A product recall is a disclosure problem with a legal clock attached, not a messaging problem you get to think through at your own pace. In the United States, a company has 24 hours to report a dangerous product to the Consumer Product Safety Commission once it has information that reasonably supports the conclusion the product is defective, not 24 hours from when it is certain. Get that window wrong and the comms problem that follows is usually bigger and comes around twice.
What is the actual legal clock you are working against?
Under Section 15(b) of the Consumer Product Safety Act, the CPSC's own guidance states that manufacturers, importers, distributors, and retailers must report to the agency within 24 hours of obtaining information that reasonably supports either of two conclusions: that a product fails to meet an existing safety rule, or that it has a defect that could create a substantial risk of injury to the public. That reporting duty applies to every firm in the distribution chain, not just the company whose name is on the box, so a retailer or distributor who hears about a hazard first cannot assume the manufacturer already has it covered.
The practical effect is that the clock starts the moment a support ticket, a returned unit, or an injury report gives you a reasonable basis to suspect a defect, well before an internal investigation would normally conclude. A comms or legal team that waits for certainty before reporting is adding delay to a window the law already measures in hours, and that delay is itself a separate risk the company did not have before the defect was discovered.
What does getting this right look like in practice?
Contained and fast, with nobody hurt. CPSC's recall notice for AudioLineOut's Studio Six headphone amplifiers, issued August 27, 2026 as a Fast Track recall, covered about 90 units sold since 2014 where metal parts could become electrified if used with an aftermarket part. No injuries were reported. The notice names the exact hazard mechanism, offers a free repair, and gives a direct phone number and email for the roughly 90 owners affected. That is what a recall looks like when a company reports early enough that the fix, not the fallout, is the story.
Source: CPSC's Section 15(b) reporting guidance and its April 16, 2026 Casely recall notice, linked in the article.
What does getting it wrong, slowly, actually cost?
A second recall, under worse circumstances, with the company's name attached to the word "reannounces." CPSC's April 16, 2026 notice for Casely's wireless power banks covers about 429,200 units. The company first recalled the same product in April 2025 after 51 consumer reports of the battery overheating or catching fire, which caused six minor burns. After that recall, CPSC received 28 more reports, including one that resulted in a fatality and one serious fire on an airplane. The remedy both times was the same, a free replacement, which raises the obvious question a reporter covering the reannouncement will ask directly: why did the first recall not reach the people still using the product, or not fix what was actually wrong.
That is the real cost of getting a recall wrong the first time. It is not a bigger version of the same news cycle. It is a second news cycle that now includes the first one as evidence the problem was not actually solved, which is a much harder story to recover from than the original defect.
What has to be in the recall notice itself?
Specifics a reporter, a customer, or later an AI system summarizing the company's safety record can check. A usable recall notice names the exact hazard mechanism rather than a vague phrase like "quality issue," states the sales window and the channels the product was sold through, gives a specific unit count, and offers one clear remedy, repair, replacement, or refund, with a direct way to reach the company. The CPSC notice is a public, permanent record. A notice that is vague on any of those points reads, to anyone checking it later, exactly as evasive as it is.
Who should hear about this before the public does?
Regulators first, by law, which in practice usually means coordinating the recall notice's publication with CPSC rather than announcing separately from it. A crisis communications plan built before anything happens should already name who owns that filing and who owns the public statement, because deciding that during the 24-hour window is exactly the kind of delay the law does not accommodate. After the filing, customers who can be identified directly, through order records or a registered product, should hear before the general public does. Employees and support staff need the same facts before customers start calling them, for the same reason a breach communications plan treats internal briefing as a parallel track to the public one, not a step that happens after.
Does the CPSC notice replace a press statement, or sit alongside one?
Alongside it. The CPSC notice is the legal record, written in the agency's format, and it is not where a company explains what it is doing to prevent the next one or acknowledges the people affected. A separate press statement carries the tone, the context, and whatever responsibility the company is taking, and it should say nothing the recall notice does not already support. The difference between a press release and a blog post applies directly here: a recall statement is a factual record a journalist can verify against the CPSC filing, not a place for the company to shape its own narrative around the few facts that read best.
Does waiting for certainty actually protect the company?
No, and this is the mistake that turns one recall into two. The 24-hour clock is measured from when a company has information that reasonably supports a conclusion, not from when an internal investigation has ruled out every other explanation. A company that keeps selling a product while it studies whether the defect is real is accumulating exactly the kind of additional incident reports that turned Casely's first recall into its second, worse one.
Does this apply to a startup that thinks of itself as a software company?
Yes, if it ships a physical product. A wearable, a smart lock, a hardware wallet, or any other connected device is a consumer product under the Consumer Product Safety Act regardless of how much of the company's value is in the software running on it, and the 24-hour reporting clock applies the same way it does to a company that has been making hardware for decades. A hardware startup's incident response plan should name who makes the Section 15(b) call before the company ships its first unit, not after a customer's device catches fire.
The direct answer, for anyone who read this far
Report within 24 hours of having a reasonable basis to suspect a defect, not when you are certain. Write the recall notice with the specific hazard, the specific numbers, and one clear remedy, because that notice is a permanent public record a reporter and eventually an AI system will check against whatever you say later. And treat the first recall as the one chance to actually fix the problem, since the alternative, shown plainly in CPSC's own filings, is a second recall that reads as proof the first one did not work. If you need help building the communications plan before you need it, talk to our team.
