His younger brother suffered a head injury and was flown with his mother, who also had cuts and abrasions, to Starship in the Auckland Westpac helicopter.
Acting Waikato district road policing manager Senior Sergeant Jeff Penno said the fact that neither child was in a car seat or booster seat could "be an aggravating factor in any number of charges". He said the onus to ensure children were properly secured fell on the driver despite both parents being inside the vehicle at the time of the accident.
Under the law, children under 5 have to be secured in a child restraint and children aged 5-7 have to use booster seats if they are fitted.
"We are not saying they weren't restrained at all but they were required to be restrained in car seats - and there were no car seats in that vehicle," Mr Penno said.
"It's the driver's responsibility to ensure that every person under 15 years of age is lawfully restrained in a vehicle."
Mr Penno said it could take up to three months collecting forensic evidence, vehicle examination reports and analysis of blood samples before the investigation into the accident could prove any culpability.
A spokeswoman for the Auckland District Health Board said the boys were recovering in Starship. One was due to be discharged, possibly today, while the other was likely be transferred to Middlemore Hospital.