Car recalls have changed — here's how over-the-air fixes work

A recall once meant one thing: a physical part had failed, and the car went back to a dealership so a technician could replace it. Faulty ignition switches, cracked suspension components and rupturing airbag inflators defined the category for decades. That version of the problem has not gone away. It now shares the recall docket with defects that have no physical form at all. A modern vehicle can carry more than 100 electronic control units, each running its own software and trading data with the others over internal networks. A coding error in a battery management module can meet the federal threshold for a safety defect. So can a miscalibrated forward-facing camera, or a rearview display that fails to render an image.

The second shift is in the remedy. Tesla $TSLA built its recall response around pushing software to vehicles wirelessly. General Motors $GM, Ford $F, Rivian $RIVN and Stellantis $STLA brands have since added over-the-air update capability to newer vehicle architectures. That changes what a recall notice asks of an owner. Some defects are corrected while the car sits in a driveway overnight, connected to a cellular network, with the new code applying at the next startup. Others — a defective battery cell, a seatbelt pretensioner, a damaged wiring harness — still require a lift and a replacement part, however connected the vehicle may be.

Which category a defect falls into determines how much of an owner's day a recall costs. It also helps explain a pattern in the numbers. The count of recalled vehicles in the U.S. has not fallen as remedies have gotten faster. More software and more sensors create more points of failure, and the industry has become better at finding them. What follows sets out the main causes behind today's car recalls and how over-the-air fixes reach a parked vehicle. It also covers where wireless remedies stop working, and what the shift should mean for anyone shopping for a car.

Illustration: Quartz

Code errors, not just broken parts, now account for a meaningful portion of U.S. vehicle recall campaigns. A single flawed instruction inside one control module can change how a car brakes, steers or reports its own status, and that is enough to meet the federal definition of a safety defect.

The shift is structural. Recalls through the late 20th century centered on parts a technician could hold: a latch that would not engage, a fastener that sheared, an ignition assembly that slipped out of position. Those failures still occur. They now sit alongside defects described in the language of firmware versions and calibration files.

Scale explains much of the change. A modern vehicle can carry more than 100 electronic control units, networked together and exchanging data continuously. A module publishing bad values can produce symptoms that look mechanical — hesitation, a phantom warning, a safety feature that disengages without explanation — while the cause sits several systems away from where the driver notices it. Tracing that chain takes different diagnostic work than inspecting a suspension arm.

Regulators treat code and hardware identically on timing. The National Highway Traffic Safety Administration requires a manufacturer to report a safety defect within five business days of determining that one exists, whether the eventual remedy is a replacement part or a downloadable patch. The reporting clock often starts before owners learn how the fix will arrive, and before the automaker has settled on a delivery method.

Recall letters increasingly describe something abstract — a logic error in a named control module rather than a component a driver can picture. The seriousness does not scale down with the abstraction. A rearview camera that fails to display an image, or an assist system that brakes when nothing is in the road, carries the same regulatory weight as a cracked suspension part, because the risk to the person behind the wheel can be identical.

Illustration: Quartz

Cameras, radar units and ultrasonic sensors have created a recall category built on perception failures rather than broken parts. When a sensor misreads the road, a car can brake when it should not or fail to brake when it should, and either outcome can qualify as a safety defect.

These components feed the features drivers now take for granted: automatic emergency braking, adaptive cruise control, lane-keeping assistance and blind-spot monitoring. None of them work without a clean stream of data about what sits in front of, beside and behind the vehicle. A fogged lens, a radar return read as an obstacle that is not there or software that misclassifies a stationary object can corrupt that stream. The driver usually notices nothing until the car reacts.

Most systems blend inputs: a forward camera reading lane markings, radar measuring the distance and closing speed of the vehicle ahead. When those readings disagree, the software decides which to trust, and that judgment lives in code rather than in the hardware.

The flaw is not always present in every unit, which complicates the engineering response. Calibration can drift within manufacturing tolerances. Vehicles built on the same line may carry different software versions depending on their build date. Low-angle sun glare, heavy rain or snow packed over a sensor housing can expose a weakness in one car and never surface it in another. That inconsistency is why such defects often appear only after thousands of vehicles accumulate real mileage and generate conditions no pre-production test program anticipated.

Honda $HMC, Toyota $TM and Subaru have each issued recalls involving driver-assistance sensors and the software logic that interprets their readings. The remedy depends on where the fault sits: an error in the interpreting code can sometimes be rewritten, while a camera aimed out of tolerance needs physical recalibration with alignment equipment.

Regulators treat these campaigns as safety recalls even when the engine, brakes and steering work normally. A blind-spot monitor that misses an adjacent car, or an automatic braking system that triggers on a phantom obstacle at highway speed, changes how the vehicle behaves in traffic.

Illustration: Quartz

Lithium-ion packs, charging hardware and the software that manages both have created defect categories gasoline cars never had. One cell manufacturing flaw can trigger a recall covering every vehicle built with that supplier's cells, and the remedy is often module replacement rather than a download.

The Chevrolet Bolt EV recall shows how that works. General Motors $GM recalled the model over cells produced with a torn anode tab and a folded separator, a combination that carried fire risk, and the remedy involved replacing battery modules. No patch could reach a physical fault sealed inside a cell.

Battery sourcing explains how one factory problem reaches several badges at once. Cells from LG Energy Solution were tied to recalls at both General Motors and Hyundai, two companies with no shared vehicle platform and no connection beyond the supplier. A carmaker's recall exposure now depends partly on decisions made several steps up the supply chain, in plants it does not own.

Fire risk is not the only trigger. Charging systems that stop delivering power without warning, battery management software that miscalculates remaining range and failures in the low-voltage system that runs lights, displays and basic controls have all produced recall campaigns. A driver stranded by a charging fault faces a different hazard than one dealing with a thermal event, and a defect that strips away expected vehicle function can still qualify as a safety defect.

These problems surface on a different timeline than mechanical ones. Cell degradation and charging faults can emerge only after months of use, repeated charge cycles and seasonal temperature swings, so an electric model's defect profile may not be visible until well after the first cars reach owners.

That timing shapes what a notice asks of the owner. A battery-related campaign may call for an inspection, a diagnostic scan of pack health or a hardware swap at a service center, even on a car that handles other remedies wirelessly. Connectivity does not change what a damaged cell requires.

Illustration: Quartz

An over-the-air update is a software package delivered wirelessly to a vehicle's computer modules through a built-in cellular modem or a home Wi-Fi connection, with no dealership visit and nothing to plug in. The car downloads it much the way a phone does, usually while parked overnight.

The sequence is more deliberate than a phone update. An automaker stages a validated software version on its own servers, then releases it to a defined group of vehicles identified by build configuration and current software level. The car checks in, confirms it qualifies and pulls the package down in the background. Installation waits until the vehicle is parked and conditions are safe, and the new code takes effect at the next startup or after a restart cycle. An in-vehicle message or a mobile app notification tells the owner when an update is pending and when it has finished.

Tesla $TSLA built wireless updating into its cars from its earliest production models and was the first automaker to settle U.S. safety recalls with a download rather than a service appointment. General Motors $GM sends updates through its Ultifi software platform, and Ford $F, Rivian $RIVN and Stellantis $STLA have engineered remote update capability into their newer vehicle architectures.

What a given car can receive depends on which module needs the change and whether that controller is reachable remotely. Infotainment systems, battery management software and certain driver-assistance calibrations are common candidates. Modules wired directly to braking and steering hardware are treated more conservatively, and some architectures do not allow remote writes to them at all.

Coverage varies across model years inside a single brand. A car built without a cellular modem, or without the internal network design needed to route a software package to the correct controller, cannot take the update no matter how recently the manufacturer added the feature elsewhere in the lineup. For those vehicles, a recall notice still means a trip to the dealer.

Illustration: Quartz

If a defect lives in code, an over-the-air update can often resolve it. If it lives in a physical component, a technician still has to touch the car. Connectivity does not move that boundary.

Defects that exist entirely in software are the candidates for remote repair. A steering control algorithm that applies assist inconsistently, an infotainment module that freezes and takes the rearview camera feed down with it, a battery management routine that miscalculates remaining range — each can be corrected by sending a revised version of the code to the affected modules. Nothing physical changes in the vehicle; the module simply runs different instructions.

Physical failures leave no such option. A seatbelt pretensioner that fails to deploy, a suspension arm prone to cracking, a corroded wiring harness or a battery cell with a manufacturing flaw all require inspection and replacement by hand. The Takata airbag inflator campaign, among the largest in automotive history, shows the limit plainly. The defect was a chemical propellant that could make the inflator rupture, and only removing and replacing the hardware addressed it.

A third category sits between the two, where software governs how a physical system behaves. Cameras and their processing logic are one example — the lens and image sensor are hardware, but how firmly the car brakes in response to what they detect is a software threshold. A manufacturer may conclude that revising the logic resolves the risk on its own, or may issue a software change as an interim step while a redesigned part enters production.

The symptom rarely reveals the remedy. The recall notice states which fix applies, and the manufacturer's filing with the National Highway Traffic Safety Administration specifies whether owners face a wireless download, a service appointment or both. Two cars with similar warning behavior can carry entirely different remedies, depending on which component the investigation named as the root cause.

Illustration: Quartz

The National Highway Traffic Safety Administration reviews the remedy itself, not just the defect, and it can reject a proposed fix — including a software-only one — when the agency concludes the hazard remains. A wireless update is not a route around federal oversight.

The process runs through paperwork before it reaches any owner. After a manufacturer determines that a safety defect exists, it files a defect and noncompliance report describing the vehicles involved, the nature of the problem and the repair it intends to provide. Owner notification letters follow a federally specified format, so the notice must state what the defect is, what risk it creates and what the owner should do next. Manufacturers then file periodic reports showing how many affected vehicles have actually been repaired, which is how the agency tracks whether a remedy is reaching the fleet or stalling.

The repair must be free to the owner under the National Traffic and Motor Vehicle Safety Act, an obligation that holds whether it involves a replacement part or a downloaded patch.

Scrutiny of code-based remedies has sharpened as more of them arrive wirelessly. Tesla $TSLA's 2021 recall addressing how Autopilot responded to emergency vehicle lights came after an extended agency investigation into crashes involving stationary emergency vehicles, and the fix itself was delivered as a software update rather than a service appointment. Regulators retain the authority to keep examining whether a code change resolved what the investigation identified.

Investigators can also open inquiries on their own initiative, working from consumer complaints, warranty data and crash reports. Those inquiries sometimes end in a recall the manufacturer had not planned to announce, which is one reason a campaign can arrive long after a model has been on the road.

For an owner, the practical meaning is straightforward. A remedy that lands as a download has moved through the same federal process as one performed with tools in a service bay, and the agency can revisit it if the defect persists.

Illustration: Quartz

Faster remedies have not produced fewer recall campaigns. Over-the-air updates shorten the gap between a defect determination and a working fix, but they do not reduce the number of defects that exist in the first place. The two figures move independently, and only one has improved.

Complexity explains most of it. A car built around more than 100 networked control units has far more conditions under which something can fail than one built in the 1990s with a handful of electronically controlled systems. Every added module, sensor and line of code is another place a defect can originate, and vehicles have been gaining all three for decades.

Detection has sharpened at the same time. Connected cars send diagnostic data back to manufacturers, warranty claims are tracked in aggregate, and owner complaints feed federal defect investigations that can escalate into a recall before an automaker reaches that conclusion itself. Faults that an earlier era absorbed as scattered service visits now surface as a documented pattern. Finding more defects looks, in the published totals, identical to having more of them.

Reporting practice contributes too. An automaker that withholds a known safety defect faces civil penalties and federal scrutiny, which pushes borderline cases toward disclosure rather than away from it. A company that issues recalls often may be reporting quickly rather than building worse cars, so campaign counts are a weak measure of how a brand's vehicles actually perform. One defective supplier part shared across several brands can also generate multiple separate campaigns from a single underlying flaw.

What has changed is the owner's side of the ledger. A defect that once meant a service appointment, a loaner and a lost morning can resolve overnight in a driveway when the root cause sits in software. The remedy arrives sooner and reaches more of the affected fleet. Neither of those outcomes says anything about how many defects reach production.

Illustration: Quartz

Any owner can confirm an open recall for free by entering a 17-character vehicle identification number into the National Highway Traffic Safety Administration's lookup tool at nhtsa.gov. The result covers that individual car rather than the model line as a whole.

The VIN sits on a plate at the base of the windshield on the driver's side, readable from outside the car. The same number appears on the sticker in the driver's door jamb and on the vehicle registration.

Searching by VIN instead of year, make and model matters because campaigns are usually bounded by build dates, assembly plant or supplier lot. Two cars of the same model year built weeks apart can carry different recall status.

Each result describes the defect, the safety risk it creates and the remedy the manufacturer has filed with regulators — a software update, a replacement part, or an inspection that leads to one of the two. The remedy line is worth reading closely, since it tells an owner whether a service appointment is actually needed.

Manufacturers must mail notices to registered owners, but those letters trail the public announcement, sometimes by weeks, while parts supply and dealer instructions are worked out. Checking the database directly is faster than waiting on the mail, and it reaches owners whose address on file has gone stale.

Many automakers run their own VIN lookup on their brand sites, and connected-car apps from companies including General Motors $GM, Ford $F and Rivian $RIVN list open campaigns for a vehicle linked to the account.

Used-car buyers have reason to run the check themselves rather than relying on a seller's word or a vehicle history report, because an unrepaired campaign follows the car when it changes hands. Federal law requires manufacturers to perform safety recall repairs at no charge on vehicles less than 15 years old, no matter how many owners the car has had.

Illustration: Quartz

A wireless remedy only works if the vehicle can actually receive it, and several ordinary conditions can prevent that. A failed cellular modem, a lapsed connected-services subscription or a car left parked long enough to drain its 12-volt battery can all block delivery. Identical vehicles nearby may already be patched.

In those cases the manufacturer falls back on the traditional path. The owner is directed to a dealership, where a technician loads the same software through a wired diagnostic port. The defect gets resolved either way, but the convenience disappears, and an owner who assumed the car would handle it alone can sit on an unpatched system for months.

Network coverage introduces its own unevenness. A vehicle that spends most of its time in an underground garage can take far longer to pull down a pending update than one parked on a city street. Thin rural cellular service produces the same delay. The remedy is identical; the timeline is not.

Some campaigns pair the download with a physical step. A manufacturer may ask a technician to verify that the new version installed correctly, or to inspect a related component as a precaution. The dashboard message confirming an update finished does not always mean the recall is closed. Checking recall status by vehicle identification number after an update lands is the reliable way to see whether anything remains open.

Security sits alongside all of this. The same always-on connection that carries a fix is, in principle, a route into the systems that control the car. Automakers encrypt update channels and cryptographically sign software so a vehicle rejects any package not issued by the manufacturer. That architecture exists because remote access carries risk of its own.

Over-the-air capability shortens the distance between a defect and its repair without removing the owner from the process. Confirming that a remedy actually reached the car remains the owner's responsibility.