The Deadline Came First: Galileo OSNMA Entered EU Vehicle Rules Before the Service Was Operational

EUSPA marked one year of operational Galileo Open Service Navigation Message Authentication on 27 July. The service was declared operational on 24 July 2025.

Anniversary posts are usually the least informative genre in institutional communications. This one contains a fact worth extracting and holding up on its own: since 24 December 2025, newly registered trucks and buses within the scope of EU tachograph legislation have been required to carry the non-transitional Smart Tachograph version 2, with OSNMA functionality.

The mechanism, though, is not the one an anniversary framing suggests. This was not a capability that won adoption in five months. Commission Implementing Regulation (EU) 2021/1228 introduced the mandatory use of OSNMA by smart tachographs, amending Regulation (EU) 2016/799 to create the second version of the device. Commission Implementing Regulation (EU) 2023/980, of 16 May 2023, then set the transitional arrangement: a smart tachograph v2 without OSNMA activated was permitted for five months after the service became operational. OSNMA was declared operational on 24 July 2025. The window closed on 24 December 2025, on schedule.

So the requirement was written into EU law in 2021, four years before the capability it depends on was declared operational.

What OSNMA actually does

OSNMA embeds digital signatures into Galileo's Open Service signal. A receiver that supports it can verify that the navigation data it is reading genuinely came from Galileo, rather than from a transmitter imitating Galileo.

The precision matters. In EUSPA's own wording, the service "significantly mitigates the impact of spoofing attacks by enabling systems to identify unauthenticated navigation data". It does not prevent spoofing, and it does nothing about jamming. What it changes is that a spoofed signal can be recognised as unauthenticated rather than silently trusted. For an application where a wrong position is worse than no position, that distinction is the whole point.

It is also worth being clear about which service this is. OSNMA sits on Galileo's open service, freely available. It is not the Public Regulated Service, the access-controlled service intended for government and security users — a distinction that comes from Galileo's service architecture rather than from EUSPA's anniversary page. This is authentication for everybody, not authentication for the authorised.

The tachograph is the real signal

Smart Tachograph version 2 was, per EUSPA, the first application designed around OSNMA. And the design ran in the other direction from the usual: the regulation specified the authentication requirement, and the service had to be there to meet it.

Consider what that does to demand. A tachograph is not a discretionary purchase; it is a compliance device, and for newly registered vehicles within the tachograph regime, compliance now requires the applicable Smart Tachograph version 2 specification. The regulation converts OSNMA support from a feature a receiver manufacturer might add into part of the specification a manufacturer must meet to supply smart tachographs for that segment of the EU commercial vehicle market. In the tachograph segment, initial uptake was driven primarily by that pre-existing regulatory specification rather than by voluntary product adoption.

This is a pattern worth naming, because Europe has other space capabilities looking for routes to uptake. The mechanism was not a subsidy, a demonstrator programme or a procurement. It was a regulation that made OSNMA support part of the applicable compliance specification for smart-tachograph suppliers serving newly registered in-scope EU vehicles, in a sector with a large annual registration volume and a legal obligation to record driving time accurately. Tachograph fraud is precisely a positioning and timing problem, so the fit between capability and requirement is real rather than contrived.

It is also a harder pattern to copy than it looks. Writing a capability into a compliance regime years ahead requires confidence that the capability will be operational on time. OSNMA was. Had it slipped, the transitional arrangement would have needed extending, and the regulation would have been the thing under pressure rather than the thing driving adoption.

Who has implemented it

The GSC's manufacturer-reported device list — compiled from information the manufacturers themselves provide, and explicitly not independently tested or certified by EUSPA — includes STMicroelectronics' Teseo V and Furuno timing receivers among products implementing OSNMA. Separately, the PATROL project used a Teseo V chip in a tachograph-authentication demonstrator; STMicroelectronics is the chip supplier there, not a named consortium partner. EUSPA also highlights Qualinx, a semiconductor company, for integrating OSNMA support into a chip family aimed at wearables, asset trackers and other low-power devices. Those are different kinds of evidence and the distinction matters: a manufacturer-reported receiver list, a demonstrator project and mass-market silicon aimed at a future segment are not the same milestone.

Two EUSPA-supported activities are also worth keeping apart, because their names invite exactly the confusion this article nearly made. The PATROL project is a smart tachograph activity, using the Teseo V chip noted above. The Romanian patrol vessels are a separate matter again, and a more consequential one. Following a completed pilot of the Galileo-enabled Asset Tracking Demonstrator in the Black Sea, Romania has launched a new procurement procedure for coastal patrol vessels that includes Galileo-authenticated positioning as a requirement. The pilot is finished; the requirement has entered an active procurement procedure, not yet an operational fleet-wide mandate. One is road transport compliance; the other is maritime procurement.

The sectors EUSPA lists as using or adopting it are road transport, maritime, aviation, automotive, agriculture, professional timing and synchronisation, and mass-market devices including wearables and asset trackers. That is a broad list and, on the evidence of a single agency page, an aspirational one in places: a receiver chipset supporting OSNMA and a sector using OSNMA operationally are different claims. The tachograph case is the one with a hard requirement behind it.

What EUSPA says comes next

The agency states that future enhancements will extend authentication to GPS broadcast navigation data, moving toward what it calls a "fully authenticated positioning solution".

That is a significant direction of travel and we are reporting it as EUSPA's stated intention rather than as a plan with a date, because the page gives no timeline, no mechanism and no confirmation from the GPS side. Authenticating another constellation's navigation data is not something a European agency does unilaterally.

What to watch

Whether the tachograph pattern repeats — and on EUSPA's own account it already has, once, in a related but legally different form. Romania has included Galileo-authenticated positioning as a requirement in a new coastal patrol vessel procurement, following a completed Black Sea pilot. That is a second public-procurement-led adoption case, in a different sector, arrived at by a related but legally different route: a procurement requirement rather than a binding sector-wide regulation, and not yet an operational fleet-wide mandate. Two cases make a mechanism look deliberate. A third, in aviation surveillance or agricultural subsidy verification, would make it look like policy.

Whether receiver support reaches mass-market silicon in volume, as distinct from being available in professional receivers. EUSPA's own list mixes the two.

And whether any of the GPS authentication work acquires a date, a partner or a document. Until it does, it is a stated ambition.