· 10 min read
Company Card Tacho: A Practical Guide for UK Operators
What a company card tacho does, who needs one, and how UK operators manage downloads, retention and audits without dropping evidence.
Monday morning in a transport office rarely starts with a blank page. The transport manager is checking which driver cards need downloading, which vehicle units are approaching their download date, whether a vehicle has moved between depots, and whether last week's infringement reports were signed. The company card tacho sits at the centre of that routine, but the card itself isn't the compliance system. It's the operator's access key, and the evidence only becomes useful when someone downloads, analyses, reviews and stores it properly.
For goods vehicle and PSV operators, that process connects directly to the operator licence. Tachograph files sit alongside safety inspection records, defect reports, driver licence and CPC checks, maintenance dates and the monthly compliance pack. A card in a drawer, an unlabelled file on a USB stick or an unsigned report doesn't give a transport manager a defensible record when DVSA asks how the business controls its fleet.
Table of Contents
- What a Company Card Tacho Does on Your Fleet
- Who Needs a Company Card and How to Get One
- Download Rules, Lock-In and 12-Month Retention
- From Download to Signed Infringement Report
- Connecting the Company Card to Wider Operator Compliance
- Common Pitfalls That Catch Operators Out
- Managing the Process Manually or With a Platform
- Putting the Company Card Workflow on a Routine
What a Company Card Tacho Does on Your Fleet
The first question is simple: what does the company card tacho control? It gives the operator access to vehicle-unit data, identifies the business using that access and allows the company lock to be applied. The compliance value comes from the complete workflow, from inserting the card and downloading files to matching records, analysing activity and retaining evidence.
The card is also called a company, or control, tachograph card. It differs from a driver card, which records an individual driver's activity, and from workshop or enforcement cards, which have separate functions. Issued in the company name, it acts as an electronic key for the operator's tachograph data. Under the UK framework set out in the Passenger and Goods Vehicles Tachograph Card Fees Regulations, it identifies the business and controls access to vehicle-unit information. It is not a general data-storage card.
The practical job of the card
Insert the company card into either card slot and the operator can download data from the vehicle unit. The card also allows the operator to apply the vehicle unit's company lock, protecting the operator's data from unauthorised access. GOV.UK's vehicle operator guidance confirms that company cards are used to download vehicle-unit data and lock in drivers' details.
The card can:
- Pull data: Retrieve vehicle-unit files and support the collection of driver-card files through the appropriate download process.
- Identify the operator: Associate the download and lock function with the company named on the card.
- Protect access: Lock company data in the vehicle unit so the same company card access is required later.
- Support a calendar: Give the compliance team a clear item to monitor alongside vehicles, drivers and due dates.
The card proves access and control. It does not prove that the operator analysed the data or dealt with an infringement.
Remote downloads and card readers follow the same principle. The hardware and tachograph card reader process provide the collection point. Someone must still match each file to the correct vehicle or driver, confirm that the company lock is present, analyse the activity and retain the audit trail. That record is what supports the monthly compliance pack and gives the operator evidence of control.
Practical rule: Treat the company card as a controlled access credential, not as proof that the compliance task is finished.
Who Needs a Company Card and How to Get One
If a vehicle operator needs to download its own tachograph data, the business needs a company card. This covers qualifying goods vehicle and passenger vehicle operators with a UK-based business presence. The legislation establishing the company card system requires the applicant to have the required UK business connection.
The application is made through DVLA's digital tachograph service or the relevant application route. Have the operator-licence information, company details and nominated cardholder's information ready before starting. The card is issued in the company name, so it does not replace a driver card. Check the DVLA application guidance for the current process and supporting requirements. For a closer look at the different card types, see this guide to digital tachograph cards.
Request, control and renewal
A company card remains valid for five years. Put renewal on the central compliance calendar well before expiry, particularly if several depots depend on separate cards. A named cardholder can manage an individual card, while the operator remains accountable for how all company cards are stored, issued and used.
One company can request up to 2,232 cards on one application. The cards share the same card number, while different issue numbers identify each card. That arrangement can suit a large fleet or several operating locations, but it needs a clear register. Record the cardholder, storage location, expiry date and downloads completed with each card. This gives the Monday download review a direct control check, rather than leaving card ownership to memory.
| Item | Detail |
|---|---|
| Purpose | Download vehicle-unit data and apply or maintain company access control |
| Issuer | DVLA, in the company name |
| Validity | Five years |
| Application route | DVLA digital tachograph service or the relevant application process |
| Multiple cards | One company can request up to 2,232 cards on one application, with issue numbers distinguishing cards |
| Lost or stolen card | Apply for a replacement online and update the card register |
| Ceased trading | Return all company cards to DVLA |
A lost or stolen card should be treated as a control incident until the replacement request and affected download coverage have been checked. The DVLA information for company card users confirms the online replacement route and the requirement to return cards when the company ceases trading. Remove expired, damaged or unallocated cards from circulation and update the register.
Download Rules, Lock-In and 12-Month Retention
Monday's download review should start with two separate clocks. The driver card contains roughly 28 days of activity, and the vehicle unit must be downloaded no later than every 90 calendar days, according to the tachograph download guidance. These are maximum operating limits, not targets to use for every situation. A driver leaving the business, a damaged card, a vehicle sale or a transfer between related operators should prompt an earlier download.
The risk is losing access to activity before it is captured. A missed driver-card window can overwrite older events before analysis. Delayed vehicle-unit collection can leave a gap in the records available for inspection. Set the calendar around the legal limit, then bring downloads forward where a change in people, vehicles or operators could interrupt coverage.
The lock-in step
The company lock associates vehicle-unit data with the operator. Insert the company card, select the relevant company-lock function on the download equipment, and check that the tool records the lock status. Equipment screens differ, so the transport manager must know what a successful lock looks like on the system in use.
A vehicle moving between businesses needs a specific handover check. Confirm the lock status, ownership or lease dates, operator record and files already stored. The company card does not automatically resolve historical data after a sale or transfer. The company card download and lock-in guidance provides a practical reference for planning downloads and checking coverage.
Retain downloaded tachograph records for at least 12 months. Keep the raw files with the evidence needed to explain what happened after analysis, including review notes and any response to identified issues. A download-only process leaves the operator unable to show how the records were managed.
A monthly compliance pack should make the chain easy to follow: original file, download date, analysis result, driver communication and corrective action. The person reviewing a file later should not need the original downloader's memory to reconstruct the decision.
A compliant archive should let someone else find the original file, the analysis, the driver discussion and the corrective action without relying on one person's memory.
From Download to Signed Infringement Report
A raw .ddd file shows recorded activity. It does not show that the operator reviewed the record, asked the driver for an explanation or acted on a problem. A defensible process therefore links the source data to the analysis, driver response and follow-up decision. That chain is what matters during a DVSA visit or Traffic Commissioner scrutiny, where a folder of downloads alone may not explain how the operator managed the findings.
Build the evidence trail
Analyse the source data. Check driver-card and vehicle-unit records against the applicable EU drivers' hours, AETR, GB domestic and Working Time rules. The review can identify rest or driving-time issues, speeding events, missing manual entries and card-not-inserted activity. Record the analysis date, ruleset used and any limitations in the file.
Create an infringement report. Each report should name the driver, identify the relevant date and rule, and state the action expected. A generic warning sent to an entire depot provides weak evidence because it does not show that the operator assessed the individual event.
Discuss the finding with the driver. Give the driver an opportunity to explain mitigating circumstances, correct an apparent misunderstanding and confirm receipt. Keep the communication and its outcome with the report. The original infringement list is not enough if the operator cannot show what was discussed.
Sign and archive the record. An electronic signature records acknowledgement of the report and any explanation provided. Store the signed report beside the source files and analysis log, retaining the complete record for at least 12 months, as required by the download and retention process described earlier.
A practical file index should answer these questions quickly:
- Which driver or vehicle is involved?
- What period does the source file cover?
- Which rule generated the finding?
- When did the manager review it?
- Where is the signed response and follow-up evidence?
Review timing affects the operator's ability to spot repeated behaviour, brief the driver and preserve a response before the next internal review. A monthly compliance cadence keeps raw data, decisions and remediation together instead of leaving files untouched until an audit.
The signature supports the evidence trail, but it does not complete the management task. The report should show the person involved, date, finding and audit history. The operator must still decide whether retraining, route planning, management action or further investigation is appropriate.
Connecting the Company Card to Wider Operator Compliance
A vehicle-unit download can be on time while the wider compliance system still has gaps. If the transport manager cannot see the vehicle's next safety inspection, defect history or maintenance evidence, the company card process is only showing part of the risk.
Build the central compliance calendar around linked records:
- Safety inspections: Planned dates, completed inspections, defects, rectification details and repairer information.
- Vehicle and trailer maintenance: Inspection intervals, annual test dates, brake-test evidence and vehicles temporarily off the road.
- Driver credentials: Licence entitlement checks, driver CPC records and tachograph-card expiry dates.
- Tachograph control: Download dates, analysis status, infringement reports and driver signatures.
- Operational events: Roadside prohibitions, recurring defect trends and actions assigned to named people.
For safety inspections, operators must retain records for at least 15 months for every vehicle, including vehicles removed from the operator licence. The file should contain defect reports, rectification details and repairer information, as set out in the GOV.UK Guide to Maintaining Roadworthiness. Tachograph records follow a separate 12-month retention expectation. Keep both evidence streams in the monthly pack, with their retention periods clearly labelled.
The monthly pack
A useful monthly pack records exceptions, decisions and follow-up, rather than showing only completed tasks. A late vehicle-unit download should include the reason and recovery action. A repeated infringement should connect to the driver review, response and any further action.
Electronic signatures can support the audit trail when the process identifies the signer and preserves the completed record. The legal standing of digital signatures depends in practice on the signature method, consent and audit information that support the document's reliability. The operator remains responsible for selecting a suitable process and retaining the underlying evidence.
The pack should also show who monitored the system, how exceptions were escalated and whether the transport manager exercised effective oversight. One indexed monthly file gives a Traffic Commissioner or DVSA examiner a clearer route through the evidence than separate depot emails, workshop folders and driver correspondence. It should link the company card download to analysis, sign-off, maintenance action and the decision recorded in the compliance calend
company card tachotachograph downloadsoperator licence complianceDVSA tachograph rulesdriver card downloads