Paper med cards stopped being proof on 11 October. Small fleets are still filing them.

At midnight on 11 October 2026, the waiver that let motor carriers rely on a paper Medical Examiner's Certificate for CDL drivers ran out. It was the third extension. FMCSA has said it does not anticipate granting any further nationwide relief, with a narrow exception for Alaska.

So the proof of a CDL driver's medical qualification is now the medical certification status sitting on their motor vehicle record. Examination results travel electronically from the National Registry to the state licensing agencies, which post them to the CDLIS driving record. The card in the driver's wallet is a convenience copy.

Plenty of small carriers have not re-pulled an MVR on every CDL driver since that happened. Their files look fine. A folder with a current-looking paper card in it feels like compliance right up until an investigator asks for the record that actually counts.

I built a complete AI app-builder blueprint for this: DQ File Desk, the driver qualification file builder and expiry chase engine. One master prompt, pasted into Lovable, produces the whole system. The full field spec, the 11-step build phase, the sell-and-run playbook and the pricing are all on the pro prompt page.

Why driver qualification files are the cheapest fine in trucking to collect

Driver qualification files have been in the top 10 critical FMCSA audit findings for 5 years running. The single most cited item of all is a missing or expired medical examiner's certificate. Investigators are trained to pull DQ files in the first half hour of an on-site review, because that is where the findings are.

The part that hurts is how the penalties get counted. They are assessed per driver, per violation. A carrier with 20 drivers and the same gap in all 20 files is looking at 20 separate findings, not one administrative slap. The maximum civil penalty on a single 49 CFR 391.51 violation is $11,956. Recordkeeping violations run up to $1,584 a day with a cap of $15,846.

Then there is the second bill. A conditional safety rating adds somewhere between 15% and 30% to commercial auto liability premiums, and some underwriters decline to quote at all. Shippers and brokers increasingly will not hand freight to a carrier carrying one. The fine is the small part.

And this is almost the whole market. 97.4% of US carriers run fewer than 20 trucks. 91.5% run 10 or fewer. More than half are a single truck. These are companies where the person doing compliance is also doing payroll, dispatch and the phones, and where the DQ file work is genuinely nobody's job.

Nobody fails this on intent

Every small carrier I have looked at knows what a DQ file is meant to contain. They fail on dates.

The med card expired in March and nobody opened the folder. The annual MVR got pulled in August but the review of that record never got written up and signed, which is a separate violation from not pulling it. The driver hired in May came from two states and only one MVR went in. The Clearinghouse limited query for a driver who has been there 4 years is sitting somewhere between "we definitely did that" and "I think Sandra did that".

Part 391 is a calendar problem wearing a regulation costume. Some things happen once at hire. Some repeat every 12 months. Some expire on whatever date a doctor printed on a form. Across 25 drivers and 14 requirement types, that is 350 clocks running at different speeds, tracked in a filing cabinet and a shared drive folder called "driver stuff".

How the blueprint works

The build does four things, and the order matters.

It reads the documents. Office staff bulk upload whatever exists. Drivers photograph things from the cab through a magic link with no password and no app store detour. An AI vision model classifies each file, works out which driver it belongs to, and pulls the issue date, expiry date, issuing state, examiner registry number, CDL class, endorsements and restrictions off it.

The interesting instruction in the master prompt behind it is the one telling the model when to refuse. If a date is obscured by glare, cut off at the edge of the photo or written in handwriting it cannot read with confidence, it returns null and names the field it could not read. It is also told never to infer an expiry from a certification period unless the certificate prints one. A wrong date in a compliance system is worse than a blank one, because a blank one gets chased and a wrong one gets trusted.

It applies the rules. The app ships with all 14 Part 391 requirements seeded as a catalogue: the employment application, MVRs from every state the driver held a licence in over the previous 3 years, the previous employer safety performance history investigation and the good faith effort records where an old employer never replied, the road test or CDL equivalent, medical certification, the annual MVR, the annual signed review of that record, the annual list of violations, the Clearinghouse pre-employment full query and the annual limited query, the pre-employment drug test, ELDT, SPE certificates and hazmat endorsement clocks.

Each row carries its CFR reference and a short investigator note saying what someone auditing it actually looks for. That catalogue is the product. Everything else is plumbing around it.

It tracks the medical certification properly. This is where the 11 October change lands. The build treats medical certification as having two evidence types on the same requirement. MVR-confirmed is the record of account for CDL and CLP drivers, with the MVR pull date stored so you can see how fresh the confirmation is. A paper certificate is still the record for non-CDL drivers operating commercial vehicles, and useful as a backup copy for everyone else.

A CDL driver whose only evidence is a paper card shows amber, reading "paper only, MVR confirmation needed", with a one-line explanation of why. Half the value of the product is that sentence, because most small carriers have not caught up yet and will argue with you until they see it on a screen next to the driver's name.

It chases. A daily job finds everything due in 60, 30, 14, 7 and 1 days plus anything already expired, and sends each driver one combined text from the carrier's own number with an upload link. One message per driver per day covering all their outstanding items, not one text per item, because the second version gets muted after a week. Three unanswered attempts escalates to the safety manager by email. The safety manager gets a one-screen digest every morning at 07:15.

When an investigator does arrive, one button generates an indexed PDF of the whole fleet in the order they ask for documents, with a clearly labelled placeholder page for every gap. Hiding a gap in the pack would be a nice touch for the demo and a disaster in an audit room, so the build prints them.

A Tuesday at Ridgeline Freight

Here is the flow with a real shape to it.

Ridgeline Freight runs 24 drivers out of Springfield, Missouri. Dana does safety, payroll and most of the dispatch. The build went live 6 weeks ago after a 4-hour session digitising the filing cabinet, which turned up 11 gaps nobody knew about.

07:15 Tuesday. Dana's digest email says 3 items expiring inside 30 days, 1 expired, 2 documents waiting on verification.

The expired one is Marcus. His med cert shows current on the paper card in the folder, issued 14 months ago and good for another 10. His MVR, pulled last week, does not show a current certification posted. The app has him amber, not green, with the reason printed next to it. Dana calls the clinic and finds the examiner submitted the result under a misspelled surname. That is a 20-minute phone call on a Tuesday instead of a finding in a compliance review six months later.

Meanwhile Jolene, who is 400 miles out, got a text at 07:00: "Hey Jolene, your med card expires 14 Nov. Tap here to send us a photo of the new one." She took the DOT physical last Friday and had the card in the visor. She photographs it at a truck stop in 40 seconds. The model reads it, spots that the certification period is 12 months rather than 24, flags it as a short-term certification, and drops it in the verify queue with the dates pre-filled.

09:40. Dana clears the verify queue, which takes 4 minutes for both documents. Jolene's row goes green, with the short-term badge on it so the next clock is already visible.

11:00. Ridgeline's insurance broker emails asking for something to take to renewal. Dana sends a time-limited read-only guest link showing fleet readiness at 96% with per-driver status and no personal documents attached. That link is the single easiest renewal conversation she has had.

Total time Dana spent on compliance that day: about 30 minutes, 20 of which was the clinic's data entry error. Before the build it was zero minutes most days and a frantic weekend twice a year.

What it costs to run, and what to charge

Running costs are small. Supabase sits on the free tier for a single carrier under about 20 drivers and $25 a month above that. The OpenAI document reading runs roughly $0.01 to $0.03 a page, so the first bulk import of a 25-driver fleet's existing paperwork costs $4 to $8 and the steady state after that is pennies. Twilio is about $0.0079 per SMS plus $1.15 a month for the number. Resend is free to 3,000 emails. Call it $15 to $40 a month in pass-through for a 25-driver carrier, billed as a visible line item.

On the sell side, the numbers in the pricing and phase-by-phase playbook break down like this.

Setup is $2,500 to $4,500 one-time. That covers the build, digitising and verifying the existing paper files, the first full fleet readiness report, A2P 10DLC registration, a supervised pilot on 5 drivers and office training. Charge the top of the range above 30 drivers or where the existing files are paper only, because the verify-queue work is the real labour and it runs about 10 minutes per driver.

Monthly is $397 to $797. For context on where that sits, J.J. Keller's compliance service is reported at roughly $6 to $12 per driver per month, with all-in figures of $800 to $2,000 a month, and Foley starts around $450 a month for a small fleet. A managed service at $597 for 25 drivers is in the same band as the incumbents, and the carrier gets a system in their own Supabase account rather than a seat in someone else's.

Two variants worth having in your back pocket. A new entrant sprint at $1,850 flat, for a carrier inside its first 12 months who has an FMCSA safety audit coming and does not know it, with no ongoing retainer. Roughly half of those convert to monthly after they pass. And a risk-share at $197 a month plus $1,500 if they clear a compliance review with no DQ file findings while under your service. Carriers who have been burned before sign that one fast, and $1,500 is cheap next to a $11,956 maximum penalty assessed per driver.

Build time is a day or two of focused work. Getting live with a real client is about a week, and the long pole is A2P 10DLC registration for the driver texts, which sits in a carrier review queue for 1 to 3 weeks. Start it the day you sign.

Be honest about the edges

Two things the app does not do, and both belong in the scope document in week 1.

It does not pull motor vehicle records and it does not run Clearinghouse queries. Both need the carrier's own accounts and the driver's consent, so the build records the result instead: the query date, the reference number and the uploaded confirmation. Say that out loud in the handover call rather than letting the client wait for an automation that is never arriving.

And you are not their DOT consultant. The app reports what is missing against the Part 391 catalogue. Whether a driver is qualified to drive stays with the carrier. The build will put a red "not qualified to drive" chip on a driver with an expired med cert or CDL, and it will never touch dispatch status, because it does not control dispatch.

Who should build this

This one suits someone who can sit in a yard office for an afternoon without flinching. The sales motion is unusually clean, because the whole prospect list is public: FMCSA's SAFER and Safety Measurement System records list every carrier with its USDOT number, fleet size, inspection history and safety rating. You can walk into a first call already knowing more about their record than they do.

Three triggers to watch for. New entrants inside their first 12 months, who face the same audit requirements as a 50-truck fleet with no exemption for being small. Carriers who just took a conditional rating or a bad roadside inspection, where the pain is fresh and the insurance renewal is coming. And any fleet still relying on paper med cards for CDL drivers, which is most of them right now.

Insurance brokers who write commercial auto refer into this well, because a clean DQ file is what lets them place the risk.

Ship it as a real app

The last step of the playbook wraps the finished build through AppBuild.DIY so it goes out as a real iOS and Android app plus a PWA, with push notifications and native camera capture turned on.

That step carries more weight here than it does on most builds. The driver half of this product only works if people send the photo. A push notification on the safety manager's lock screen gets acted on the same day where the digest email gets read on Friday. And a driver who sees their own company's app on their home screen takes the picture. A driver who gets a link to a website they have never heard of assumes it is a phishing attempt, and then you are the one explaining why nobody responded.

Why this week

The regulatory change already happened. Every CDL driver at every small carrier in the country now needs medical certification confirmed on their motor vehicle record, and the paper card in the folder stopped being the answer 5 days ago. Most carriers will find this out from an investigator.

That is a cold-call opening that writes itself, and it has a shelf life. Six months from now this is old news and the early movers have the accounts.

Get the DQ File Desk blueprint on Prompt-King, paste the master prompt into Lovable, and you can have a working build to demo by the weekend.