specifically may still clear the economic bar for certification even when the mainstream version does not.

Why the electric replacements were already coming regardless

Both the Macan and the 718 already had confirmed battery-electric successor generations in development before the cybersecurity regulation forced the internal combustion versions off the market early. The electric Macan was unveiled in January 2024, and the electric 718 was slated to arrive in 2025. This timing detail is genuinely relevant to understanding the decision: Porsche wasn't abandoning these nameplates entirely, it was accelerating the retirement of the outgoing combustion generation by roughly two years relative to what would have otherwise been a longer overlap period between old and new powertrains. The regulation compressed an already-planned transition timeline rather than creating an entirely unplanned one.

The full market picture

Marqstats' complete Europe automotive digital twin synthesis software market analysis, including the full regulatory landscape driving digital twin adoption, is available in the linked report below.