The approval is an event. The conformity is a subscription.

Here is an uncomfortable observation for anyone with a type-approval certificate framed on the office wall. Chery's Omoda 5 was not merely recalled over a rear-axle defect. Its vehicle type approval was suspended first, which meant no new registrations at all. Not fewer sales. Zero. I have stood at enough shipping gates to know the difference between a containment and a stoppage: one is a bad week, the other is an existential quarter. The recall came days later. That sequencing is the whole story – the regulator reached for the kill-switch before the manufacturer reached for the paperwork. The same week, a luxury Chinese EV drew regulatory scrutiny over brake-pedal failures, and Beijing handed the entire industry a year-end safety deadline. One message, three stories. This is not a Chery problem. It is a warning to every plant that treats approval as a gate passed once, at launch, with champagne.

One specimen versus the ten thousand that follow

Type approval certifies exactly one thing: that a specimen, tested under controlled conditions, met the requirements. That is an event. Everything that matters afterwards is conformity of production – the continuously proven state that unit ten thousand still matches the specimen the authority actually approved.

They are different disciplines, and most organisations staff the first while starving the second. The launch audit gets a war room, a steering committee, overtime. The daily proof gets a binder nobody opens until someone official asks.

I would bet the Omoda axle passed its approval test. Something between the specimen and serial production moved – a heat-treatment window, a substituted supplier lot, a weld schedule, a torque drifting towards the edge of tolerance. Production diverged from the approved state quietly, one unit at a time. That is the failure mode nobody's PFMEA weights honestly, because it has no single point of occurrence. We have QRQC and 8D for escapes. For drift, we have almost nothing institutionalised.

The certificate says you could. Only the evidence says you still do.

The cascade nobody prices in

Run the arithmetic a plant controller would run. A suspended approval freezes registrations. Frozen registrations strand dealer stock that cannot legally be handed over; floorplan interest accrues on metal that has stopped being sellable; a forced recall follows; re-approval happens on the regulator's clock – their queues, their priorities. Move 300 units a day at €2,000 contribution each and the suspension alone burns €600,000 daily, before a single warranty claim arrives. Stellantis is digesting a €4.1 billion quality bill for cars already sold. A suspension is worse in kind: it stops the cars you have not yet sold.

Aerospace internalised this decades ago. Two decades split between automotive plants and aerospace programmes taught me the lesson from both directions: the right to ship is revocable. Always. Nobody in aviation confuses a certificate with a possession. It is a permission that survives exactly as long as the evidence does. Automotive regulation is converging on the same model, and plants that priced quality escapes as containment-plus-freight are about to reprice them as sales outages.

Run conformity like a subscription

When I built the QA/QC department for a 900-person greenfield plant, I refused to let conformity of production exist as a binder. It went into the operating system on day one: every characteristic underpinning the approval file mapped, owned and SPC-charted, with a retest and audit calendar that named a human being against each line. Not a department. A name. When IATF 16949, VDA 6.3 and customer conformity audits arrived, we produced the evidence in an afternoon, because it was being generated every day anyway. A VDA 6.3 auditor once held a shift meeting hostage over a missing torque-audit record; I still carry the scar tissue. That daily discipline, not heroics, is why we later ran a full quarter with zero critical customer escalations.

Four rules make the subscription real:

• Named owners on a conformity calendar. Every approval-critical characteristic carries a person, a frequency and an evidence location. Drift lives in the unowned ones.
• SPC on what the approval file rests on. Not only the customer's noted characteristics – the homologation-relevant ones the certificate quietly assumes are stable.
• Change control that asks the approval question. Every deviation, supplier move and process change passes one gate: does this touch the approved state? If yes, the approval authority hears it from you before production, not after.
• Self-disclosure before discovery. The Omoda recall landed after the suspension. That order is backwards, and it is the most expensive sequencing error in regulatory affairs.

That last point deserves an argument from an unusual quarter. I spend enough time on the security side of systems – ethical hacking, responsible disclosures, a name on a telecom's bug-bounty hall of fame – to know which posture survives: report before you are found. A vulnerability disclosed on your own timetable is a fix. One surfaced by somebody else's scan is an incident. Regulators run identical logic. The plant that walks in with its own drift data and its own re-approval plan keeps partial control of the clock. The plant that gets found keeps none.

Look at the plaque differently. It is not an asset. It is a loan note, and the evidence you can produce this afternoon is the interest payment. The Omoda suspension, the brake-pedal scrutiny and the year-end deadline all say the same thing in different accents: the approval is an event, the conformity is a subscription, and the subscription is billed daily. The plants that survive this enforcement era will not be the ones that passed the launch audit most brilliantly. They will be the ones that, on any given Tuesday afternoon, can produce the proof.