DEV Community

Alex Kane
Alex Kane

Posted on

n8n for AutoTech & Connected Vehicle SaaS Vendors: 5 Automations for UN R155 CSMS, NHTSA Defect Reporting, and OTA Compliance (Free JSON)

#n8n #security #automation #programming

If you sell SaaS into the automotive supply chain, your compliance landscape just got a lot more complex.

UN Regulation No. 155 (CSMS — Cybersecurity Management System) and UN Regulation No. 156 (SUMS — Software Update Management System) became mandatory for all new vehicle type approvals in the EU from July 2024. Every OEM must demonstrate CSMS readiness — and they cascade that obligation directly to their SaaS vendors through contractual audit rights.

Layered on top: NHTSA 49 CFR Part 573 (5-business-day defect report clock), CCPA/CPRA for connected vehicle telematics data (California's proposed Vehicle Data Accountability Act treats precise location as sensitive PI), the NEVI Formula Program (97% EV charging uptime reporting), and FTC Section 5 for connected vehicle data practices.

The automation surface is large. The clocks are short. Here are five n8n workflows to cover all of it — with full JSON you can import today.

Why n8n? The UN R155/R156 Self-Hosting Argument

UN Regulation No. 156 (SUMS) requires a traceable, authorized software update chain. If you route OTA update authorization events through a cloud iPaaS — Zapier, Make, or any SaaS automation tool — that vendor becomes an undocumented node in your software update management system boundary.

When your type approval authority audits your SUMS documentation, they will ask: who authorized this OTA command, and where is the authorization log? If the answer is "Zapier's servers," you have a gap that no SLA or DPA can contractually close.

UN R155 Annex 5 Part A has the same problem for cybersecurity incident logs: CSMS evidence must be traceable. Cloud iPaaS vendor subpoenas (§512(f) equivalent in EU: GDPR Art.48 third-country transfer) create a discovery exposure vector your OEM customer's legal team will flag before signing.

Self-hosted n8n runs inside your own infrastructure boundary — OTA authorization events and CSMS incident logs never leave your network perimeter. That is the architecture argument OEM procurement and type approval auditors need to see.

Fastest Compliance Clocks

Regulation Clock Trigger
NHTSA 49 CFR §573.6 5 business days Determining a defect or noncompliance exists
PCI DSS v4.0 Req 12.10.7 24 hours Confirmed cardholder data compromise
CCPA Cal. Civ. §1798.29 72 hours Vehicle telematics data breach (location/biometric)
GDPR Art.33 72 hours Personal data breach involving EU vehicle users
UN R155 §7.3.3 Prompt Cybersecurity incident affecting CSMS
UN R156 §7.2 Immediate Unauthorized or out-of-boundary OTA update
NEVI Formula FHWA Quarterly 97% uptime reporting for EV charging operators
CCPA DSR §1798.105 45 days Vehicle data subject deletion request

Workflow 1: Tier-Segmented Customer Onboarding Drip

Seven customer tiers, each with a different compliance briefing: automakers get UN R155/R156 + NHTSA §573; Tier 1 suppliers get CSMS supply chain audit prep; fleet operators get FMCSA ELD + CCPA vehicle data; connected mobility platforms get GDPR Art.9 special category analysis; AV SaaS vendors get NHTSA AV 4.0 + state permit tracking; EV charging networks get NEVI + PCI DSS; startups get ISO/SAE 21434 + OEM partnership readiness.

{
  "name": "AutoTech SaaS \u2014 Tier-Segmented Onboarding Drip",
  "nodes": [
    {
      "name": "Daily Trigger",
      "type": "n8n-nodes-base.scheduleTrigger",
      "typeVersion": 1.1,
      "position": [
        240,
        300
      ],
      "parameters": {
        "rule": {
          "interval": [
            {
              "field": "cronExpression",
              "expression": "0 8 * * *"
            }
          ]
        }
      }
    },
    {
      "name": "Get Onboarding Customers",
      "type": "n8n-nodes-base.httpRequest",
      "typeVersion": 4.1,
      "position": [
        460,
        300
      ],
      "parameters": {
        "url": "https://your-crm.example.com/api/customers",
        "method": "GET",
        "qs": {
          "enrolled_day_in": "1,4,8"
        },
        "authentication": "headerAuth",
        "headerParameters": {
          "parameters": [
            {
              "name": "Authorization",
              "value": "Bearer {{$env.CRM_API_KEY}}"
            }
          ]
        }
      }
    },
    {
      "name": "Segment by Tier",
      "type": "n8n-nodes-base.switch",
      "typeVersion": 3,
      "position": [
        680,
        300
      ],
      "parameters": {
        "dataType": "string",
        "value1": "={{$json[\"tier\"]}}",
        "rules": {
          "rules": [
            {
              "value2": "AUTOMAKER_SAAS_VENDOR",
              "output": 0
            },
            {
              "value2": "TIER1_AUTOMOTIVE_SUPPLIER",
              "output": 1
            },
            {
              "value2": "FLEET_MANAGEMENT_SAAS",
              "output": 2
            },
            {
              "value2": "CONNECTED_MOBILITY_PLATFORM",
              "output": 3
            },
            {
              "value2": "AUTONOMOUS_VEHICLE_SAAS",
              "output": 4
            },
            {
              "value2": "EV_CHARGING_NETWORK_SAAS",
              "output": 5
            }
          ],
          "fallbackOutput": 6
        }
      }
    },
    {
      "name": "Email \u2014 Automaker (UN R155/R156 + NHTSA \u00a7573)",
      "type": "n8n-nodes-base.emailSend",
      "typeVersion": 2.1,
      "position": [
        900,
        100
      ],
      "parameters": {
        "toEmail": "={{$json[\"email\"]}}",
        "subject": "={{$json[\"company\"]}} \u2014 Your UN R155/R156 compliance automation is ready",
        "emailType": "html",
        "message": "<p>Hi {{$json[\"first_name\"]}},</p><p>Your platform is subject to <strong>UN Regulation No. 155</strong> (CSMS \u2014 Cybersecurity Management System) and <strong>UN Regulation No. 156</strong> (SUMS \u2014 Software Update Management System), mandatory for all new vehicle type approvals in the EU from July 2024.</p><p>Critical clock: NHTSA defect report <strong>5 business days</strong> (49 CFR \u00a7573.6) \u2014 cloud automation downtime creates records-accessibility gap. Your n8n workspace is ready to manage all five compliance workflows.</p><p>\u2192 <a href='https://stripeai.gumroad.com'>Get the full template bundle</a></p>"
      }
    },
    {
      "name": "Email \u2014 Tier 1 Supplier (UN R155 CSMS supply chain)",
      "type": "n8n-nodes-base.emailSend",
      "typeVersion": 2.1,
      "position": [
        900,
        220
      ],
      "parameters": {
        "toEmail": "={{$json[\"email\"]}}",
        "subject": "={{$json[\"company\"]}} \u2014 UN R155 CSMS supply chain obligations",
        "emailType": "html",
        "message": "<p>Hi {{$json[\"first_name\"]}},</p><p>UN Regulation No. 155 Annex 5 Part A requires your OEM customers to audit your CSMS before issuing type approval. Your n8n workflows automate CSMS incident logging, supplier audit evidence collection, and cybersecurity KPI reporting \u2014 all traceable within your own infrastructure, not a cloud vendor's.</p><p>\u2192 <a href='https://stripeai.gumroad.com'>Get the full template bundle</a></p>"
      }
    },
    {
      "name": "Email \u2014 Fleet (FMCSA + ELD + CCPA vehicle data)",
      "type": "n8n-nodes-base.emailSend",
      "typeVersion": 2.1,
      "position": [
        900,
        340
      ],
      "parameters": {
        "toEmail": "={{$json[\"email\"]}}",
        "subject": "={{$json[\"company\"]}} \u2014 Fleet telematics compliance automation ready",
        "emailType": "html",
        "message": "<p>Hi {{$json[\"first_name\"]}},</p><p>Your fleet management platform is subject to <strong>FMCSA 49 CFR Part 395</strong> ELD mandate, <strong>CCPA/CPRA</strong> for driver location/behavior data, and <strong>NHTSA 49 CFR Part 573</strong> defect reporting if you integrate with vehicle ECU data. Your n8n workspace automates all three deadline chains.</p><p>\u2192 <a href='https://stripeai.gumroad.com'>Get the full template bundle</a></p>"
      }
    },
    {
      "name": "Email \u2014 Mobility Platform (GDPR Art.9 + CCPA sensitive)",
      "type": "n8n-nodes-base.emailSend",
      "typeVersion": 2.1,
      "position": [
        900,
        460
      ],
      "parameters": {
        "toEmail": "={{$json[\"email\"]}}",
        "subject": "={{$json[\"company\"]}} \u2014 Connected mobility data compliance workflows",
        "emailType": "html",
        "message": "<p>Hi {{$json[\"first_name\"]}},</p><p>Precise location data from connected mobility platforms is <strong>GDPR Article 9 special category</strong> in EU courts (FCA Italy, 2023) and <strong>CCPA/CPRA sensitive personal information</strong> under Cal. Civ. \u00a71798.121. Your n8n workspace automates consent expiry tracking, erasure request pipelines (GDPR 72h Art.33 + CCPA 45-day \u00a71798.105), and quarterly data mapping reviews.</p><p>\u2192 <a href='https://stripeai.gumroad.com'>Get the full template bundle</a></p>"
      }
    },
    {
      "name": "Email \u2014 AV SaaS (NHTSA AV 4.0 + FMVSS exemption)",
      "type": "n8n-nodes-base.emailSend",
      "typeVersion": 2.1,
      "position": [
        900,
        580
      ],
      "parameters": {
        "toEmail": "={{$json[\"email\"]}}",
        "subject": "={{$json[\"company\"]}} \u2014 AV regulatory tracking workflows",
        "emailType": "html",
        "message": "<p>Hi {{$json[\"first_name\"]}},</p><p>Your autonomous vehicle platform must track <strong>NHTSA AV 4.0</strong> voluntary safety self-assessment submissions, <strong>49 CFR Part 573</strong> defect reporting (5-day clock), <strong>CA DMV AV testing permit</strong> annual renewal, and state-level AV deployment approval deadlines across 29 states. Your n8n workspace automates all regulatory deadline chains without sending AV safety data through a third-party cloud vendor.</p><p>\u2192 <a href='https://stripeai.gumroad.com'>Get the full template bundle</a></p>"
      }
    },
    {
      "name": "Email \u2014 EV Charging (NEVI + ADA + PCI DSS)",
      "type": "n8n-nodes-base.emailSend",
      "typeVersion": 2.1,
      "position": [
        900,
        700
      ],
      "parameters": {
        "toEmail": "={{$json[\"email\"]}}",
        "subject": "={{$json[\"company\"]}} \u2014 EV charging network compliance automation",
        "emailType": "html",
        "message": "<p>Hi {{$json[\"first_name\"]}},</p><p>Your EV charging network SaaS must comply with <strong>NEVI Formula Program</strong> (FHWA \u2014 97% network uptime reporting, ADA accessibility, open payment), <strong>PCI DSS v4.0</strong> for payment terminals, and <strong>CCPA/CPRA</strong> for charging session data. Your n8n workspace automates uptime reporting, PCI DSS quarterly vulnerability scans, and ADA accessibility audit deadlines.</p><p>\u2192 <a href='https://stripeai.gumroad.com'>Get the full template bundle</a></p>"
      }
    },
    {
      "name": "Email \u2014 AutoTech Startup (UN R155 pre-approval checklist)",
      "type": "n8n-nodes-base.emailSend",
      "typeVersion": 2.1,
      "position": [
        900,
        820
      ],
      "parameters": {
        "toEmail": "={{$json[\"email\"]}}",
        "subject": "={{$json[\"company\"]}} \u2014 AutoTech compliance foundation workflows",
        "emailType": "html",
        "message": "<p>Hi {{$json[\"first_name\"]}},</p><p>As an AutoTech startup, your roadmap to OEM partnerships requires demonstrating <strong>UN R155 CSMS readiness</strong> (cybersecurity management system audit evidence), <strong>ISO/SAE 21434</strong> risk assessment documentation, and <strong>CCPA/GDPR</strong> data processing agreements for any EU or CA customer vehicle data. Your n8n workspace automates evidence collection and audit-ready reporting from Day 1.</p><p>\u2192 <a href='https://stripeai.gumroad.com'>Get the full template bundle</a></p>"
      }
    }
  ],
  "connections": {
    "Daily Trigger": {
      "main": [
        [
          {
            "node": "Get Onboarding Customers",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Get Onboarding Customers": {
      "main": [
        [
          {
            "node": "Segment by Tier",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Segment by Tier": {
      "main": [
        [
          {
            "node": "Email \u2014 Automaker (UN R155/R156 + NHTSA \u00a7573)",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "Email \u2014 Tier 1 Supplier (UN R155 CSMS supply chain)",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "Email \u2014 Fleet (FMCSA + ELD + CCPA vehicle data)",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "Email \u2014 Mobility Platform (GDPR Art.9 + CCPA sensitive)",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "Email \u2014 AV SaaS (NHTSA AV 4.0 + FMVSS exemption)",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "Email \u2014 EV Charging (NEVI + ADA + PCI DSS)",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "Email \u2014 AutoTech Startup (UN R155 pre-approval checklist)",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}
Enter fullscreen mode Exit fullscreen mode

Workflow 2: Compliance Deadline Tracker

Twelve deadline types covering UN R155 CSMS annual audit, UN R156 SUMS process review, ISO/SAE 21434 TARA annual update, NHTSA AV 4.0 safety self-assessment, CCPA data mapping review, CCPA DSR response (45d), GDPR erasure request (30d), NEVI quarterly uptime report, PCI DSS vulnerability scan, SOC2 renewal, and annual pentest. Polls every 6 hours. Alerts CSM on P0/P1 deadlines within 7 days.

{
  "name": "AutoTech SaaS \u2014 Compliance Deadline Tracker",
  "nodes": [
    {
      "name": "Every 6 Hours",
      "type": "n8n-nodes-base.scheduleTrigger",
      "typeVersion": 1.1,
      "position": [
        240,
        300
      ],
      "parameters": {
        "rule": {
          "interval": [
            {
              "field": "hours",
              "minutesInterval": 6
            }
          ]
        }
      }
    },
    {
      "name": "Get Active Accounts",
      "type": "n8n-nodes-base.httpRequest",
      "typeVersion": 4.1,
      "position": [
        460,
        300
      ],
      "parameters": {
        "url": "https://your-crm.example.com/api/accounts/active",
        "authentication": "headerAuth",
        "headerParameters": {
          "parameters": [
            {
              "name": "Authorization",
              "value": "Bearer {{$env.CRM_API_KEY}}"
            }
          ]
        }
      }
    },
    {
      "name": "Get Compliance Deadlines",
      "type": "n8n-nodes-base.function",
      "typeVersion": 1,
      "position": [
        680,
        300
      ],
      "parameters": {
        "functionCode": "const deadlineTypes = [\n  { type: 'NHTSA_DEFECT_REPORT', label: 'NHTSA Defect Report (49 CFR \u00a7573.6)', horizon_days: 5, priority: 'P0', flags: ['NHTSA_DEFECT_REPORTING'] },\n  { type: 'UN_R155_CSMS_AUDIT', label: 'UN R155 CSMS Annual Audit', horizon_days: 30, priority: 'P1', flags: ['UN_R155_CSMS_SUBJECT'] },\n  { type: 'UN_R156_SUMS_REVIEW', label: 'UN R156 SUMS OTA Process Review', horizon_days: 30, priority: 'P1', flags: ['UN_R156_SUMS_SUBJECT'] },\n  { type: 'ISO_SAE_21434_TARA', label: 'ISO/SAE 21434 TARA Annual Update', horizon_days: 90, priority: 'P1', flags: ['UN_R155_CSMS_SUBJECT'] },\n  { type: 'NHTSA_AV_SAFETY_SELF_ASSESSMENT', label: 'NHTSA AV 4.0 Safety Self-Assessment', horizon_days: 365, priority: 'P2', flags: ['AUTONOMOUS_MODE_ACTIVE'] },\n  { type: 'CCPA_DATA_MAPPING_REVIEW', label: 'CCPA Vehicle Data Mapping Review', horizon_days: 90, priority: 'P1', flags: ['CCPA_VEHICLE_DATA'] },\n  { type: 'CCPA_DSR_RESPONSE', label: 'CCPA Data Subject Request (45d Cal. Civ. \u00a71798.105)', horizon_days: 45, priority: 'P1', flags: ['CCPA_VEHICLE_DATA'] },\n  { type: 'GDPR_ERASURE_REQUEST', label: 'GDPR Erasure Request (30d Art.17)', horizon_days: 30, priority: 'P1', flags: ['CCPA_VEHICLE_DATA'] },\n  { type: 'NEVI_UPTIME_QUARTERLY', label: 'NEVI Formula 97% Uptime Report (quarterly)', horizon_days: 90, priority: 'P1', flags: ['EV_CHARGING_NEVI'] },\n  { type: 'PCI_DSS_VULNERABILITY_SCAN', label: 'PCI DSS Quarterly ASV Scan', horizon_days: 90, priority: 'P1', flags: ['PCI_DSS_REQUIRED'] },\n  { type: 'SOC2_TYPE2_RENEWAL', label: 'SOC2 Type II Annual Renewal', horizon_days: 30, priority: 'P2', flags: ['SOC2_REQUIRED'] },\n  { type: 'ANNUAL_PENTEST', label: 'Annual Penetration Test', horizon_days: 30, priority: 'P2', flags: [] }\n];\nconst items = $input.all();\nconst output = [];\nconst today = new Date();\nfor (const item of items) {\n  const account = item.json;\n  for (const dt of deadlineTypes) {\n    if (dt.flags.length > 0 && !dt.flags.some(f => account.compliance_flags?.includes(f))) continue;\n    const dueDate = new Date(account.deadlines?.[dt.type] || Date.now() + dt.horizon_days * 86400000);\n    const daysLeft = Math.round((dueDate - today) / 86400000);\n    if (daysLeft <= dt.horizon_days && daysLeft >= 0) {\n      output.push({ json: { account_id: account.id, company: account.company, email: account.csm_email, deadline_type: dt.type, label: dt.label, days_left: daysLeft, priority: dt.priority, due_date: dueDate.toISOString().split('T')[0] } });\n    }\n  }\n}\nreturn output;"
      }
    },
    {
      "name": "Filter Urgent (<=7d P0/P1)",
      "type": "n8n-nodes-base.if",
      "typeVersion": 2,
      "position": [
        900,
        300
      ],
      "parameters": {
        "conditions": {
          "options": {
            "combinator": "and"
          },
          "conditions": [
            {
              "id": "1",
              "leftValue": "={{$json[\"days_left\"]}}",
              "rightValue": 7,
              "operator": {
                "type": "number",
                "operation": "lte"
              }
            },
            {
              "id": "2",
              "leftValue": "={{$json[\"priority\"]}}",
              "rightValue": "P2",
              "operator": {
                "type": "string",
                "operation": "notEqual"
              }
            }
          ]
        }
      }
    },
    {
      "name": "Alert CSM",
      "type": "n8n-nodes-base.emailSend",
      "typeVersion": 2.1,
      "position": [
        1120,
        220
      ],
      "parameters": {
        "toEmail": "={{$json[\"email\"]}}",
        "subject": "={{$json[\"priority\"]}} \u2014 {{$json[\"label\"]}} due in {{$json[\"days_left\"]}} days ({{$json[\"company\"]}})",
        "emailType": "html",
        "message": "<p><strong>Compliance deadline approaching:</strong></p><ul><li><strong>Account:</strong> {{$json[\"company\"]}}</li><li><strong>Deadline:</strong> {{$json[\"label\"]}}</li><li><strong>Due:</strong> {{$json[\"due_date\"]}} ({{$json[\"days_left\"]}} days)</li><li><strong>Priority:</strong> {{$json[\"priority\"]}}</li></ul>"
      }
    }
  ],
  "connections": {
    "Every 6 Hours": {
      "main": [
        [
          {
            "node": "Get Active Accounts",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Get Active Accounts": {
      "main": [
        [
          {
            "node": "Get Compliance Deadlines",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Get Compliance Deadlines": {
      "main": [
        [
          {
            "node": "Filter Urgent (<=7d P0/P1)",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Filter Urgent (<=7d P0/P1)": {
      "main": [
        [
          {
            "node": "Alert CSM",
            "type": "main",
            "index": 0
          }
        ],
        []
      ]
    }
  }
}
Enter fullscreen mode Exit fullscreen mode

Workflow 3: Vehicle Platform API Health Monitor

Five endpoints: CSMS incident API (UN R155 §7.3.3 audit evidence), OTA update authorization API (UN R156 SUMS boundary), NHTSA defect reporting API (§573.6 5-day clock risk), vehicle telematics API (CCPA/CPRA sensitive PI pipeline), and EV charging network API (NEVI 97% uptime). Runs every 15 minutes. Deduplicates with $getWorkflowStaticData — only pages on state change, not every poll.

{
  "name": "AutoTech SaaS \u2014 Vehicle Platform API Health Monitor",
  "nodes": [
    {
      "name": "Every 15 Minutes",
      "type": "n8n-nodes-base.scheduleTrigger",
      "typeVersion": 1.1,
      "position": [
        240,
        300
      ],
      "parameters": {
        "rule": {
          "interval": [
            {
              "field": "minutes",
              "minutesInterval": 15
            }
          ]
        }
      }
    },
    {
      "name": "Check Endpoints",
      "type": "n8n-nodes-base.function",
      "typeVersion": 1,
      "position": [
        460,
        300
      ],
      "parameters": {
        "functionCode": "const endpoints = [\n  { name: 'csms_incident_api', url: 'https://your-platform.example.com/api/csms/health', compliance: 'UN R155 \u00a77.3.3 \u2014 DOWN = CSMS incident logging gap, Annex 5 audit evidence loss' },\n  { name: 'ota_update_authorization_api', url: 'https://your-platform.example.com/api/ota/health', compliance: 'UN R156 \u00a77.2 \u2014 DOWN = SUMS OTA authorization chain broken, unauthorized update risk' },\n  { name: 'nhtsa_defect_reporting_api', url: 'https://your-platform.example.com/api/defect/health', compliance: 'NHTSA 49 CFR \u00a7573.6 \u2014 DOWN = 5-business-day defect report window at risk' },\n  { name: 'vehicle_telematics_api', url: 'https://your-platform.example.com/api/telematics/health', compliance: 'CCPA/CPRA Cal. Civ. \u00a71798.121 \u2014 DOWN = vehicle location/behavior data pipeline interruption, consent audit gap' },\n  { name: 'ev_charging_network_api', url: 'https://your-platform.example.com/api/charging/health', compliance: 'NEVI Formula FHWA \u2014 DOWN = 97% uptime SLA violation, quarterly uptime report discrepancy' }\n];\nreturn endpoints.map(e => ({ json: e }));"
      }
    },
    {
      "name": "HTTP Health Check",
      "type": "n8n-nodes-base.httpRequest",
      "typeVersion": 4.1,
      "position": [
        680,
        300
      ],
      "parameters": {
        "url": "={{$json[\"url\"]}}",
        "method": "GET",
        "options": {
          "timeout": 10000,
          "response": {
            "response": {
              "neverError": true
            }
          }
        }
      }
    },
    {
      "name": "Check Static Data (dedup)",
      "type": "n8n-nodes-base.function",
      "typeVersion": 1,
      "position": [
        900,
        300
      ],
      "parameters": {
        "functionCode": "const state = $getWorkflowStaticData('global');\nconst key = `${$json.name}_status`;\nconst prevStatus = state[key] || 'unknown';\nconst currStatus = $('HTTP Health Check').item.json.statusCode < 400 ? 'ok' : 'down';\nif (currStatus === prevStatus) return [];\nstate[key] = currStatus;\nif (currStatus === 'down') {\n  return [{ json: { ...$json, status: currStatus, compliance_note: $json.compliance } }];\n}\nreturn [];"
      }
    },
    {
      "name": "Alert On-Call + Engineering",
      "type": "n8n-nodes-base.emailSend",
      "typeVersion": 2.1,
      "position": [
        1120,
        300
      ],
      "parameters": {
        "toEmail": "oncall@your-company.example.com",
        "subject": "CRITICAL \u2014 {{$json[\"name\"]}} DOWN \u2014 {{$json[\"compliance_note\"]}}",
        "emailType": "html",
        "message": "<p><strong>AutoTech Platform Health Alert</strong></p><ul><li><strong>Endpoint:</strong> {{$json[\"name\"]}}</li><li><strong>URL:</strong> {{$json[\"url\"]}}</li><li><strong>Compliance Risk:</strong> {{$json[\"compliance_note\"]}}</li><li><strong>Detected:</strong> {{$now}}</li></ul>"
      }
    }
  ],
  "connections": {
    "Every 15 Minutes": {
      "main": [
        [
          {
            "node": "Check Endpoints",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Check Endpoints": {
      "main": [
        [
          {
            "node": "HTTP Health Check",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "HTTP Health Check": {
      "main": [
        [
          {
            "node": "Check Static Data (dedup)",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Check Static Data (dedup)": {
      "main": [
        [
          {
            "node": "Alert On-Call + Engineering",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}
Enter fullscreen mode Exit fullscreen mode

Workflow 4: Automotive Compliance Incident Pipeline

Eight incident types. NHTSA defect discovered triggers immediate P0 with §573.6 5-business-day language and NHTSA reporting URL. UN R155 cyber incident triggers CSMS response chain. UN R156 unauthorized OTA triggers SUMS boundary alert. CCPA vehicle data breach triggers 72h notification clock. GDPR data breach triggers Art.33 supervisory authority notification. NEVI uptime breach triggers FHWA quarterly report flag. PCI DSS payment incident triggers card brand 24h notification.

{
  "name": "AutoTech SaaS \u2014 Compliance Incident Pipeline",
  "nodes": [
    {
      "name": "Webhook: Incident Received",
      "type": "n8n-nodes-base.webhook",
      "typeVersion": 2,
      "position": [
        240,
        300
      ],
      "parameters": {
        "path": "autotech-incident",
        "httpMethod": "POST"
      }
    },
    {
      "name": "Route by Incident Type",
      "type": "n8n-nodes-base.switch",
      "typeVersion": 3,
      "position": [
        460,
        300
      ],
      "parameters": {
        "dataType": "string",
        "value1": "={{$json[\"incident_type\"]}}",
        "rules": {
          "rules": [
            {
              "value2": "NHTSA_DEFECT_DISCOVERED",
              "output": 0
            },
            {
              "value2": "UN_R155_CYBER_INCIDENT",
              "output": 1
            },
            {
              "value2": "UN_R156_UNAUTHORIZED_OTA",
              "output": 2
            },
            {
              "value2": "CCPA_DATA_BREACH_VEHICLE",
              "output": 3
            },
            {
              "value2": "GDPR_DATA_BREACH",
              "output": 4
            },
            {
              "value2": "NEVI_UPTIME_SLA_BREACH",
              "output": 5
            },
            {
              "value2": "PCI_DSS_PAYMENT_INCIDENT",
              "output": 6
            }
          ],
          "fallbackOutput": 7
        }
      }
    },
    {
      "name": "NHTSA Defect \u2014 5BD Clock (49 CFR \u00a7573.6)",
      "type": "n8n-nodes-base.emailSend",
      "typeVersion": 2.1,
      "position": [
        700,
        60
      ],
      "parameters": {
        "toEmail": "legal@your-company.example.com",
        "ccEmail": "cto@your-company.example.com",
        "subject": "P0 NHTSA DEFECT REPORT \u2014 5 Business Day Clock Started \u2014 49 CFR \u00a7573.6",
        "emailType": "html",
        "message": "<p><strong>CRITICAL: NHTSA Defect Report Required</strong></p><p>49 CFR \u00a7573.6(a) \u2014 report must be submitted to NHTSA within <strong>5 business days</strong> of determining a defect exists. Failure: civil penalty up to $22,194/day, $111M cap (49 USC \u00a730165).</p><p><strong>Defect:</strong> {{$json[\"description\"]}}<br><strong>VINs Affected:</strong> {{$json[\"vin_count\"]}}<br><strong>Discovery Date:</strong> {{$now}}</p><p>Report via: https://www.nhtsa.gov/reporting-a-safety-defect</p>"
      }
    },
    {
      "name": "UN R155 Cyber Incident \u2014 CSMS Response",
      "type": "n8n-nodes-base.emailSend",
      "typeVersion": 2.1,
      "position": [
        700,
        180
      ],
      "parameters": {
        "toEmail": "ciso@your-company.example.com",
        "ccEmail": "legal@your-company.example.com",
        "subject": "P0 UN R155 CSMS Cyber Incident \u2014 Type Approval Authority Notification Required",
        "emailType": "html",
        "message": "<p><strong>UN Regulation No. 155 Cybersecurity Incident</strong></p><p>UN R155 \u00a77.3.3 requires OEMs to report cybersecurity incidents to the type approval authority. As a SaaS vendor in the supply chain, notify your OEM customer within your contractual SLA window \u2014 they carry the regulatory obligation upstream.</p><p><strong>Incident:</strong> {{$json[\"description\"]}}<br><strong>CSMS Impact:</strong> {{$json[\"csms_scope\"]}}<br><strong>Detected:</strong> {{$now}}</p>"
      }
    },
    {
      "name": "UN R156 Unauthorized OTA \u2014 SUMS Boundary Alert",
      "type": "n8n-nodes-base.emailSend",
      "typeVersion": 2.1,
      "position": [
        700,
        300
      ],
      "parameters": {
        "toEmail": "engineering@your-company.example.com",
        "ccEmail": "ciso@your-company.example.com",
        "subject": "P0 UN R156 SUMS VIOLATION \u2014 Unauthorized OTA Update Detected",
        "emailType": "html",
        "message": "<p><strong>UN R156 Software Update Management System Violation</strong></p><p>UN Regulation No. 156 \u00a77.2 requires that software updates are authorized, traceable, and applied only within the defined SUMS boundary. An unauthorized or out-of-boundary update triggers type approval review.</p><p><strong>Vehicle:</strong> {{$json[\"vin\"]}}<br><strong>Software Version:</strong> {{$json[\"sw_version\"]}}<br><strong>Alert:</strong> {{$json[\"description\"]}}<br><strong>Timestamp:</strong> {{$now}}</p>"
      }
    },
    {
      "name": "CCPA Vehicle Data Breach \u2014 72h Clock",
      "type": "n8n-nodes-base.emailSend",
      "typeVersion": 2.1,
      "position": [
        700,
        420
      ],
      "parameters": {
        "toEmail": "legal@your-company.example.com",
        "subject": "P0 CCPA VEHICLE DATA BREACH \u2014 72h Notification Clock (Cal. Civ. \u00a71798.29)",
        "emailType": "html",
        "message": "<p><strong>CCPA/CPRA Connected Vehicle Data Breach</strong></p><p>Cal. Civ. \u00a71798.29 \u2014 notify affected California residents within <strong>72 hours</strong> if breach involves location, biometric (driver monitoring), or other sensitive vehicle telematics data (\u00a71798.121 sensitive PI).</p><p><strong>Data Type:</strong> {{$json[\"data_type\"]}}<br><strong>Vehicles Affected:</strong> {{$json[\"count\"]}}<br><strong>Breach Detected:</strong> {{$now}}</p>"
      }
    },
    {
      "name": "GDPR Data Breach \u2014 72h Art.33",
      "type": "n8n-nodes-base.emailSend",
      "typeVersion": 2.1,
      "position": [
        700,
        540
      ],
      "parameters": {
        "toEmail": "dpo@your-company.example.com",
        "subject": "P0 GDPR VEHICLE DATA BREACH \u2014 72h Supervisory Authority (Art.33)",
        "emailType": "html",
        "message": "<p><strong>GDPR Article 33 \u2014 Supervisory Authority Notification Required</strong></p><p>Connected vehicle location data = GDPR special category (precise geolocation per Art.4(1) definition). Notify your lead DPA within <strong>72 hours</strong>. Document: nature of breach, categories/volume of data, likely consequences, measures taken.</p><p><strong>Description:</strong> {{$json[\"description\"]}}<br><strong>EU Users Affected:</strong> {{$json[\"count\"]}}<br><strong>Detected:</strong> {{$now}}</p>"
      }
    },
    {
      "name": "NEVI Uptime Breach \u2014 FHWA Report",
      "type": "n8n-nodes-base.emailSend",
      "typeVersion": 2.1,
      "position": [
        700,
        660
      ],
      "parameters": {
        "toEmail": "ops@your-company.example.com",
        "subject": "P1 NEVI UPTIME SLA BREACH \u2014 FHWA 97% Quarterly Target",
        "emailType": "html",
        "message": "<p><strong>NEVI Formula Program Uptime Violation</strong></p><p>FHWA NEVI Formula Program requires 97% network uptime. Failure triggers FHWA grant condition review and potential clawback for state DOT-contracted EVSE operators.</p><p><strong>Station:</strong> {{$json[\"station_id\"]}}<br><strong>Downtime:</strong> {{$json[\"downtime_minutes\"]}} minutes<br><strong>Detected:</strong> {{$now}}</p>"
      }
    },
    {
      "name": "PCI DSS Payment Incident",
      "type": "n8n-nodes-base.emailSend",
      "typeVersion": 2.1,
      "position": [
        700,
        780
      ],
      "parameters": {
        "toEmail": "security@your-company.example.com",
        "subject": "P0 PCI DSS PAYMENT INCIDENT \u2014 Card Brand Notification 24h",
        "emailType": "html",
        "message": "<p><strong>PCI DSS v4.0 Payment Security Incident</strong></p><p>PCI DSS Req 12.10.7 \u2014 notify your acquiring bank and relevant card brands within <strong>24 hours</strong> of confirmed cardholder data compromise. Applies to EV charging payment terminals and in-vehicle payment integrations.</p><p><strong>Incident:</strong> {{$json[\"description\"]}}<br><strong>Detected:</strong> {{$now}}</p>"
      }
    },
    {
      "name": "General Incident \u2014 Log + Triage",
      "type": "n8n-nodes-base.emailSend",
      "typeVersion": 2.1,
      "position": [
        700,
        900
      ],
      "parameters": {
        "toEmail": "compliance@your-company.example.com",
        "subject": "AutoTech Compliance Incident \u2014 {{$json[\"incident_type\"]}} \u2014 Triage Required",
        "emailType": "html",
        "message": "<p><strong>Unclassified AutoTech Compliance Incident</strong></p><p><strong>Type:</strong> {{$json[\"incident_type\"]}}<br><strong>Description:</strong> {{$json[\"description\"]}}<br><strong>Received:</strong> {{$now}}</p>"
      }
    }
  ],
  "connections": {
    "Webhook: Incident Received": {
      "main": [
        [
          {
            "node": "Route by Incident Type",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Route by Incident Type": {
      "main": [
        [
          {
            "node": "NHTSA Defect \u2014 5BD Clock (49 CFR \u00a7573.6)",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "UN R155 Cyber Incident \u2014 CSMS Response",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "UN R156 Unauthorized OTA \u2014 SUMS Boundary Alert",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "CCPA Vehicle Data Breach \u2014 72h Clock",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "GDPR Data Breach \u2014 72h Art.33",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "NEVI Uptime Breach \u2014 FHWA Report",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "PCI DSS Payment Incident",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "General Incident \u2014 Log + Triage",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}
Enter fullscreen mode Exit fullscreen mode

Workflow 5: Weekly AutoTech KPI Report

Monday 8AM report to CEO + CTO BCC Compliance. Covers all seven customer tiers (accounts + MRR), five compliance flags (UN R155/R156/NHTSA/CCPA vehicle data/AV active), open incidents (NHTSA reports/breach reports/R155 incidents/NEVI violations), and upcoming deadlines in the next 30 days.

{
  "name": "AutoTech SaaS \u2014 Weekly KPI Report",
  "nodes": [
    {
      "name": "Every Monday 8AM",
      "type": "n8n-nodes-base.scheduleTrigger",
      "typeVersion": 1.1,
      "position": [
        240,
        300
      ],
      "parameters": {
        "rule": {
          "interval": [
            {
              "field": "cronExpression",
              "expression": "0 8 * * 1"
            }
          ]
        }
      }
    },
    {
      "name": "Fetch KPI Data",
      "type": "n8n-nodes-base.httpRequest",
      "typeVersion": 4.1,
      "position": [
        460,
        300
      ],
      "parameters": {
        "url": "https://your-crm.example.com/api/kpis/weekly",
        "authentication": "headerAuth",
        "headerParameters": {
          "parameters": [
            {
              "name": "Authorization",
              "value": "Bearer {{$env.CRM_API_KEY}}"
            }
          ]
        }
      }
    },
    {
      "name": "Build KPI Report",
      "type": "n8n-nodes-base.function",
      "typeVersion": 1,
      "position": [
        680,
        300
      ],
      "parameters": {
        "functionCode": "const d = $input.first().json;\nconst html = `\n<h2>AutoTech SaaS \u2014 Weekly Compliance KPI</h2>\n<h3>Customer Segments</h3>\n<table border='1' cellpadding='6'>\n<tr><th>Tier</th><th>Accounts</th><th>MRR</th></tr>\n<tr><td>Automaker SaaS Vendors</td><td>${d.tier_automaker || 0}</td><td>$${d.mrr_automaker || 0}</td></tr>\n<tr><td>Tier 1 Suppliers</td><td>${d.tier_tier1 || 0}</td><td>$${d.mrr_tier1 || 0}</td></tr>\n<tr><td>Fleet Management</td><td>${d.tier_fleet || 0}</td><td>$${d.mrr_fleet || 0}</td></tr>\n<tr><td>Connected Mobility</td><td>${d.tier_mobility || 0}</td><td>$${d.mrr_mobility || 0}</td></tr>\n<tr><td>AV SaaS</td><td>${d.tier_av || 0}</td><td>$${d.mrr_av || 0}</td></tr>\n<tr><td>EV Charging</td><td>${d.tier_ev || 0}</td><td>$${d.mrr_ev || 0}</td></tr>\n<tr><td>AutoTech Startups</td><td>${d.tier_startup || 0}</td><td>$${d.mrr_startup || 0}</td></tr>\n<tr><td><strong>Total</strong></td><td><strong>${d.total_accounts || 0}</strong></td><td><strong>$${d.total_mrr || 0}</strong></td></tr>\n</table>\n<h3>Compliance Flags</h3>\n<ul>\n<li>UN R155 CSMS Subject: ${d.flag_un_r155 || 0}</li>\n<li>UN R156 SUMS Subject: ${d.flag_un_r156 || 0}</li>\n<li>NHTSA Defect Reporting: ${d.flag_nhtsa || 0}</li>\n<li>CCPA Vehicle Data: ${d.flag_ccpa_vehicle || 0}</li>\n<li>Autonomous Mode Active: ${d.flag_av_active || 0}</li>\n</ul>\n<h3>Open Incidents</h3>\n<ul>\n<li>NHTSA Defect Reports Open: ${d.nhtsa_open || 0}</li>\n<li>CCPA/GDPR Breach Reports Open: ${d.breach_open || 0}</li>\n<li>UN R155 Cyber Incidents Open: ${d.r155_incidents_open || 0}</li>\n<li>NEVI Uptime Violations Open: ${d.nevi_violations_open || 0}</li>\n</ul>\n<h3>Upcoming Deadlines (30d)</h3>\n<ul>\n<li>UN R155 CSMS Audits Due: ${d.r155_audits_due_30d || 0}</li>\n<li>CCPA DSR Deadlines: ${d.ccpa_dsr_due || 0}</li>\n<li>NEVI Quarterly Reports: ${d.nevi_reports_due || 0}</li>\n<li>PCI DSS Scans Due: ${d.pci_scans_due || 0}</li>\n</ul>\n`;\nreturn [{ json: { html, subject: 'AutoTech SaaS \u2014 Weekly Compliance KPI \u2014 ' + new Date().toISOString().split('T')[0] } }];"
      }
    },
    {
      "name": "Send to CEO + COO",
      "type": "n8n-nodes-base.emailSend",
      "typeVersion": 2.1,
      "position": [
        900,
        300
      ],
      "parameters": {
        "toEmail": "ceo@your-company.example.com",
        "ccEmail": "cto@your-company.example.com",
        "bccEmail": "compliance@your-company.example.com",
        "subject": "={{$json[\"subject\"]}}",
        "emailType": "html",
        "message": "={{$json[\"html\"]}}"
      }
    }
  ],
  "connections": {
    "Every Monday 8AM": {
      "main": [
        [
          {
            "node": "Fetch KPI Data",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Fetch KPI Data": {
      "main": [
        [
          {
            "node": "Build KPI Report",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Build KPI Report": {
      "main": [
        [
          {
            "node": "Send to CEO + COO",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}
Enter fullscreen mode Exit fullscreen mode

Self-Hosting Rationale by Regulation

Regulation Cloud iPaaS Risk Self-Hosted n8n Fix
UN R156 SUMS OTA authorization log outside SUMS boundary Authorization events stay inside your SUMS perimeter
UN R155 CSMS Incident log gap — vendor subpoena = CSMS evidence loss CSMS incident chain entirely within your network
NHTSA §573.6 Cloud downtime during 5-day reporting window On-prem n8n runs inside your infrastructure — no SLA dependency
CCPA/CPRA §1798.121 Cloud vendor = unauthorized subprocessor for sensitive vehicle telematics Data mapping and consent workflows run in your own perimeter
GDPR Art.33 Third-country transfer risk (GDPR Art.48) via cloud vendor All EU vehicle user data processing stays within EU boundary

Get All 15 Templates

These five workflows are part of the FlowKit n8n Automation Bundle — 15 production-ready templates for SaaS compliance automation across regulated verticals.

→ Download the full bundle at stripeai.gumroad.com

Each template includes the complete workflow JSON, a setup guide, and configuration notes. Import directly into your n8n instance.

Top comments (0)