Finding
OTA turns a recall into an overnight software push, but only if every update is signed, staged and reversible
Over-the-air updates deliver new software, firmware, settings and AI models to deployed machines. Done well, they turn a recall into an overnight push: Tesla fixed 98% of its 2025 recalls this way. Across the US industry, only about 15-16% of recalled vehicles in Q3 and Q4 2025 could be fixed over the air, and some OTA fixes introduced new faults - a 2025 Mustang Mach-E brake software update had to be recalled itself.
Safe OTA has a standard recipe. Packages are signed and verified by a hardware root of trust. Devices install to an inactive partition (A/B) while running the old version, then switch, with automatic rollback if checks fail. Rollouts go to a small share of the fleet first and expand as telemetry confirms health. Updates are scheduled around use - a vehicle parked and charging, a charger idle - and Europe requires a certified software-update management system (UN R156) for every new vehicle.
Artifacts
What OTA updates
| Artifact | Example | Risk |
|---|---|---|
| Application software | Infotainment, apps | Low |
| Vehicle functions | Charging logic, thermal, body | Medium |
| Safety-relevant firmware | Brakes, steering, BMS | High; needs validation |
| AI models | Driving and perception networks | High; behavior change |
| Configuration | Power limits, tariffs | Medium |
Sources
Sources and scope
- Scope
- OTA Architecture
- Sources
- NHTSA; BizzyCar Q3/Q4 2025 recall reports; Tesla; UNECE R156
- Updated
- October 2026