Your Hardware Just Shipped a Serious Defect — Now What? The GAC Toyota bZ7 Was Recalled Twice in Under 100 Days, Both Times for Software

On August 1, GAC Toyota filed two recall notices.

The first, S2026M0083V, covers 15,266 bZ7s. The stated cause reads: the smart Bluetooth module’s software control program was insufficiently considered, and under certain conditions may send an abnormal command to the vehicle control module, causing the car to shift automatically from D to N while driving.

The second, S2026M0084V, covers 24,286 bZ7s. The stated cause: the thermal management controller’s software control strategy is incomplete, and after the vehicle powers on, the A/C compressor and water heater may stop working. In extreme cases defrost and defog performance degrades, obstructing the driver’s view.

That is 39,552 cars. The bZ7 had been on sale for less than 100 days.

The remedy on both notices is the same sentence: a free over-the-air software update, no dealer visit required.

The other three notices that month need hands on metal

From August 8, two Jaguar Land Rover recalls take effect together. S2026M0080V covers 76,422 imported Range Rover and Discovery vehicles; S2026M0081V covers 83,810 Defenders. Total: 160,232. The defect is fretting corrosion at the connector between the steering wheel clock spring and the driver’s airbag, raising circuit resistance and potentially preventing the driver’s airbag from deploying. The remedy is applying a special grease to the connector terminals, free of charge.

From August 28, S2026M0082V recalls 33,473 XPeng X9s. Manufacturing process variation reduced the airtightness of the front air springs; after long use in hot, humid conditions they may leak slowly, and in extreme cases handling is affected. The remedy is a free replacement of the improved front air spring strut assembly.

Put all five side by side:

The top three rows mean more than 190,000 cars driving into service bays one at a time — lifts, labor hours, parts, customer appointments, all of it real. The bottom two rows are 39,552 cars and an engineer publishing an update package.

The wording of defect causes is changing: from “corrosion” to “insufficiently considered”

Read through two months of recall notices and the vocabulary of classic hardware defects is a fixed set: corrosion, metal fatigue, cracking, insufficient design strength, half-shafts of the wrong size fitted to the front axle, lithium growth inside the cell. Harley-Davidson’s batch reads “the upper triple clamp material strength is insufficiently designed, and cracks may form at stress concentrations.” Volvo’s EX30 batch reads “production variation may cause lithium growth inside the cell.”

The new vocabulary is a different set: insufficiently considered, incomplete strategy, improperly configured. In the same run of notices, FAW Toyota recalled 9,408 Prados because “the combination meter control program was improperly configured, and at vehicle start the combination meter may fail to start correctly.”

“The smart Bluetooth module’s software control program was insufficiently considered,” translated into what a software team says every day, means a boundary condition never made it into the check. In a requirements review that is one line of minutes reading “let’s not handle that case for now.” In a recall notice it is 15,266 cars.

Of 1,904 OTA updates in 2025, only 13 counted as recalls

SAMR’s 2025 figures: 190 vehicle recalls nationwide covering 6.846 million vehicles, down 18.5% and 39.1% year over year. Of those, 13 recalls were carried out over the air, covering 1.756 million vehicles — 25.7% of all vehicles recalled that year.

In the same year, manufacturers reported 1,904 OTA updates covering 140 million vehicle-instances, with the number of updates up 38% from the year before.

1,904 and 13. The overwhelming majority of OTAs add features, tune the experience, fix small annoyances. Thirteen were classified as recalls. Where that line gets drawn is the most expensive judgment in this whole business — on one side is product iteration, on the other is a defect recall that must be filed with the regulator, that stops production and sales, and that lands in the annual statistics.

The March 2025 joint notice from MIIT and SAMR draws it explicitly: “Where an enterprise carries out an OTA update to eliminate a defect in an automotive product and implement a recall, it shall organize the recall in accordance with the Implementing Measures for the Regulations on the Recall of Defective Automobile Products, and immediately halt production and sale of the defective product.” The same document adds a line aimed squarely at the temptation: standardize how OTA updates are applied, so that enterprises do not use them to conceal vehicle defects or evade responsibility.

OTA has crushed the cost of a fix from “190,000 cars through service bays” down to “publish one package,” and it has not removed a single filing obligation. Being able to change it remotely does not mean you may change it quietly.

After a defect is confirmed: ten working days, three months, 1% to 10% of value

A recall does not start on the day the notice goes public. It starts on the day someone concludes a defect may exist.

For vehicles, the Regulations on the Recall of Defective Automobile Products require the manufacturer to file a recall plan with the competent authority before carrying out the recall. Hardware that isn’t a car falls under the Interim Provisions on the Administration of Consumer Product Recalls, which spell the clock out in more detail. Article 9: where a producer discovers that a consumer product may be defective, it shall immediately organize an investigation and analysis. Article 17: for a voluntary recall, the producer shall report the recall plan to the provincial market regulator within ten working days of the investigation concluding that a defect exists. Article 21: an interim summary every three months from the start of the recall, and a final summary within fifteen working days of completing the plan.

The penalty column differs by an order of magnitude. Article 24 of the vehicle regulation sets fines at 1% to 10% of the value of the defective automotive products, with license revocation in serious cases; Article 23 sets 500,000 to 1,000,000 yuan for failing to cooperate with a defect investigation and refusing to correct. Article 25 of the consumer product provisions sets 10,000 to 30,000 yuan for failing to correct in time.

Which makes the hardest move in the chain not the fix but the classification — whether anyone will call it a defect. Of the 190 recalls in 2025, 55 were carried out under SAMR prompting, covering 2.934 million vehicles, or 42.9% of all vehicles recalled that year. By unit count, nearly half the cars were not raised by the manufacturer’s own hand.

The fix, the public statement and the compensation package can all be ready inside 48 hours. What stalls is always the step before: someone has to sign off that this is a defect.

On my side, the worst case is a rollback

I build software, not hardware. When something breaks in production, the worst night I have had ends with rolling back a release and writing the postmortem the next morning. The cost to users is a few hours of not being able to use the thing, or a batch of data that has to be reimported. I can afford that, which is why “ship it and fix it later” almost never required hesitation from me.

The bZ7 notice says the car may shift automatically from D to N while driving. Same species of mistake — a control path with a case left out — and on my side it ends in a rollback, on theirs someone loses power on the road.

Once software defines hardware, the worst outcome of one commit goes from “the user restarts the app” to a public notice with a filing number, a unit count and a regulator’s stamp. And the people writing that logic still carry software habits: ship, watch the data, iterate.

OTA makes that habit harder to break. The more a fix looks like a release, the easier it is to judge “is this even a problem” by release standards. The bZ7 filed two recalls in under 100 days, and the earliest production date in scope is October 28, 2025 — both defects left the factory with the first cars, and were simply driven around for a few months before anyone owned up to them.

The five notices of August 2026, numbered S2026M0080V through S2026M0084V, cover 233,257 vehicles. For 39,552 of them, the problem is a condition someone left out of the code.