New edition of the Vehicle Recall Code published by the German Federal Motor Transport Authority

The German Federal Motor Transport Authority (Kraftfahrtbundesamt ‒ KBA) has published an updated version of its Vehicle Recall Code (Kodex für die Durchführung von Rückrufaktionen ‒ KBA-Kodex) (last modified in April 2025). The Code has been in existence for many years and serves as an internal administrative guideline to ensure consistent recall implementation in the automotive sector by the Motor Transport Authority.

As in the previous version, it contains explanations in particular regarding notification procedures, the retrieval of current vehicle keeper data from the Central Vehicle Register (Zentrales Fahrzeugregister ‒ ZFZR) and the management of recall processes by the Motor Transport Authority. The new version of the Code brings its provisions in line with the recently revised EU product safety framework and, compared to the previous version, also offers a user-friendly design with overviews.

The Code divides the process into three steps: Notification (A), Investigation (B) and Monitoring (C).

A. The notification

A significant change compared to the previous version can already be found in the rules for initiating the process: While the previous edition of the Code still listed the Motor Transport Authority’s e-mail address for reporting serious risks identified, together with the information that notification could additionally be made via the EU’s Product Safety Business Alert Gateway portal, such notifications must now be submitted directly via the EU’s Safety Business Gateway portal. As a result, the special treatment afforded to the automotive industry, whereby the Motor Transport Authority acted as an official intermediary on its behalf, has now been formally abolished. In all other consumer goods sectors, the use of the online portal was already mandatory. Once a notification is submitted digitally via the Safety Business Gateway to the EU Commission, it is then forwarded to all relevant national contact points. In Germany, this is the Federal Institute of Occupational Safety and Health (Bundesanstalt für Arbeitsschutz und Arbeitsmedizin ‒ BAuA), which in turn then notifies the Motor Transport Authority.

By making it mandatory to submit notifications via the Safety Business Gateway Portal, the Code is moving closer to the new EU General Product Safety Regulation (GPSR, Regulation (EU) 2023/988) in terms of the procedure. However, a key difference from the GPSR lies in the relevant risk thresholds:

The notification obligation of economic operators under the GPSR, as set out for manufacturers in Article 9(8)(c) of the GPSR and implemented via the EU’s Safety Business Gateway, is triggered by the mere dangerousness of the product in question. Under the legal definitions in Article 3(3) and 3(2) of the GPSR, a product is considered “dangerous” if it is not “safe”. A product is deemed safe if it poses no risks or only minor risks that are compatible with its use. According to the wording, the obligation to notify the authorities under the GPSR is by no means limited to genuine serious risks. Additionally, Article 20(1) of the GPSR introduces a new notification obligation triggered by any product-related accident even if it is minor.

In contrast, the Motor Transport Authority bases its actions under both the old and the new Code on the classification as a serious risk ‒ the highest of four risk levels: A notification must be made to the Motor Transport Authority only if a vehicle poses a serious risk or does not comply with the requirements of Regulations (EU) 167/2013, 168/2013 and 2018/858. This results in a discrepancy between the requirements of the Code and the GPSR in cases where a risk exists below the “serious risk” threshold and without any regulatory non-compliance. The previous version of the Code likewise made a strict distinction between a recall monitored by the Motor Transport Authority in the case of serious risks and a voluntary product recall below this threshold. Even under the new Code, the Motor Transport Authority only considers itself responsible for monitoring from the threshold of a serious risk onwards.

The Motor Transport Authority’s Code remains silent on this discrepancy. However, it can rely on the requirement of a serious risk based on the specific legal provisions of the EU Type-Approval Regulation (Regulation (EU) 2018/858), which in Article 14(2) sets a high threshold of a serious risk for the manufacturer’s notification obligation and, correspondingly, for the actions of market surveillance authorities in Article 52(1).

Simultaneously with the notification via the Safety Business Gateway, the request for vehicle keeper data pursuant to section 35(2) of the German Road Traffic Act (Straßenverkehrsgesetz ‒ StVG) is initiated. The legal prerequisite for this is a safety-relevant defect, a significant environmental defect or another non-compliance in vehicles that have already been delivered. Even under the new Code, requests for vehicle keeper data, which have data protection implications, must still be submitted directly to the Motor Transport Authority along with the following documents:

I. Recall declaration (Appendix 1)

As in the previous version, the minimum requirements for the declaration of the recall required for the vehicle keeper data request are set out in Appendix 1 to the Vehicle Recall Code. The document serves as a request for keeper data.

The declaration of the recall includes, among other things, the data protection requirements that the manufacturer must observe when handling the vehicle keeper data as well as information on whether the “mailing service”, whereby the Motor Transport Authority takes over the sending of letters to vehicle keepers, should be used. Furthermore, it must be confirmed that a sufficient number of spare parts are available to begin the recall without delay. If spare parts are not available in sufficient quantity, the Motor Transport Authority must be informed of the plans for spare parts availability before the request for vehicle keeper data is submitted. Depending on the risk and circumstances, the Motor Transport Authority may decide whether an interim or preliminary notification must be sent to the vehicle keepers. The letter (see Appendix 3) would then have to be adapted accordingly.

II. Letter to the vehicle keeper (Appendix 3) and workshop instructions

The request for vehicle keeper data also includes the letter to the vehicle keepers, for which the template provided in Appendix 3 may be used, and the workshop instructions.

It should be noted here that the Code stipulates, among other things, that softening language such as “voluntary”, “precautionary”, “discretionary”, “in rare situations” and “in specific situations” are to be avoided. The new GPSR also contains this (incomprehensible) language prohibition. In this context, the communication departments are certainly required to exercise tact in order to maintain the balance between marketing-oriented customer communication and the requirements of the Code.

B. Investigation by the Motor Transport Authority

Once the Motor Transport Authority has received all relevant information, an assessment of the reported defect and its risk is carried out by the Motor Transport Authority using a risk assessment based on the Safety Gate Risk Assessment (SAGA). If no serious risk is identified, the matter is to be examined for a possible regulatory non-compliance. If the risk assessment reveals a serious risk and the economic operator has already announced appropriate measures together with the notification, the Motor Transport Authority will only issue a declaratory decision. In other cases, suitable measures to eliminate the risk are ordered after a hearing.

C. Monitoring the recall

If a serious risk or a regulatory non-compliance is present, the recall is monitored by the Motor Transport Authority. The Motor Transport Authority publishes recalls in accordance with section 19(2) of the German Market Surveillance Act (Marktüberwachungsgesetz ‒ MÜG) in the recall database on the Motor Transport Authority’s website.

As part of its monitoring activities, the Motor Transport Authority must regularly be provided with reports on the success rate of vehicles already processed. In most cases, this results in follow-up actions. In contrast to the initial action of the first letter to the keeper, the Code defines a follow-up action as a new letter sent to any vehicle keeper who has not yet responded. It should be noted that a new vehicle keeper data request is always required for the follow-up action since the previously obtained keeper data has an “expiry date” of 14 days. 

Finally, as in the past and if required, a final letter to the vehicle keepers is issued, setting a deadline (if necessary, using a Certificate of Service by Post). In the event of serious risks or regulatory non-compliance, an operating ban is imposed as a last resort on the remaining vehicles.

D. Conclusion

The new edition of the Vehicle Recall Code introduces important adjustments for modern and effective handling of product risks and provides economic operators with clear information on the recall process of motor vehicles. While the Code provides a valuable overview, it is inherently limited in detail.