How a Car Is Made: Materials, Parts and the Software Inside

A car is made by turning mined ore into steel, aluminium, copper, glass, rubber and plastics, stamping and joining those into a body, painting it, then fitting a powertrain, interior, wiring and dozens of computers on an assembly line. By weight, steel and iron are still the largest share: about 49% of one current electric SUV excluding its battery, with aluminium near 19% and polymers near 18%, according to the automaker's own life cycle assessment. An electric car adds a battery pack built from lithium, nickel, cobalt or iron phosphate, manganese and graphite, and every modern car now carries software that regulators treat as a safety component in its own right.

This guide walks the whole journey: the materials and where they are mined, how the body and powertrain are built, how a car is tested and certified, what software runs inside it and which rules govern that software, and what happens when the car is scrapped. Every figure comes from a primary source: the U.S. Geological Survey, the U.S. Department of Energy, the EPA, the U.S. Code of Federal Regulations, NHTSA, UNECE, and an automaker's published life cycle assessment.

Key takeaways

• Steel and iron make up roughly half of a car's weight even in a new electric model. Aluminium and polymers follow, then fluids, tyres and copper.
• A 10% cut in vehicle weight can improve fuel economy by 6% to 8%, according to the U.S. Department of Energy, which is why carmakers mix several steel grades with aluminium, magnesium and composites.
• Battery minerals are concentrated: in 2025 about 74% of mined cobalt came from Congo (Kinshasa), about two thirds of mined nickel from Indonesia, and about three quarters of natural graphite from China, per USGS.
• The build sequence is press shop, body in white, paint shop, powertrain, general assembly and end of line testing.
• In the U.S., manufacturers self certify that each vehicle meets the Federal Motor Vehicle Safety Standards in 49 CFR Part 571. Countries that apply UN Regulations use type approval instead.
• UNECE said in June 2020 that cars contain up to 150 electronic control units and about 100 million lines of code.
• UN Regulation 155 requires a certified cybersecurity management system that covers suppliers. UN Regulation 156 requires a software update management system that records every software version and its integrity data.
• NHTSA's 2022 cybersecurity best practices ask manufacturers to keep a software bill of materials per ECU and check open source components against known vulnerabilities.
• Recycling of the steel in scrapped cars in the U.S. is close to 100%, per USGS. Batteries, rare earth magnets and electronics are much harder to recover.

What is a car made of?

The best public answer to "what materials are required" comes from automakers' life cycle assessments, which have to list material composition by weight to calculate a carbon footprint. The table below uses the Polestar 4 SUV life cycle assessment (model year 2027), which breaks the car down into more than 70 material categories from its bill of materials. It is one vehicle, not an industry average, and the battery pack is excluded from the percentages because the report models it separately.

The same report gives total vehicle weights of 2,360 kg for the dual motor version and 2,238 kg for the rear motor version. So the battery pack alone is about a quarter of the car's mass.

Two things stand out. First, "electronics" is a tiny share by weight even though it carries most of the car's functions, which is why weight tables say little about where the complexity sits. Second, the report finds that material production causes 57.9% to 59.7% of the car's cradle to gate climate impact (battery excluded), with aluminium alone 35.2% to 37.2% of that and iron and steel 31.0% to 31.5%. Material choices matter for the environment long before the car is driven.

A combustion car has a similar overall mix without the large battery, plus an engine block, exhaust system and fuel tank. The engine block is usually cast iron or aluminium, and the exhaust carries a catalytic converter coated with platinum group metals.

Where do a car's raw materials come from?

Every material in the table starts in a mine, a well or a recycling yard. The U.S. Geological Survey's Mineral Commodity Summaries 2026 give world production for 2025, which shows how concentrated some of these supply chains are.

USGS figures for 2025 are estimates and some are revised in later editions. U.S. lithium production is withheld by USGS to protect company data, so the lithium world total excludes it.

Iron ore to steel

Steel is iron with a little carbon and other alloying elements. Integrated mills smelt iron ore in blast furnaces and convert the pig iron into steel; minimills melt scrap in electric arc furnaces. USGS reports that the U.S. made 82 million tons of raw steel in 2025 at integrated mills and 102 minimills, and that automotive took about 15% of U.S. net steel shipments. Manganese matters here too: USGS notes it "has no satisfactory substitute in its major applications," the biggest of which is steelmaking.

Car bodies do not use one steel. Engineers combine mild steels that form easily into complex panels, high strength low alloy steels for general structure, advanced high strength steels for crash members, and press hardened (hot stamped) boron steels for parts such as door pillars and roof rails that must resist intrusion. USGS notes that steel competes with "lighter materials, such as aluminum and plastics in the automotive industry," and the Department of Energy names high strength steel alongside magnesium alloys, aluminium alloys, carbon fibre and polymer composites as the main lightweighting options.

Bauxite to aluminium

Aluminium starts as bauxite, is refined to alumina, then smelted electrolytically, which uses large amounts of electricity. That is why the Polestar report attributes such a large share of the car's material emissions to aluminium and why automakers track whether their aluminium comes from smelters on renewable power or from recycled scrap. In the U.S., transportation applications took 36% of aluminium consumption in 2025, the largest single end use, according to USGS.

Copper

Copper carries electricity: the wiring harness, motor windings, busbars and charging hardware. USGS, citing the Copper Development Association, says transportation equipment used 18% of U.S. copper and copper alloy products. USGS also notes aluminium substitutes for copper in automobile radiators, one example of how material choices shift with price and weight.

Plastics, glass and rubber

Polymers come mostly from petrochemical feedstocks and appear as polypropylene bumpers and trim, polyurethane seat foam, polyamide parts under the bonnet, polycarbonate light lenses and PVC or other insulation on wires. Glass for windows is made from silica sand, soda ash and limestone; U.S. safety rules for vehicle glazing sit in Federal Motor Vehicle Safety Standard 205, and windshield mounting in Standard 212. Tyres combine natural rubber from plantations with synthetic rubber, carbon black, silica, steel belts and textile cords, and Standard 139 covers new radial tyres for light vehicles.

Platinum group metals

The leading U.S. use of platinum group metals is catalytic converters "to decrease harmful emissions from automobiles," according to USGS. Palladium replaced platinum in most gasoline converters because it was historically cheaper, and USGS notes about 25% of palladium can routinely be substituted for platinum in diesel converters. Battery electric cars have no exhaust and no catalytic converter.

Rare earths for motors

Many electric drive motors and small motors use neodymium iron boron permanent magnets. USGS says the estimated leading global use of rare earths was magnets, and that China mined about 270,000 of the world's 390,000 tons of rare earth oxide in 2025. Not every motor uses magnets: induction motors and wound rotor motors avoid them, at some cost to efficiency or size.

What minerals are in an electric car battery?

An EV battery pack is many cells grouped into modules, grouped into a pack. The EPA lists the common materials in lithium ion batteries as lithium, nickel, cobalt, manganese, graphite, iron, copper and aluminium foils and a usually flammable electrolyte. It notes that lithium nickel cobalt aluminium oxide chemistries "are often used for electric vehicle batteries," and that EV packs "may require hundreds or even thousands of cells."

The main chemistry families, described at a conceptual level:

The anode in all three is usually graphite, natural or synthetic. Copper foil carries current on the anode side and aluminium foil on the cathode side.

USGS ties the market directly to cars. Batteries were 88% of global lithium end use in 2025, with consumption for batteries rising "owing to the use of rechargeable lithium batteries in the growing market for electric vehicles." On cobalt, USGS says the cobalt content of lithium ion batteries "was being decreased" and that cobalt free chemistries using iron and phosphorus "held significant market share in China." The EPA notes that aluminium, lithium, nickel, cobalt, manganese and graphite were all on the USGS 2022 critical minerals list.

The Polestar 4 example gives a sense of scale: a 100 kWh NMC pack of 589 kg, of which 407 kg is cells. The heaviest non cell parts, the report says, are the aluminium tray that holds the cells and the high voltage cables.

How is a car designed before it is built?

Long before a press stamps a panel, an automaker fixes the requirements: vehicle class, target markets, safety ratings to aim for, range or fuel economy, cost and the regulations of every country it will be sold in. Most new models are built on a shared platform, so the floor, crash structure, electrical architecture and many control units are reused across several body styles. The Polestar report, for example, says the Polestar 4 SUV and Polestar 4 coupé "share most of its components" and the same vehicle platform.

From the requirements come a bill of materials and a supplier plan. Car companies make some parts themselves, often the body, paint and final assembly, and sometimes engines, motors or battery packs, and buy the rest from layers of suppliers. Industry calls direct suppliers tier 1, their suppliers tier 2, and so on down to the mines and smelters. Each tier also supplies software for the parts it makes, which is why the software supply chain of a car looks like its hardware supply chain.

Components and suppliers by category

The table describes categories, not specific companies, and roles differ by automaker. Some build their own battery packs or infotainment software; others buy complete modules.

How is a car made, step by step?

Car factories follow the same broad sequence worldwide. What follows is a conceptual tour, not a process manual.

1. Press shop: stamping

Steel and aluminium arrive as large coils. Blanking lines unroll and cut them into flat blanks, and transfer or tandem presses form each blank through several dies into a door outer, roof, side panel or floor section. Press hardened parts follow a different route: the blank is heated in a furnace, formed and quenched in a cooled die, which gives the very high strength used in safety cages. Aluminium can also be cast; some automakers now cast large single pieces for the front or rear underbody to replace dozens of stamped parts.

2. Body shop: the body in white

The stamped parts are joined into the bare structure the industry calls the body in white. Robots do most of the joining using resistance spot welding, laser welding, structural adhesives, self piercing rivets and flow drill screws. Mixed steel and aluminium bodies need mechanical joints or adhesives because the two metals do not weld directly in the conventional way. Doors, bonnet and boot lid (the closures) are hung on the body so they go through paint with it, then often removed again later so the interior can be fitted.

Dimensional accuracy is checked with measuring stations and coordinate measuring machines. The DOE says replacing cast iron and traditional steel with lightweight materials can cut the weight of a vehicle's body and chassis "by up to 50 percent," which is the engineering pressure behind every mixed material body.

3. Paint shop

Paint does two jobs: stop corrosion and look good. The body is cleaned, given a phosphate or similar conversion coating, then dipped into an electrocoat tank where an electric current deposits an even primer layer inside every cavity. After curing in an oven, seams are sealed, under body coatings applied, then primer, colour base coat and clear coat are sprayed, mostly by robots, with oven cures between stages.

4. Powertrain: engine, motor and battery

For a combustion car, the engine is machined from cast blocks and heads, assembled with crankshaft, pistons and valve train, and tested. For an electric car, the motor stator is wound with copper, the rotor carries magnets or conductors, and an inverter converts battery DC to the AC the motor needs. Battery packs are assembled in clean, dry rooms: cells into modules, modules into the tray with cooling plates, busbars and the battery management system, then sealed and tested. Transmissions or single speed reduction gears are machined and assembled from hardened steel gears.

5. General assembly

The painted body enters the assembly line, which is where most of the parts you can see go on. The wiring harness is routed first, followed by the dashboard module, glazing, headliner, carpets, seats, door modules and trim. The "marriage" joins the body to the powertrain and chassis, which come up from below. Wheels, fluids, the 12 volt battery and the high voltage battery (for an EV) follow.

Software arrives here too. Control units are usually delivered with base software from their supplier, and the plant flashes the final software and configuration for that specific car, codes the variant and records the versions. Under UN Regulation 156, manufacturers must be able to say, for every vehicle type, which software versions are installed and keep integrity data for them.

6. End of line testing and quality

Before shipping, each car goes through checks: wheel alignment, headlamp aim, a rolling road for brakes and drive, a water test for leaks, electrical and diagnostic checks of every control unit, and often a short test drive. Audits pull random cars for detailed inspection. Problems found later in the field lead to recalls, which can now sometimes be fixed by an over the air update.

How is a new car tested and certified?

There are two main legal models, and they shape how a car is tested.

United States: self certification against FMVSS

NHTSA issues the Federal Motor Vehicle Safety Standards to implement laws from Congress. The standards live in 49 CFR Part 571 and cover controls and displays (101), lighting (108), rear visibility (111), theft protection and rollaway prevention (114), light vehicle brakes (135), tyre pressure monitoring (138), new radial tyres (139), occupant crash protection (208), seat belts (209), side impact (214), roof crush (216a), ejection mitigation (226), fuel system integrity (301), and electric vehicle electrolyte spillage and electrical shock protection (305, with an upgraded Standard 305a on electric powertrain integrity mandatory from 1 September 2027).

Manufacturers do not get permission in advance. Instead, 49 CFR 567.4 requires a label on every passenger car stating: "This vehicle conforms to all applicable Federal motor vehicle safety, bumper, and theft prevention standards in effect on the date of manufacture shown above." The manufacturer runs whatever tests it needs to be confident that statement is true, and NHTSA can test cars from the market to check.

The crash tests are specific. Standard 208, for example, includes a frontal test in which the vehicle travels "at any speed, up to and including 56 km/h (35 mph), into a fixed rigid barrier," with instrumented test dummies that must stay within injury criteria. Other tests use offset deformable barriers and smaller female dummies. Consumer rating programmes run additional tests beyond the legal minimum.

UN Regulations and type approval

Many other countries use the UNECE 1958 Agreement. Under it, a national approval authority, helped by a technical service, approves a vehicle type before it can be sold, against UN Regulations covering similar ground (brakes, lighting, crash protection, emissions and now cybersecurity and software updates). UNECE said in 2020 that the 1958 Agreement had 54 Contracting Parties. The European Union, Japan and the Republic of Korea are among the large markets that apply UN Regulations, through their own laws.

The practical difference: under type approval an authority checks before sale; under self certification the manufacturer takes legal responsibility and the regulator enforces afterwards. Both models expect the manufacturer to have documented tests and controlled production so every car matches the approved or certified design.

Emissions and fuel economy

Combustion and hybrid vehicles are also tested for exhaust emissions and fuel economy, and EVs for range and energy use. The EPA's Automotive Trends Report shows how design choices add up: average real world fuel economy for model year 2024 new vehicles reached a record 27.2 mpg, while average horsepower, weight and footprint "have all generally increased in recent years." The same report says that without battery electric and plug in hybrids, the average model year 2024 vehicle would have weighed 72 pounds less.

What software is inside a modern car?

A modern car is a network of computers. UNECE's June 2020 press release said "cars contain up to 150 electronic control units and about 100 million lines of software code," and projected that would rise to 300 million lines by 2030. Those figures are UNECE's, quoted from industry sources; counts vary widely by model and how you count, so treat them as an order of magnitude.

The main software groups:

• Powertrain control. Engine control, inverter and motor control, battery management, thermal management and the charging controller.
• Chassis and safety. Antilock brakes and stability control, electric power steering, airbag control and suspension.
• Body and comfort. Door, seat, lighting, climate and keyless entry modules.
• Driver assistance. Camera, radar and sensor fusion software for lane keeping, adaptive cruise and automatic emergency braking.
• Infotainment and telematics. Head units running full operating systems, apps, maps, the cellular modem and the connection to the automaker's cloud.
• Gateways. Units that route traffic between in vehicle networks and isolate safety critical buses from external connections.

Control units talk over in vehicle networks such as CAN, CAN FD, LIN and automotive Ethernet; our guide to CAN, CAN FD and LIN explains the differences. Much of the embedded software follows the AUTOSAR architecture, in its Classic form for deeply embedded units and its Adaptive form for high performance computers; see AUTOSAR Classic vs Adaptive. A lot of that code is C and C++, with the memory safety issues that implies, covered in C and C++ security in software defined vehicles.

Where does all this software come from? The same layered supply chain as the hardware. A tier 1 supplier writes application software for its control unit on top of a real time operating system, communication stacks and libraries from other vendors, and often open source components such as Linux, compression libraries, TLS libraries and network tools in infotainment and telematics units. NHTSA's 2022 guidance defines a software bill of materials as "a list of components in a piece of software, including assembled open source and commercial software components."

What rules govern car software and cybersecurity?

UN Regulation 155: cybersecurity management systems

UN Regulation 155 was adopted by the UNECE World Forum for Harmonization of Vehicle Regulations (WP.29) in June 2020. Per UNECE, it applies to passenger cars, vans, trucks and buses, to light four wheelers with automated driving from level 3, and to trailers fitted with at least one electronic control unit. The manufacturer must hold a Certificate of Compliance for its Cyber Security Management System (CSMS), which "shall remain valid for a maximum of three years" (paragraph 6.7).

Paragraph 7.2.2.2 requires processes to identify, assess and treat risks, test that mitigations work, and "monitor for, detect and respond to cyber-attacks," including vehicles after first registration. Two clauses make it a supply chain rule:

• Paragraph 7.2.2.5: the manufacturer must show how its CSMS "will manage dependencies that may exist with contracted suppliers, service providers or manufacturer's sub-organizations."
• Paragraph 7.3.2: for the vehicle type being approved, the manufacturer "shall identify and manage" supplier related risks.

Annex 5 lists threats the risk assessment must consider. Threat group 12 covers software updates, including compromise of over the air updates, compromise of local updates, "the software is manipulated before the update," and compromise of signing keys. Our explainers on R155, R156 and ISO/SAE 21434 in plain terms and what CSMS auditors look for go deeper.

UN Regulation 156: software update management systems

UN Regulation 156 covers software updates and gave "a legal basis for so-called Over-the-Air (O.T.A.) updates," in UNECE's words. Its requirements read like a software inventory specification:

• Paragraph 7.1.1.2: a process to document "all initial and updated software versions, including integrity validation data, and relevant hardware components."
• The RX Software Identification Number (RXSWIN), defined in paragraph 2.2, identifies the type approval relevant software of a control system. Each RXSWIN must be readable in a standardised way, "at least by the standard interface (OBD port)" (7.2.1.2.2).
• Paragraph 7.1.1.5 requires a process to identify interdependencies of the updated system with other systems, and 7.1.1.7 to confirm compatibility with the target vehicle's configuration.
• Paragraph 7.2.1.1: "The authenticity and integrity of software updates shall be protected."
• For over the air updates, the vehicle must be able to restore the previous version or reach a safe state after a failed or interrupted update (7.2.2.1.1), and only run an update when it has enough power to finish.

Timeline of the software rules

United States: NHTSA cybersecurity best practices

The U.S. has no FMVSS for cybersecurity. NHTSA instead publishes non binding guidance, last updated in September 2022. Three of its general practices map directly to software supply chain work:

• G.10: suppliers and manufacturers "should maintain a database of their operational hardware and software components used in each automotive ECU, each assembled vehicle, and a history log of version updates applied over the vehicle's lifetime."
• G.11: manufacturers should track software components in enough detail that when a new vulnerability is found in open source or off the shelf software, they "can quickly identify what ECUs and specific vehicles would be affected."
• G.12: manufacturers "should evaluate all commercial off-the-shelf and open-source software components used in vehicle ECUs against known vulnerabilities."

For how SBOMs are used in automotive programmes, see software bills of materials in the automotive industry and HBOM vs SBOM.

Comparing the three regimes

What happens to a car at the end of its life?

Steel: the best recycled material in the car

USGS reports that recycling of automobiles in the U.S. "is nearly 100% each year." More than 13 million tons of steel per year is recycled from automobiles, the equivalent of about 17 million cars, through more than 280 car shredders in North America. A scrapped car is drained of fluids, stripped of reusable parts and the battery, then shredded; magnets pull out the steel, and eddy current and other separators recover non ferrous metals. The leftover mix of plastics, foam, glass and rubber, often called shredder residue, is the hard part.

Aluminium, copper and platinum group metals

USGS reports 3.6 million tons of aluminium recovered from purchased scrap in the U.S. in 2025, with old scrap equal to about 28% of apparent consumption. For platinum group metals, about 50,000 kg of palladium and 8,600 kg of platinum were recovered from automobile catalytic converters in the U.S. in 2025, according to USGS. Copper from wiring harnesses is recovered but has to be separated from insulation and from steel scrap, where it is an unwanted contaminant.

Batteries

EV batteries are a separate stream. The EPA says most lithium ion batteries on the market are likely to be hazardous wastes when disposed of, because they "may catch fire or explode if not handled carefully," and has announced plans to propose new universal waste rules for lithium batteries. It also notes that end of life batteries "contain valuable critical minerals needed in the production of new batteries." USGS adds that automobile companies and battery recyclers have "partnered to supply the automobile industry with a source of battery materials," and that cobalt in purchased scrap covered 25% of estimated U.S. cobalt consumption in 2025.

Magnets and electronics

Rare earth recycling is limited: USGS says only "limited quantities" are recovered from batteries, permanent magnets and lamps. Circuit boards contain gold, silver, copper and palladium but are small and mixed with plastics.

Software and data at end of life

A scrapped or resold car still holds data: paired phones, saved addresses, account tokens for the automaker's app and sometimes stored credentials for home chargers. Factory reset the head unit and remove the car from the manufacturer's app before selling or scrapping it. Fleet operators should treat telematics units as they treat laptops at decommissioning.

Step by step: building a software inventory for vehicle software

If your team builds software that ends up in a vehicle, at a tier 1 supplier, an automaker or a company making apps, telematics or charging software, the NHTSA practices and the R156 recording rules come down to the same habit: know what is in each build and keep that record over time. A practical starting point:

1. Generate an SBOM for each build you ship

For a source repository, for example the Linux userland or the companion app of an infotainment unit:

# scan the build tree and write results as JSON under ./output
safeguard scan --dir .

For build tools and services you run in containers, such as the backend that signs and distributes update packages:

safeguard scan --image registry.example.com/ota-backend:2026.10.1

2. Ingest supplier SBOMs instead of filing them

When a supplier delivers a control unit with an SBOM, scan the SBOM file so its components are matched against vulnerability data like your own code:

safeguard scan --sbom supplier-telematics-unit.cdx.json

3. Tie software to ECU and version

Record which ECU and software version each SBOM belongs to, so you can answer G.11's question of which ECUs and vehicles are affected. CycloneDX metadata can carry that link. An illustrative fragment:

{
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "metadata": {
    "component": {
      "type": "firmware",
      "name": "telematics-control-unit",
      "version": "TCU-SW-04.12.0"
    },
    "properties": [
      { "name": "vehicle:ecu", "value": "TCU" },
      { "name": "vehicle:rxswin", "value": "example-rxswin-value" }
    ]
  }
}

The property names here are examples, not a standard; agree a convention with your partners and use it everywhere.

4. Answer "do we ship this component?" quickly

When a new advisory lands, query every stored SBOM for the component. With plain files and jq:

# list SBOM files that contain any version of zlib
for f in sboms/*.json; do
  jq -e '.components[]? | select(.name=="zlib") | .version' "$f" >/dev/null && echo "$f"
done

In the Safeguard platform, the same question is answered by looking up which projects contain a given component and version.

5. Keep history

R156 asks for an auditable register of software before and after each update, and NHTSA asks for a history log over the vehicle's lifetime. Store every SBOM you generate or receive alongside the release it describes, and do not overwrite old ones.

Where Safeguard fits, honestly

Safeguard does not make, test or certify cars, and it does not secure a vehicle, its networks or its control units. It does not inspect hardware, analyse firmware binaries or generate hardware bills of materials. The overlap is narrow and specific: the software supply chain of the code that goes into vehicles and the systems around them. Safeguard scans repositories, container images and SBOM files, including SBOMs supplied by other companies, matches components against vulnerability databases, applies reachability analysis, shows which projects carry a given component and version, and can open fix pull requests for dependencies. That supports the kind of software inventory and known vulnerability checks that NHTSA's G.10 to G.12 describe and that a CSMS needs as evidence; it does not by itself make an organisation compliant with R155 or R156. For a broader programme view, see building an automotive software supply chain programme from zero, and for the firmware side, our firmware supply chain guide.

Common mistakes

These are the misconceptions that come up most often when people ask how cars are made.

• "Modern cars are mostly aluminium and plastic." Not by weight. Even the electric SUV in the Polestar report is about 49% steel and iron excluding its battery, with aluminium near 19% and polymers near 18%.
• "Electric cars do not need much mining." They avoid exhaust catalysts and engine blocks, but the battery pack can be a quarter of the car's mass and depends on lithium, graphite and, depending on chemistry, nickel, cobalt and manganese, plus copper and often rare earth magnets.
• "All EV batteries contain cobalt." No. USGS reports cobalt free iron phosphate chemistries held significant market share in China, and the EPA lists several chemistry families.
• "One steel is used for the whole body." Bodies mix mild, high strength and press hardened steels, plus aluminium, so each zone can be formable, stiff or intrusion resistant as needed.
• "In the U.S., the government approves each new model before sale." Under FMVSS, manufacturers self certify and label each vehicle; NHTSA enforces afterwards. Pre sale approval is the type approval model used under UN Regulations.
• "Over the air updates are unregulated." Where UN R156 applies, updates need a certified management system, integrity protection, recorded versions and safe recovery from failed updates.
• "Car software is all written by the carmaker." Most control units come from suppliers whose code includes third party and open source components, which is why R155 and NHTSA both focus on suppliers.
• "Line of code counts are precise." The widely quoted 100 million lines figure is an order of magnitude that UNECE cited in 2020; real counts vary by model and method.
• "Scrapped cars are fully recycled." The steel almost entirely is. Plastics, foam, glass, rare earth magnets and electronics are recovered far less.

FAQ

How is a car made, in simple terms?

Raw materials are turned into steel, aluminium, glass, rubber and plastics. Steel and aluminium are stamped into panels and joined into a body, which is painted. The engine or electric motor and battery are built separately, then everything comes together on the assembly line, the software is flashed, and each car is tested before it ships.

What materials are needed to make a car?

Mainly steel and iron, aluminium, polymers, glass, rubber and copper, plus fluids. An electric car adds a lithium ion battery made with lithium, graphite, aluminium and copper foils, and nickel, cobalt and manganese or iron phosphate in the cathode. Combustion cars need platinum group metals for catalytic converters.

What percentage of a car is steel?

It varies by model. In the Polestar 4 SUV life cycle assessment, steel and iron are 48.0% to 48.9% of vehicle weight excluding the battery pack. USGS says automotive took about 15% of U.S. steel shipments in 2025.

What minerals are in an electric car battery?

Lithium, graphite, and depending on chemistry, nickel, cobalt and manganese (NMC), nickel, cobalt and aluminium (NCA), or iron and phosphate (LFP). Aluminium and copper foils, an electrolyte and the pack structure complete it.

Where do lithium and cobalt come from?

Per USGS estimates for 2025, Australia, China, Chile, Zimbabwe and Argentina mined most lithium. Congo (Kinshasa) mined about 230,000 of the world's 310,000 tons of cobalt, followed by Indonesia.

How are cars crash tested?

In the U.S., FMVSS 208 includes a frontal test into a fixed rigid barrier at up to 56 km/h (35 mph) with instrumented dummies, alongside side impact, roof crush and other standards. Manufacturers certify compliance; NHTSA can test vehicles from the market.

How many computers and lines of code are in a car?

UNECE said in 2020 that cars contain up to 150 electronic control units and about 100 million lines of code, projected to reach 300 million by 2030. Counts vary widely between models.

What are UN R155 and R156?

R155 requires a certified cybersecurity management system covering the vehicle's lifecycle and suppliers. R156 requires a software update management system, protected and recorded updates and safe recovery from failed over the air updates. In the EU, R155 became mandatory for all new vehicles produced from July 2024.

How much of a car can be recycled?

USGS says recycling of automobiles in the U.S. is nearly 100% for the steel, with more than 13 million tons of steel recovered from cars every year. Aluminium and catalytic converter metals are recovered too. Batteries need specialist recyclers, and plastics and electronics are harder to recover.

Fix it without waiting for upstream

A car's software is assembled like its hardware, from supplier code that carries open source libraries, and both UN R155 and NHTSA's guidance expect manufacturers and suppliers to find and fix known vulnerabilities in those components. Safeguard does not patch a car, but for the repositories, images and SBOMs that feed vehicle software, infotainment apps and the cloud services behind over the air updates, the same patch discipline applies.

Whatever the vulnerability, most of the risk sits in two gaps. The first is the time between a fix being published and that fix actually running in your production builds. The second, and worse, is the time before any fix exists at all, while a maintainer works out a patch and a release schedule. Waiting through both gaps is a habit, not a requirement. Safeguard gives teams three ways to close them.

1. Autonomous remediation: pull requests, not tickets

When a fixed version exists, Safeguard's Griffin models open a tested, policy gated pull request that moves the affected dependency to the safe version. You can run it on one repository or in bulk across every project that carries the vulnerable version. Remediation covers eight categories, including dependencies, licenses, security posture and findings. Reachability analysis ranks the vulnerable code paths your application actually calls first, so the first pull requests you merge are the ones that matter most. Autonomous remediation ships switched off, with every category set to Manual, so your team decides how much runs on its own and what still needs a human approval.

2. Gold Open Source: the safe version in seconds, free

gold.safeguard.sh is free and needs no login. Search any CVE or package to see affected and fixed versions, CVSS, EPSS, CISA KEV status and a recommended safe version, or use the "Am I affected?" checker. The same data is available through a free read API, README status badges and RSS threat feeds. The safeguard-sh/gold-scan-action GitHub Action can fail a build on a known exploited vulnerability, on any known vulnerability, or never, so a version you have just removed cannot quietly come back in next week's merge.

3. Gold Registry: start from components that are already fixed

registry.safeguard.sh provides hardened, drop in replacements for upstream packages and container images. Every Gold artifact is held continuously to zero exploitable critical or high CVEs, zero malware and a completed license check, with SLSA L3 or higher provenance, a Sigstore signature and a public evidence page you can hand to an auditor. An artifact loses its Gold badge if it regresses. Teams can point their own package directory at the registry so hardened equivalents resolve without changing how developers install anything.

When upstream has no fix yet, or will not ship one, Safeguard first works to get the fix accepted upstream. If the issue is severe or upstream will not move, Safeguard builds a fork, fixes the vulnerability there and publishes a hardened Gold build, so you are not stuck on a maintainer's release schedule. You can also request a hardened, compatibility tested build of a specific package. This fork and patch flow is in early access today, so ask which packages it covers before you plan around it.

One honest limit: when the vulnerable code lives in a vendor appliance, a hosted service or an operating system runtime you do not build yourself, the fix still has to come from that vendor or distribution. The steps above apply to the open source dependencies and container images you build and ship, which is where most teams carry the largest and least tracked share of their exposure.

To try it on your own machine, download Safeguard from https://safeguard.sh/download and see the CLI documentation at https://docs.safeguard.sh/docs/cli .

See how Safeguard would help

The first demo sets up Safeguard's local runner on your own machine, approves it with a device code, and runs a scan from the terminal. On a build host for infotainment or telematics software, the same flow produces the component inventory that NHTSA's G.10 practice describes; it covers software you build, not the control unit hardware.

Click through it at your own pace, or open it full screen.

The second demo is a real Safeguard CLI session: asked to fix a lodash CVE, it reads the finding and advisory, asks before each command, edits package.json to lodash 4.17.21, runs npm install and npm test with approval, and pushes nothing. The same approve each step flow applies to dependency upgrades in a vehicle companion app or an update distribution backend.

Click through it at your own pace, or open it full screen.

The third demo connects Claude to the Safeguard MCP server with OAuth and lets you choose which tools Claude can use. That lets an engineer ask which projects carry a given component version when a new advisory lands, while controlling what the assistant can touch.

Click through it at your own pace, or open it full screen.

Quick check

Sources

• U.S. Geological Survey, Mineral Commodity Summaries 2026: Lithium (PDF)
• U.S. Geological Survey, Mineral Commodity Summaries 2026: Cobalt (PDF)
• U.S. Geological Survey, Mineral Commodity Summaries 2026: Nickel (PDF)
• U.S. Geological Survey, Mineral Commodity Summaries 2026: Graphite (PDF)
• U.S. Geological Survey, Mineral Commodity Summaries 2026: Manganese (PDF)
• U.S. Geological Survey, Mineral Commodity Summaries 2026: Aluminum (PDF)
• U.S. Geological Survey, Mineral Commodity Summaries 2026: Iron and Steel (PDF)
• U.S. Geological Survey, Mineral Commodity Summaries 2026: Iron and Steel Scrap (PDF)
• U.S. Geological Survey, Mineral Commodity Summaries 2026: Copper (PDF)
• U.S. Geological Survey, Mineral Commodity Summaries 2026: Rare Earths (PDF)
• U.S. Geological Survey, Mineral Commodity Summaries 2026: Platinum Group Metals (PDF)
• U.S. Department of Energy: Lightweight Materials for Cars and Trucks
• U.S. EPA: Lithium Ion Battery Recycling
• U.S. EPA: Highlights of the Automotive Trends Report
• eCFR: 49 CFR Part 571, Federal Motor Vehicle Safety Standards
• eCFR: 49 CFR 571.208, Occupant crash protection
• eCFR: 49 CFR 567.4, Requirements for manufacturers of motor vehicles
• NHTSA: Federal Motor Vehicle Safety Standards and regulations (archived copy, June 2024)
• NHTSA: Cybersecurity Best Practices for the Safety of Modern Vehicles, 2022 update (PDF)
• UNECE press release, 24 June 2020: UN Regulations on Cybersecurity and Software Updates to pave the way for mass roll out of connected vehicles
• UNECE: UN Regulation No. 155, Cyber security and cyber security management system (PDF)
• UNECE: UN Regulation No. 156, Software update and software update management system (PDF)
• Polestar: Polestar 4 SUV life cycle assessment, model year 2027 (PDF)

Last reviewed: 23 October 2026.