Volkswagen made the diesel defeat device a software-governance accountability test

Summary

• The confirmed technical trigger was dual-condition engine-control behavior. Certain diesel vehicles recognized conditions associated with official emissions testing and operated emissions controls differently from ordinary driving. The U.S. Environmental Protection Agency says affected 2.0-liter vehicles emitted nitrogen oxides at levels up to 40 times the applicable standard in normal operation. The exact factor varied by vehicle, route, engine generation and jurisdiction; it is not a universal multiplier for every affected car.
• Volkswagen AG's U.S. criminal plea supplies the strongest internal chronology for the conduct it admits. The company admitted a conspiracy involving defeat-device development and repeated false certification, obstruction of justice, and importation by false statements. That corporate disposition is not a conviction of every employee or a finding that every board member knew the same facts at the same time.
• The direct root was not an accidental coding defect. Software was used to reconcile product and emissions targets at the certification boundary while leaving a different operating state on the road. Contributing factors included concentrated calibration authority, product constraints, weak separation between design and compliance testing, repeated certification of opaque software, management escalation failures, misleading explanations to regulators and inadequate preservation of records.
• Independent portable testing broke the control loop. A 2014 West Virginia University study commissioned by the International Council on Clean Transportation found large road-to-laboratory nitrogen-oxide differences in two tested vehicles. CARB and EPA repeated tests, rejected explanations that did not fit the evidence, and made approval of later model-year vehicles contingent on resolving the discrepancy. Detection succeeded because an external team varied the operating environment rather than repeating the expected laboratory cycle.
• Legal outcomes must remain separated. U.S. criminal admissions, Clean Air Act consent decrees, FTC consumer orders, German civil judgments, a Canadian guilty plea, an Australian consent-based court declaration and European Union legal interpretation answer different questions under different laws. Settlements resolve claims without necessarily admitting every allegation, while later real-driving rules and later court interpretations should not be treated as if they were the original certification test.
• Recovery combined vehicle removal, approved emissions modifications, consumer compensation, environmental mitigation, zero-emission investment, civil penalties and externally supervised compliance change. The FTC reported more than $9.5 billion repaid to U.S. consumers and payments associated with more than 88 percent of covered vehicles. That is strong redress evidence, but it is not a global repair denominator or proof that every modified vehicle performs identically throughout its remaining life.
• Durable closure requires machine-verifiable evidence: version-controlled calibration logic, named approvers, an explicit inventory of auxiliary emission strategies, independent tests over randomized real-world conditions, regulator access to executable configurations, fleet telemetry or statistically sound in-use sampling, repair completion by vehicle cohort, protected escalation and board reporting tied to unresolved technical exceptions. Policy counts and completed monitoring terms are relevant, but observed behavior is the final control.

The software made a regulatory representation executable

An emissions certificate is a representation about how a vehicle type will behave under legally specified conditions. In a software-defined powertrain, that representation is partly executable. Sensor inputs enter an engine control unit; calibration maps and conditional logic select exhaust-gas recirculation, fuel injection, boost pressure, lean-NOx-trap regeneration, selective catalytic reduction and other control behavior; physical exhaust leaves the tailpipe. If code recognizes the approval environment and selects a cleaner mode only there, the certification file and the road product no longer describe the same system.

EPA's current explanation of the Volkswagen violations states that software in affected Volkswagen, Audi and Porsche vehicles detected emissions testing, activated full emissions controls during the test and reduced their effectiveness in normal driving. The agency identifies up to 40 times the standard for certain 2.0-liter vehicles and up to nine times for certain 3.0-liter vehicles. Those are agency descriptions of affected U.S. groups, not a basis for assigning one emissions rate to all eleven million vehicles Volkswagen later identified worldwide.

The distinction between a software feature and a defeat device is legal as well as technical. A modern engine must vary controls with temperature, load, speed and component protection. Conditionality is normal. The accountability failure appears when a condition reduces emissions-control effectiveness in circumstances reasonably expected in ordinary use, is not lawfully disclosed or justified, and enables certification that the delivered product could not otherwise support. The prohibited act is therefore not optimization in the abstract.

It is ungoverned or unlawful optimization across a boundary where the company owes regulators and customers an accurate account of behavior.

This is why the incident cannot be reduced to a few lines of malicious code. Code had to be specified, implemented, calibrated, integrated, tested, released into production, carried across model years, included in certification vehicles, serviced in the field and explained to authorities. Each step had an owner and an opportunity for challenge. A software-governance analysis asks why those gates reinforced the divergence instead of revealing it.

Practical control was distributed, but the manufacturer held the system boundary

Volkswagen AG controlled the core product program, engine targets, software release, calibration resources and the representation that vehicles met applicable standards. Brand and regional entities connected that product to local certification and customers. Audi personnel had important roles in the admitted U.S. history of dual-mode logic, while external engineering company IAV also participated in the 2.0-liter work. The Justice Department later announced IAV's guilty plea and $35 million criminal resolution. Supplier or contractor participation does not transfer the vehicle manufacturer's duty to certify the integrated vehicle accurately.

Engineers had direct practical control over algorithms, calibration maps, test recognition and implementation. Supervisors controlled design constraints, staffing, technical decisions and approval. Product-safety, environment and regulatory teams controlled escalation and disclosure. Certification personnel controlled applications and attestations. Legal and records personnel controlled preservation once investigation or litigation became foreseeable. Senior executives controlled targets, conflict resolution and the response to evidence that the product could not satisfy its promised combination of performance and emissions.

The supervisory and management boards controlled governance, risk reporting and consequences, even though they were not expected to review every calibration table.

Regulators held a separate control layer. EPA and CARB could define certification requirements, demand information, conduct confirmatory and in-use tests, withhold certificates, order remedies and enforce violations. European type-approval authorities and regulators in other countries operated under different statutes and test systems. Their control was consequential but incomplete: they did not write Volkswagen's code, continuously observe internal decision-making or receive every software strategy automatically.

Owners controlled whether to present a vehicle for an optional modification or accept a buyback after remedies became available. Dealers performed modifications and documented transactions. Neither group could discover hidden mode logic before disclosure or independently verify an entire fleet. Accountability should not be assigned according to who ultimately possessed the vehicle. It should follow authority over the hidden condition, the certification statement and the evidence needed to challenge both.

2006 to 2008: a product constraint became a governance decision

Volkswagen's admitted U.S. plea agreement and Statement of Facts describe the beginning of the 2.0-liter program. In 2006, engineers were developing a new diesel engine for the U.S. market under stricter nitrogen-oxide limits. The company wanted a vehicle that could satisfy emissions rules while preserving other design, cost and performance characteristics. According to the admitted facts, engineers could not meet the required combination within the constraints imposed on them and used software based on an Audi dual-mode concept to recognize the test and alter emissions behavior.

This is the first decisive accountability point. An engineering impossibility within a chosen design envelope can produce four legitimate responses: change hardware, relax commercial targets, delay the program or seek a lawful regulatory path. It can also be hidden by making the product pass the observable test. Which option is chosen is not merely an engineering matter. It is a capital-allocation and product-governance decision because cost, schedule, market positioning and legal compliance are competing requirements.

The Statement of Facts says personnel raised objections and that supervisors directed continuation. It further says software was installed from the first model year 2009 through model year 2016 in U.S. 2.0-liter subject vehicles. Because Volkswagen stipulated that the corporate facts were true for the plea, this chronology is a corporate admission. It does not authorize a claim that every person in engine development participated, knew the legal analysis or understood all downstream consequences.

The hidden tradeoff also changed assurance. A conventional emissions test asks whether a representative vehicle follows a prescribed cycle within limits. Once the product can recognize the cycle, passing the test becomes evidence that recognition works, not evidence of normal-use compliance. The control must then move one level higher: reviewers need access to conditional logic, tests that vary hidden assumptions and organizational independence from the team trying to achieve program targets. None of those controls was strong enough to stop production.

2009 to 2012: certification repeated while the software remained opaque

For each model year, manufacturers seeking U.S. certificates of conformity had to describe relevant emissions-control systems and demonstrate compliance. Volkswagen vehicles passed laboratory testing and entered the market under a "clean diesel" proposition. The code's dual behavior made that repeated success misleading: the certification vehicle behaved cleanly in the expected test while ordinary-use controls were less effective. Repetition increased the scale of the problem but could also create false confidence. Each prior certificate appeared to validate the next application.

The U.S. guilty plea matters because it resolved more than a technical violation. On 10 March 2017, Volkswagen pleaded guilty to three felony counts: conspiracy to defraud the United States, commit wire fraud and violate the Clean Air Act; obstruction of justice; and importation by false statements. The company thereby accepted criminal responsibility for repeated representations and concealment, not just for an isolated software nonconformity.

Certification controls failed at several layers. Software inventories did not produce a regulator-facing explanation sufficient to expose the mode switch. Compliance testing was predictable enough to be recognized. Independent engineering challenge did not force road testing across randomized conditions. Certification sign-off did not require a negative assurance from software owners that no undisclosed test-recognition strategy existed. Management did not resolve the original constraint by changing the program.

Marketing added a second representation. A certificate answers a regulator's legal test; advertising tells customers what the product means in daily life. The Federal Trade Commission later alleged that environmental and low-emission claims deceived buyers. The FTC Volkswagen case record contains the complaints, orders and supporting materials. The settlement orders resolved consumer claims and imposed redress without converting every advertisement seen by every buyer into an individually tried finding.

2012 to early 2014: hardware failures revealed the hidden state, then prompted a better disguise

Software exceptions often leave physical traces. According to Volkswagen's admitted Statement of Facts, certain 2.0-liter vehicles experienced exhaust-system hardware failures around 2012. Engineers believed some vehicles remained in the cleaner dynamometer mode during road use, placing additional stress on components that had not been designed to operate that way continuously. The anomaly therefore revealed that the product contained a state whose long-duration road operation was outside its intended design.

A July 2012 meeting brought the defeat device and hardware-failure explanation to senior personnel identified in the plea record. The admitted account says further concealment was encouraged. Engineers later improved test recognition by starting in street mode and switching after identifying dynamometer conditions, including through steering-wheel-angle recognition. Existing vehicles received software updates. This was not remediation in the compliance sense. It reduced the risk that the hidden mode would remain active accidentally while preserving the regulatory deception.

The episode is critical for root-cause analysis. The system detected an adverse consequence of its own hidden behavior. An accountable process would have opened a compliance incident, preserved the affected software, identified every vehicle and certificate using it, tested ordinary-road emissions, notified independent legal and regulatory functions and stopped further releases. Instead, the feedback was used to improve state detection. The monitoring signal became an input to optimization of the control failure.

This does not mean every service update during the period was improper, or that every hardware failure proved defeat-device operation. The confirmed fact is the corporate admission about the particular failures and response described in the plea. The supported institutional inference is that software change management was aligned to product continuity rather than independent compliance. A stronger claim about every engineer's purpose would exceed the record.

May 2014: independent road testing changed the observable system

The decisive external signal came from a small study designed to compare laboratory and road behavior. The International Council on Clean Transportation commissioned West Virginia University's Center for Alternative Fuels, Engines and Emissions to test three U.S.-certified light-duty diesel vehicles with portable emissions measurement equipment. The 30 May 2014 report describes predefined highway, urban, suburban and rural routes, an extended drive and chassis-dynamometer work at CARB's El Monte facility.

Two vehicles showed large nitrogen-oxide excesses on the road while meeting the standard over the laboratory certification cycle. The report describes factors of 15 to 35 for the lean-NOx-trap vehicle and 5 to 20 for one selective-catalytic-reduction vehicle over the predefined routes; a third vehicle generally performed at or below the standard. The study did not identify a defeat device, assign culpability or estimate worldwide harm. Its evidentiary force came from the pattern: high road emissions were not inevitable for every diesel technology, and the two high emitters behaved differently on the known laboratory cycle.

External researchers succeeded because they changed the environment. Portable equipment made the real road part of the test. Multiple routes varied speed, load and terrain. A comparison vehicle showed that the measurement method could observe compliant behavior. The study therefore challenged the assumption that a passing laboratory result was an adequate proxy for ordinary use.

The limited sample is a feature and a limit. Three vehicles cannot estimate a global fleet distribution. It can, however, generate a sufficiently serious hypothesis to require regulator follow-up. Risk governance should distinguish detection sensitivity from final quantification. A credible outlier can justify investigation long before it supports a population estimate.

2014 to September 2015: regulator persistence converted discrepancy into disclosure

CARB and EPA followed the road-test results with their own work and information exchanges. Volkswagen offered technical explanations and conducted a voluntary U.S. recall announced in late 2014. A software update was presented as addressing the emissions discrepancy. CARB tested modified vehicles and continued to observe excess nitrogen oxides. The proposed explanation and remedy did not fit the result.

CARB's 18 September 2015 In-Use Compliance letter reconstructs this sequence: receipt of the in-use study, confirmatory testing, discussions about technical causes, the recall and post-recall evaluation. It records that Volkswagen disclosed the existence and operation of a second calibration in September 2015 after CARB and EPA made clear that certification of 2016 model-year diesel vehicles would not proceed without an adequate explanation.

EPA's Notice of Violation for the 2.0-liter vehicles alleged that model year 2009-2015 Volkswagen and Audi diesels contained software that detected test conditions and reduced emissions-control effectiveness during normal driving. At the notice stage these were regulatory allegations. Volkswagen's later guilty plea and admitted facts confirmed the central U.S. conduct, while consent decrees resolved civil claims.

The chronology shows what effective challenge looks like. Regulators did not accept a plausible software fix merely because a recall had been announced. They measured the output after the fix, retained the unresolved discrepancy and linked disclosure to a business-critical approval. The detection control worked only when evidence, authority and a deadline converged. Earlier disclosure would have reduced the duration of excess emissions; a less persistent regulator could have certified another model year.

September to November 2015: the visible event expanded across engines and borders

On 18 September 2015, EPA and CARB publicly announced the 2.0-liter violation. CARB's joint announcement with EPA described roughly 482,000 U.S. passenger cars in the initial notice and emphasized that the vehicles remained legal to drive at that point. The public trigger produced leadership changes, sales stops, investigations and a rapid widening of scope.

Volkswagen's 22 September ad hoc disclosure said noticeable test-to-road discrepancies had been found in type EA 189 engines and that approximately eleven million vehicles worldwide were affected. The company's 2015 Annual Report broke that population down by engine size, brand and region and recorded provisions, recalls, litigation and uncertainty. It is primary evidence of what Volkswagen reported, not independent verification of every estimate or legal consequence.

EPA issued a separate notice on 2 November concerning certain 3.0-liter Volkswagen, Audi and Porsche vehicles. The agency says Volkswagen officials later informed it that the relevant defeat device had existed in all U.S. 3.0-liter diesel models since 2009. The 2.0-liter and 3.0-liter systems, populations and remedies were not identical. They should not be collapsed into a single software version or emissions factor.

The global figure also had a different meaning from the U.S. enforcement population. Around eleven million referred principally to EA 189 engine-management software worldwide. Approximately 590,000 in the later U.S. resolutions included covered 2.0- and 3.0-liter vehicles under U.S. standards. Different jurisdictions had different certification procedures, emissions limits, legal definitions, recall authority and consumer remedies. Scale is confirmed; legal uniformity is not.

Trigger, direct root and contributing factors must remain separate

The trigger was the publicly confirmed divergence between certified laboratory behavior and ordinary-road emissions, ultimately traced to test-recognition software. The direct technical root was an engine-control strategy that selected a low-emission calibration for official testing and a less effective state outside it. The direct governance root was authorization of that strategy as a way to deliver a product whose chosen constraints could not otherwise satisfy applicable U.S. emissions requirements.

Several factors contributed without replacing the root. Product targets constrained hardware and calibration choices. Software authority was concentrated among teams accountable for delivery. Compliance personnel lacked demonstrable independence from design. Approval tests were predictable. Certification relied on representations that did not expose executable conditions. Repeated passage of the same kind of test created assurance debt. Hardware failures were treated as a reason to refine mode recognition. Management escalation did not force lawful resolution.

Explanations and a recall update consumed regulator time without eliminating the discrepancy. Records were later destroyed, producing the obstruction count in the corporate plea.

Culture is often invoked, but it should be translated into controls. A "pressure" explanation matters only if targets, performance reviews or decision rights made lawful alternatives practically unavailable. A "silo" matters only if no owner had to reconcile calibration, durability, certification and road-test data. A "speak-up" weakness matters only if objections could be overruled without a traceable independent review. These are testable propositions.

The evidence does not support a claim that every Volkswagen employee accepted deception or that diesel technology itself required cheating. The comparison vehicle in the WVU work is one reason to reject technological inevitability. Nor does the record prove that one national regulatory system caused the conduct. Predictable tests created an opportunity, but the manufacturer remained responsible for accurate certification and lawful normal-use behavior.

Detection succeeded outside the expected test and failed inside the enterprise

Internal detection had several opportunities. Code review could have identified test recognition. Calibration comparison could have shown two materially different emissions states. Randomized road testing could have reproduced excess nitrogen oxides. Hardware durability analysis could have exposed why the cleaner state could not persist. Certification review could have demanded a full inventory of auxiliary strategies. Employee objections could have triggered an independent stop. None ended the program.

External detection combined portable measurement, comparative testing, regulator laboratories and certification leverage. The WVU team did not need access to source code to establish that the product behaved differently. CARB did not need to prove individual intent before insisting that the post-recall vehicle still failed to match the explanation. EPA did not need a global fleet estimate before issuing a U.S. notice.

This sequence suggests an assurance hierarchy. First, black-box tests should vary routes, temperatures, starts, steering, acceleration and test order. Second, white-box review should enumerate every input capable of changing emissions-control effectiveness. Third, binary and calibration hashes should tie the reviewed artifact to the production vehicle. Fourth, in-use surveillance should test aged vehicles and service updates. Fifth, an independent function should investigate discrepancies without needing product-program permission.

Detection evidence should also preserve negative decisions. If a strategy is judged lawful because it protects the engine, the record should state the immediate hazard, the operating envelope, alternative designs considered and why the exception is no broader than necessary. The later Court of Justice interpretation confirms the importance of narrow exceptions, but the governance principle is more general: undocumented conditionality is an unpriced compliance liability.

Response stopped sales and created remedies, but recovery required different proof

The initial response included public disclosure, leadership changes, stop-sale actions, withdrawal or delay of certification applications, technical investigation and recall planning. These actions reduced additional exposure but did not repair the installed population or compensate owners. Response evidence answers whether the company contained an unfolding event. Recovery evidence answers whether vehicles, people and environmental harm were addressed.

In the United States, recovery was divided by engine generation because a single technical fix could not responsibly be assumed. EPA's civil settlement record describes removal from commerce or approved modification targets of at least 85 percent, separate California targets, financial consequences for missing targets, consumer programs, a $2.7 billion mitigation trust plus $225 million for 3.0-liter vehicles, $2 billion in zero-emission investment and a $1.45 billion Clean Air Act civil penalty under the third partial settlement.

The court-approved consent-decree collection is the controlling source for detailed obligations. Consent decrees resolve civil claims under negotiated terms. They are judicial orders, but their entry does not mean every allegation was tried. They deliberately combine different remedies: vehicle-level relief reduces future excess emissions, compensation addresses consumer loss, mitigation substitutes reductions from other sources for pollution already released, and penalties punish and deter.

No one measure can stand in for the others. A buyback removes a vehicle but does not itself compensate a community for past pollution. A software modification can reduce emissions but may alter maintenance or performance and requires durability testing. A payment compensates an owner but does not establish environmental restoration. Governance reform reduces recurrence risk but does not repair an engine. Accountability requires separate completion evidence for each obligation.

Consumer redress was measurable and unusually complete within its U.S. scope

The FTC orders gave eligible U.S. owners and lessees choices that varied by engine generation and repair availability. For many 2.0-liter vehicles, owners could accept a buyback or keep the vehicle and receive an approved modification plus compensation. Some 3.0-liter generations had compliant-repair pathways; older vehicles could be bought back if an adequate modification was unavailable. Loan, lease, rural-access and claims-administration rules addressed practical barriers.

The FTC's 2020 final status report states that defendants repaid consumers more than $9.5 billion, made payments associated with more than 88 percent of covered "Clean Diesel" vehicles and that 86.2 percent of eligible consumers who completed the process and chose a remedy selected buyback or early lease termination. The report also credits the administration's accuracy and timeliness, based largely on data analyzed by the independent claims supervisor.

Those results are strong evidence that a large redress mechanism operated. Their scope must be preserved. The $9.5 billion figure excludes more than $300 million paid by Bosch, according to the report. The payment rate is not the same as a repair rate because buybacks, lease terminations and modifications are different outcomes. The report addresses U.S. orders, not compensation in every country. Participation also does not prove the absence of individual disputes.

The federal court's 2016 approval of the 2.0-liter FTC order moved the program from proposed relief to an enforceable process. This procedural distinction matters. A headline settlement amount represents a maximum or structured obligation; the final report records actual program outcomes. Both are needed to assess design and execution.

Technical repair had to be approved by generation, not assumed from intent

An emissions modification is itself safety- and compliance-relevant software. It must remove prohibited logic, reduce nitrogen oxides across real operation, maintain on-board diagnostics, protect hardware and disclose effects on fuel economy, performance, reliability and maintenance. Treating the fix as a patch that merely deletes a condition would repeat the original governance error.

EPA and CARB approved modifications in stages. Their January 2017 approval for model year 2015 Generation 3 2.0-liter vehicles required software and hardware work, with an initial software phase followed by additional software and replacement of emissions components. A later April 2018 approval letter documents approval of another part of that remedy.

Regulators did not approve every proposal. EPA's November 2017 partial disapproval for certain Generation 1 2.0-liter transmission-control-unit modifications demonstrates that recovery retained an approval gate. A rejected component of a proposed modification is not evidence that all remedies failed. It is evidence that the regulator tested the proposal against settlement criteria rather than treating Volkswagen's submission as sufficient.

Durability remains a separate question. Approval is based on specified tests, engineering submissions and warranties. Completion is based on vehicle records. Long-term effectiveness requires in-use data after mileage, aging, service and diverse climates. Public settlement records provide meaningful evidence of approved designs and program execution, but they do not expose a current, globally harmonized dataset for every affected vehicle and every post-modification emissions result.

The environmental remedy acknowledged that consumer repair could not reverse past emissions

Nitrogen oxides contribute to nitrogen dioxide, ground-level ozone and particulate matter. EPA links exposure to aggravated asthma and other respiratory and cardiovascular effects, with heightened risks for children, older adults, outdoor workers and people with heart or lung disease. A specific health outcome cannot be assigned to one vehicle without exposure and causal analysis, but fleet-scale excess emissions create a population-level environmental burden.

The U.S. consent decrees therefore funded mitigation beyond the subject vehicles. The trusts allow states, territories, the District of Columbia and eligible tribes to replace or repower heavy-duty diesel sources, buses, locomotives, marine equipment and other eligible sources. This design recognizes a basic recovery limit: emissions already released cannot be recalled. Equivalent or greater reductions must be created elsewhere under auditable projects.

Mitigation funding is not self-executing proof of environmental benefit. Beneficiaries must select projects, document eligible expenditures, replace or destroy old equipment where required and report outcomes. Modeled reductions depend on baseline engine use, replacement technology, project life and enforcement against double counting. The settlement amount is confirmed; the realized tonnage is a program result requiring beneficiary and trustee evidence.

The zero-emission investment has a different rationale. It supports infrastructure, access and awareness to address the market impact of consumers buying vehicles they believed were lower emitting. It should not be added to mitigation spending and described as one pollution-removal total. Nor should later electric-vehicle investment be treated as proof that the original software controls were repaired. One is a market and technology remedy; the other is a product-compliance control.

Responsibility control map: authority must be tied to evidence and a stop right

The incident's control map is useful only if it identifies practical authority, not merely organizational titles.

Control domain	Primary practical controller	Required evidence	Independent challenge	Failure exposed by the case
Product constraints	Engine program and senior product leadership	Signed tradeoff record linking emissions, cost, performance, timing and lawful alternatives	Compliance and executive risk committee with stop authority	An infeasible target combination was resolved through hidden conditional behavior
Source code and calibration	Powertrain software and calibration owners	Version history, requirements, reviewers, condition inventory and production hash	Independent software-compliance review	Test recognition and dual modes could persist across releases
Hardware integration	Engine and aftertreatment engineering	Durability data across clean modes, aging, temperature and load	Product safety and external laboratory	Hardware stress revealed the clean state but did not force disclosure
Certification	Homologation and regional environment offices	Complete strategy declaration tied to exact executable artifact	Legally accountable signatory and regulator access	Certificates repeated without exposing ordinary-use behavior
In-use surveillance	Quality, warranty and emissions-compliance teams	Randomized road tests, aged-vehicle samples, anomaly thresholds	Independent test facility and regulator	Known-cycle testing produced false assurance
Employee escalation	Management, compliance and human resources	Protected report, preserved dissent, deadline and written disposition	Audit committee access and anti-retaliation review	Objections could be overruled without stopping the program
Regulator disclosure	Regional regulatory affairs and legal	Chronology, raw data, code changes and explanation of uncertainty	Named disclosure officer and board visibility	Technical explanations and recall activity delayed full disclosure
Records preservation	Legal, information governance and engineering custodians	Automated hold, immutable logs and deletion exceptions	Forensic audit	Destruction of relevant documents produced an obstruction conviction for the company
Vehicle remedy	Engineering, dealers and claims administration	Approved modification, VIN outcome, warranty and field performance	EPA, CARB, court and claims supervisor	Repair feasibility differed by generation and required external gates
Environmental recovery	Trust beneficiaries and independent trustee	Project baseline, expenditure, scrappage and modeled reduction	Public reporting and audit	Past emissions could not be corrected through owner compensation alone
Governance durability	Management board and supervisory board	Exception metrics, independent testing, recurring control assessment	External auditor, monitor or regulator	Policy and hierarchy did not prevent software from redefining compliance

Every row needs a stop right. A reviewer who can comment but cannot delay release is not an independent control. A regulator liaison who depends on the product team for the only explanation cannot provide negative assurance. A board that receives only aggregate legal reserves cannot see whether a technical exception remains unresolved. The control must specify who can halt certification, what evidence starts the halt, how it is cleared and who reviews an override.

Criminal, civil, regulatory and private outcomes answer different questions

Volkswagen was sentenced in federal court on 21 April 2017 after its guilty plea. The court accepted a $2.8 billion criminal penalty, three years of probation and an independent corporate compliance monitor. That is a court disposition of the company's criminal responsibility. It does not establish criminal guilt for people who were merely charged, and it does not decide civil damages for every owner.

The civil resolutions addressed different statutes and remedies. Clean Air Act decrees handled vehicles, environmental mitigation, penalties and preventive controls. FTC orders addressed allegedly deceptive marketing and consumer loss. Customs and financial claims formed part of the broader 2017 resolution. Private class settlements coordinated with public orders. A number from one instrument should not be combined with another without checking overlap, maximum versus paid amounts and geographic scope.

Individual outcomes also require precise labels. Two former Volkswagen personnel pleaded guilty and were sentenced in the United States; other people were charged or indicted. An indictment is an allegation and carries a presumption of innocence unless resolved by a conviction. Corporate responsibility can be established even where extradition, evidence or separate legal standards leave individual cases unresolved.

The U.S. resolution is unusually strong because Volkswagen admitted a detailed Statement of Facts. It is still jurisdiction-specific. The document expressly frames legal terms and emissions standards under U.S. law. It should not be used as an automatic finding of liability under every country's criminal, administrative, consumer or securities law.

Global accountability diverged because law, procedure and remedy were not uniform

Canada provides a separate criminal result. Canada's Environmental Offenders Registry records that Volkswagen AG pleaded guilty to 58 counts concerning unlawful importation of vehicles that did not conform to prescribed emissions standards and was ordered in January 2020 to pay a C$196.5 million fine. That disposition is authoritative for the Canadian offenses recorded; it is not a supplement to the U.S. count or a global judgment.

In Australia, the Federal Court made consent-based declarations that Volkswagen breached consumer law by making false representations about compliance. The Australian Competition and Consumer Commission's official case summary states that the court imposed A$125 million in penalties and that Volkswagen admitted nondisclosure of two-mode software when seeking approval to supply and import more than 57,000 vehicles. The consent context and Australian statutory basis should remain visible.

German civil law produced another type of accountability. In a 2020 diesel case, Germany's Federal Court of Justice described software that recognized the test bench and selected lower nitrogen-oxide behavior. Its 30 July 2020 ruling summary sent a purchaser's damages claim back for further treatment after an earlier dismissal. This was not a criminal adjudication of the entire Volkswagen Group, and German purchaser outcomes depend on claim timing, vehicle, use offsets and other facts.

Volkswagen's 2024 legal-risk report shows why closure cannot be declared globally. It reported continuing proceedings in multiple countries, approximately EUR0.6 billion in diesel-related litigation and legal-risk provisions at year end, and EUR4.0 billion in disclosed contingent liabilities, predominantly investor claims. These are company accounting estimates under uncertainty, not final damages findings.

European law illustrates why later standards cannot be projected backward

European Regulation 715/2007 already prohibited defeat devices that reduced emissions-control effectiveness under normal-use conditions, subject to limited exceptions. The official regulation defined a defeat device through sensed parameters and their effect on emissions controls. That legal text, applicable according to its own dates and scope, is the proper starting point for European analysis.

In December 2020, the Court of Justice of the European Union interpreted the regulation in C-693/18. The judgment held, in substance, that a device systematically improving emissions-control performance during approval procedures could not be justified merely because it prevented engine aging or clogging; the engine-protection exception had to be interpreted strictly. This is an authoritative interpretation of EU law, but the preliminary-ruling procedure answered referred legal questions rather than calculating damages for every owner.

The European Union subsequently implemented Real Driving Emissions procedures using portable measurement systems. Commission Regulation 2016/427 describes RDE requirements and application rules for new approvals. These procedures improved the test environment by making ordinary driving observable. They should not be described as though they were the certification cycle Volkswagen originally encountered, nor used to claim a retroactive violation of a later measurement protocol.

The correct distinction is narrower. Original conduct is assessed under the law, certifications and representations applicable to the vehicles at the time. Later judgments can authoritatively interpret existing provisions where procedurally relevant. Later test rules demonstrate a control improvement and govern according to their effective dates. Keeping those categories separate avoids both under-accountability and retroactive overstatement.

Supported inference, unresolved questions and allegation boundaries

Confirmed facts include the WVU road-test results, the EPA and CARB actions, Volkswagen's approximately eleven-million-vehicle disclosure, the company's U.S. guilty plea and admitted facts, the court-entered civil orders, recorded consumer payments, approved and rejected remedy steps, the Canadian plea and the Australian consent declarations. Regulatory findings and court dispositions are attributed to the body that made them.

The strongest supported inference is that the defeat device persisted because software, product and compliance governance were aligned around passing a known approval process rather than demonstrating lawful behavior over normal operation. That inference rests on the admitted origin, repeated certification, 2012 hardware feedback, 2014 refinement and 2015 disclosure sequence. It does not require speculation about the private state of mind of every senior leader.

Unresolved questions remain. Public material does not provide a complete, unredacted map of who reviewed each software version in every brand and jurisdiction. It does not reveal all internal monitor testing or every recommendation. It does not establish one worldwide repair-completion denominator with current registration status. It does not produce a directly measured health outcome for each community. It does not finally resolve all investor and consumer litigation.

Party allegations must stay labeled. Charges against people who were not convicted remain allegations. Civil complaints state government or private claims until admitted, adjudicated or settled. Volkswagen's annual-report position on board knowledge is a company statement under financial-reporting controls, not an independent exoneration. Conversely, a settlement without an admission is not proof that the alleged conduct did not occur. Procedural form is part of the evidence.

Counterfactuals identify controls, not alternate-history certainty

The earliest counterfactual is technical and commercial. If product leadership had responded to the 2006 constraint by changing hardware, cost, performance or launch timing, the U.S. program might have been compliant or might not have launched in the same form. The record supports feasibility of those governance choices in principle, but it does not establish the exact product, sales or emissions outcome of a lawful redesign.

A second counterfactual concerns independent review. A code inventory naming every condition that changed emissions control, paired with a reviewer outside the engine program and a release stop, would likely have exposed the dual mode before certification. This is a strong prevention counterfactual because the behavior was encoded and repeated. It still cannot prove that management would have canceled the program rather than finding another response.

A third concerns testing. Randomized portable road tests before launch could have observed the laboratory-to-road divergence years earlier. The 2014 study demonstrates detection capability, but earlier vehicles, equipment and routes might have produced different measurements. The defensible claim is acceleration of detection, not a guaranteed date.

A fourth concerns the 2012 hardware failures. Treating unexpected clean-mode operation as a reportable compliance incident could have forced a vehicle population review and regulator disclosure. That would probably have shortened the period of continued certification. It cannot establish the exact number of vehicles, emissions or consumer losses avoided.

A fifth concerns 2014 response. Full disclosure when regulators first presented the road data, instead of explanations and a recall that did not resolve the discrepancy, would have reduced investigative delay. Earlier containment could have stopped additional model-year exposure. No counterfactual can calculate exact avoided health outcomes without assumptions about fleet activity, atmospheric chemistry, exposure and remedy timing.

Governance reform was substantial, but certification is not permanent proof

The U.S. criminal and civil resolutions imposed external oversight and specific preventive controls. EPA's settlement summary says Volkswagen had to separate personnel who test emissions compliance from those who design vehicles, establish a Clean Air Act steering committee, improve training, create whistleblower mechanisms and retain an independent compliance auditor. The criminal plea added a monitor over anti-fraud and environmental compliance.

Volkswagen announced completion of the monitorship in September 2020. Its end-of-monitorship record says the independent monitor certified that covered entities had designed and implemented a program intended to prevent and detect anti-fraud and environmental violations, with changes to technical development, governance, risk management, compliance and legal functions. Porsche AG and Porsche Cars North America were outside that monitorship certification, an important scope limit.

The company also published the result of the independent compliance auditor's final civil audit. Volkswagen's July 2020 release says the final report found no new violations and that reviewed entities met obligations under the third partial consent decrees. That is stronger than an unsupported self-assessment because it reports an independent auditor's conclusion under a court order. Public access and scope are still limited compared with a full reproducible test archive.

The monitor's nonpublic material illustrates the transparency boundary. A later Justice Department summary of litigation over disclosure of a monitor report notes extensive interviews, meetings, policy review, recommendations and observations, while addressing lawful redactions. Monitoring can be independent and still leave outsiders unable to replay its evidence. Completion proves satisfaction of a defined term, not permanent elimination of risk.

Durable repair evidence must test behavior, authority and fleet outcomes

An accountable closure package would contain at least six linked evidence sets. The first is software provenance: source commit, build environment, calibration package, signer, reviewers, production hash and a machine-readable inventory of every condition affecting emissions. The second is legal mapping: each strategy tied to a requirement, disclosed exception or regulator approval. The third is test coverage: laboratory cycles, randomized cycles, road routes, temperature and altitude ranges, aging, diagnostic behavior and statistical sampling rationale.

The fourth is fleet recovery: original eligible population by engine, model year and region; buybacks; scrappage; exports; approved modifications; failed or reversed modifications; unreachable owners; current registrations; and remaining open vehicles. Percentages need denominators and dates. A vehicle paid under a consumer program should not automatically be counted as repaired. A bought-back vehicle should not be counted as removed until disposition rules are satisfied.

The fifth is environmental performance: measured pre- and post-modification nitrogen oxides, warranty failures, aged-vehicle retests and trust-project reductions with baselines. Modeled benefits should be distinguished from measured tailpipe results. The sixth is governance operation: objections filed, issues stopped, exceptions overdue, regulator disclosures, independent test failures and board review. Counts should be normalized by programs and releases so increased reporting is not mistaken for increased wrongdoing.

These records should be connected by stable identifiers. A certification should point to exact executable software. A dealer modification should point to the approved package. A test result should identify the vehicle configuration and mileage. A legal exception should identify the code paths it covers. A board dashboard should expose unresolved high-risk strategies without displaying only aggregated compliance training. Traceability is the difference between a policy and a control.

The accountability finding

Volkswagen's defeat device was not simply a case of software defeating a laboratory test. It was a case of an institution allowing a laboratory test to define the truth it was willing to observe. The code embodied that choice, but product targets, approval authority, repeated certification, limited independent testing, escalation failure and delayed disclosure made it durable. External road testing succeeded because it changed the conditions under which truth was measured.

Responsibility is therefore layered but not diffuse. Volkswagen AG bears corporate accountability established by its guilty plea and by civil and regulatory resolutions. Engineers, supervisors, managers, contractors, regional entities, boards, regulators, dealers and owners had different forms of control, but they did not have equal knowledge or authority. Individual liability depends on the disposition of individual cases. Regulatory weakness does not erase manufacturer duty. Consumer possession does not transfer responsibility for hidden code.

Recovery evidence is substantial: enormous consumer redress, vehicle buybacks and approved modifications, environmental mitigation, zero-emission investment, penalties, governance requirements, independent auditing and a completed monitor term. Global litigation and company-reported provisions show that the legal and financial boundary remained active years later. Public evidence is strongest for U.S. program execution and weaker for a single worldwide account of vehicle outcomes and enduring real-world performance.

The durable standard is behavioral. A compliant vehicle must remain compliant when the route, steering input, temperature, test order and observer change. A compliant institution must surface an infeasible product target before code hides it, preserve dissent, give independent reviewers a stop right, disclose material strategies and prove repair against a dated denominator. When software can recognize the examiner, accountability begins by ensuring that neither the product nor the organization gets to choose when the rules apply.