Ask most transport managers which download window applies to which device and a surprising number will get it backwards. The vehicle unit is 28 days, they'll say. The driver card is 90. Confident. Wrong both ways.
I made the same assumption when I first got into the compliance side of things. Figured the driver card — the one you carry on your person, the small smart card you insert on every shift — would be the less urgent thing to pull. It's on you. You'll hand it in. It'll get done.
The rules don't see it that way. The driver card has to come down every 28 calendar days. The vehicle unit — the big black box bolted into the dashboard — every 90. And both windows have an additional trigger that catches operators who aren't paying attention.
The actual download schedule
Operators must download data from the vehicle unit at least every 90 calendar days. From driver cards, it's every 28 calendar days. Both of these are minimum frequencies — there's nothing stopping you downloading more often, and for anything above a handful of vehicles, more frequent downloads are standard practice.
But both windows also have a trigger download requirement on top of the calendar deadline. For the vehicle unit: you must also download immediately before transferring control of the vehicle to someone else, and without delay if a malfunction is detected or data loss is likely. For the driver card: you must also download immediately before a driver's employment ends — and without delay if the card is damaged or malfunctioning.
That last one — download before employment ends — is the trigger most agencies miss. I covered it in the record-keeping post, but it's worth repeating here: the 28-day calendar window doesn't suspend your obligation to download a departing driver's card. Before they go, you pull the data. Not within 28 days of when they leave. Before.
Why the card window is tighter than the VU
It comes down to data capacity. A driver card holds a rolling window of data — roughly the last 28 days of activity in typical use, though the exact capacity depends on the card generation and how many activities are recorded. Once that capacity is reached, the oldest records start to be overwritten.
The vehicle unit has substantially more storage — typically 365 days or more of activity for a single vehicle. So the 90-day window isn't driven by storage limits the way the 28-day card window is. It's a compliance interval. The card interval is structural.
This means that if an operator is running on a 90-day everything schedule — which some small operators do, treating all their download obligations as a single quarterly task — they're already breaching on every driver card. Every month that passes without a card download is a month in breach. DVSA check the download timestamps when they audit. They compare the date of the last download on the card against the date of the check. If it's been 35 days, that's a gap. If it's been 60 days, that's a significant gap.
What the data actually shows
When a vehicle unit is downloaded, the data includes everything the tacho has recorded: driving time, speed, location events (for smart tachos), activity modes, card insertions and withdrawals, any manual entries and printouts. Analysts use this to cross-check driver card data — if the card says the driver was resting and the VU says the vehicle was moving, that's an immediate flag.
Smart tachographs (version 2, introduced from August 2023 for new vehicles) record even more — they automatically detect country crossings and record GNSS position at journey start and end, border crossings, and regular intervals. Which means the scope for cross-referencing is higher, and the scope for gaps between what the driver's card says and what the vehicle recorded is correspondingly smaller.
Downloading both devices regularly gives you the data to check your own compliance before DVSA do. That's the actual point. The mandatory download interval isn't about bureaucracy for its own sake — it's about making sure the operator has seen the data and acted on anything problematic inside a reasonable window. If there's been an infringement, you should know about it within 28 days of it happening, not find out from an enforcement officer six months later.
The malfunction download: a situation that catches operators flat-footed
Both the VU and the driver card have a malfunction trigger — you must download without delay if a fault is detected or if data loss is imminent. In practice, this means: if the tacho starts throwing fault codes, get the data off the unit before you send it to the workshop. If a driver's card is showing errors on insertion, download it before it gets any worse.
I've seen a small operator lose three weeks of VU data because a faulty unit was sent straight to the Stoneridge dealer without a download being taken first. The dealer's workshop wiped the internal memory during the repair process. No download meant no records. No records meant DVSA, during a routine check six weeks later, found a 90-day window with a three-week hole in it. That's a serious record-keeping failure, not a minor one.
The answer is simple enough: download before repair. It takes five minutes with the right software. It's not a complicated process. But it requires someone to think of it at the point where a van with a broken tacho has just arrived in the yard and there are seven other things that need doing before end of shift.
How long to keep what you download
Operators must be able to produce downloaded records to enforcement officers for 12 months. That applies to digital tachograph data, analogue charts, manual records, and any printouts. Twelve months from the date the driving occurred — not from the date of download.
Most fleet management software handles retention automatically. But for smaller operators running their own download infrastructure, it's worth being explicit about the retention policy. Twelve months minimum, indexed in a way that lets you find records for a specific vehicle and date range quickly if you need to.
Drivers must also be able to produce records at roadside — the current day plus the previous 28 calendar days for domestic and assimilated-rules journeys, or 56 days if doing international work into EU countries. The roadside obligation is on the driver. The 12-month retention is on the operator. Both are separate requirements and both apply.
The print-at-roadside situation
A digital tacho can produce a printout directly from its own head. The driver uses this when asked to demonstrate compliance at roadside — and it's a skill that more drivers should know how to do instinctively. The printout shows activity summaries, timing, any infringement flags. An enforcement officer can read it faster than interpreting the card download on a laptop.
For the operator, the printout produced at roadside is separate from the download obligation. The download is the operator's record. The printout is what the driver hands over. A driver whose printout shows a clean record, from a vehicle whose last download was 95 days ago — the officer sees both. The clean printout doesn't cancel the late download. Both get noted.
What happens if you miss the window
Missing the download window — whether by a few days or a few months — goes on the OCRS record for the operator. The Traffic Commissioner can ask about it at a public inquiry if the operator's overall compliance profile is under scrutiny. It's not usually a standalone licensing issue, but it compounds.
A 12-vehicle fleet I know — running general haulage out of a yard near Birmingham — went through a targeted DVSA check after a roadside stop flagged a late driver card download. The visit uncovered a pattern of 30-35 day card download intervals. Technically, every one of those was a breach. The operator's TM had thought the window was 35 days. It's 28. Six weeks later, there was a letter from the Traffic Commissioner's office asking the operator to attend a public inquiry to discuss the compliance record.
None of that had to happen. The window is 28 days. Set a reminder. Download every three weeks if you want a margin. It is not a complicated interval to hit.
The smart tacho upgrade timeline
From August 2023, new vehicles entering service in Great Britain must be fitted with version 2 smart tachographs. Vehicles fitted with version 1 smart tachographs from 2019 onwards will require retrofitting by 2025 — the DVSA enforcement date for that was June 2025. Analogue vehicles operating internationally into EU countries needed retrofitting by August 2025.
The download obligations are the same regardless of tacho generation — 28 days for card, 90 days for VU — but the data volume and the remote download capability changes. Some version 2 smart tachos support remote download via GNSS, which means operators can pull data without the vehicle returning to the depot. Which removes some of the logistical friction around the download schedule.
Remote download doesn't change the legal requirement. You still need to download within the window. But it makes it easier to stay compliant for fleets that operate out of multiple sites or whose vehicles don't regularly return to base.
A quick check on your own schedule
If you're a TM or an operator reading this: when did your last driver card downloads happen? Check the download timestamps in your fleet software for any card that hasn't been pulled in the last three weeks. That's your immediate risk. Then look at your VU download log and make sure nothing's creeping past 85 days.
If you're a driver: know how to produce a printout from your tacho head. Know how to check when your card was last downloaded (the tacho displays this). Know what your own 28-day obligation looks like in terms of records you should be carrying.
If you want the download schedule and compliance data managed automatically rather than tracked in a spreadsheet, ShiftOwt handles 561/WTD compliance tracking — £5.99/mo for drivers, fleet pricing on request.
The full picture on what OCRS looks like when download failures stack up alongside other compliance gaps is in the OCRS post. And if you want to understand the operator obligations in a wider context, the record-keeping post covers the retention and production requirements alongside the download schedule.