Autonomous vehicle regulations in the United States are split between two levels of government: federal agencies set vehicle safety standards and crash reporting rules, and individual states decide who can test or deploy self-driving vehicles, where they can operate, and how much insurance is required. More than 20 states have enacted specific laws or executive orders on the technology, and federal agencies are steadily updating decades-old safety standards written for vehicles that assumed a human driver, a steering wheel, and a brake pedal.
Why the SAE Levels Matter
Regulators classify self-driving capability using the SAE Levels of Driving Automation, running from Level 0 through Level 5. At Level 0, the human handles everything. Level 1 assists with steering or speed but not both. Level 2 handles steering and speed together, though the driver still monitors the road and must intervene at any moment.
The regulatory picture changes at Level 3, where the vehicle drives itself within defined conditions and the human takes over only when the system requests it. Level 4 systems are fully responsible for driving inside a set service area, with no human driver needed. Level 5 covers full automation on any road, under any conditions.
The level determines which rules apply. Federal crash reporting covers Level 2 and above. State testing permits often treat vehicles that still need a human behind the wheel differently from those that don’t. Knowing where a vehicle sits on the scale tells you which set of requirements it has to meet before it can operate on a public road.
What NHTSA Regulates at the Federal Level
The National Highway Traffic Safety Administration is the primary federal agency for motor vehicle safety. It issues and enforces the Federal Motor Vehicle Safety Standards in Title 49, Part 571 of the Code of Federal Regulations.1National Highway Traffic Safety Administration. NHTSA Statutes, Regulations, Authorities and FMVSS Those rules were built around traditional vehicle designs. In September 2025, NHTSA proposed three rulemakings to amend standards on transmission interlocks, windshield systems, and lighting equipment so they can apply to vehicles with automated driving systems and no manual controls.2National Highway Traffic Safety Administration. Trump’s Transportation Secretary Sean P. Duffy Advances AV Framework Plan to Modernize Safety Standards
Manufacturers building vehicles that don’t fit existing standards can petition NHTSA for a temporary exemption under 49 U.S.C. § 30113. Exemptions are capped at 2,500 vehicles sold in any 12-month period and last no more than two years, though renewal is possible. The manufacturer has to show either that the vehicle offers safety at least equal to non-exempt vehicles or that the exemption is needed to evaluate a new safety feature.3Office of the Law Revision Counsel. 49 USC 30113 – General Exemptions The cap prevents the exemption process from becoming a route to mass production without full compliance.
Violations carry real money. A manufacturer faces a civil penalty of up to $27,874 per violation, and the maximum for a related series of violations is roughly $139.4 million.4eCFR. 49 CFR Part 578 – Civil and Criminal Penalties These amounts are adjusted for inflation each year.
Crash Reporting Requirements
NHTSA’s Standing General Order requires manufacturers and operators of vehicles equipped with automated driving systems or Level 2 driver-assistance systems to report certain crashes to the agency.5National Highway Traffic Safety Administration. Standing General Order on Crash Reporting The order was first issued in 2021 and has been amended several times. Under the third amended version, issued in 2025, the most severe crashes must be reported within five days and less severe incidents on a monthly basis.6National Highway Traffic Safety Administration. Third Amended Standing General Order 2021-01
The data is not collected for its own sake. It lets NHTSA identify patterns across different systems and manufacturers. Under 49 U.S.C. § 30166, the agency can open a defect investigation, compel production of records, hold hearings, and order a recall if a defect poses an unreasonable safety risk.7Office of the Law Revision Counsel. 49 USC 30166 – Inspections, Investigations, and Records
Voluntary Safety Self-Assessments
NHTSA also encourages developers to publish a Voluntary Safety Self-Assessment covering 12 priority safety elements, including object detection, system fallback behavior, cybersecurity, and post-crash system behavior. The assessments are voluntary. There is no mechanism to compel submission, and NHTSA does not approve them.8National Highway Traffic Safety Administration. Automated Driving Systems – A Vision for Safety
They still carry weight. Publishing one signals to regulators, state licensing agencies, and the public that a developer has taken safety seriously. Skipping the assessment is not illegal, but companies that do can face harder questions from state regulators during permit applications. Most major developers have published at least one, and the format has become an industry expectation without a legal mandate behind it.
How States License and Restrict Autonomous Vehicles
States decide who tests and deploys autonomous vehicles on their roads, and the rules vary widely. Some states have detailed statutory frameworks with formal permit processes, test-driver qualifications, and data submission requirements. Others operate under executive orders from the governor. A handful have no specific autonomous vehicle laws at all, so standard traffic codes apply by default.
States with structured programs generally distinguish two phases of operation:
- Testing with a human safety operator behind the wheel. Permits require documentation of the operator’s qualifications and the vehicle’s technical capabilities.
- Driverless deployment, where no human sits in the driver’s seat. This requires a higher level of validation, and many states also require a law enforcement interaction plan explaining how the vehicle will communicate with police or emergency responders during a traffic stop or crash.
Some states require companies to file disengagement reports whenever the autonomous system fails or the human operator intervenes for safety. These reports are sometimes public, and frequent disengagements can lead to permit suspension or revocation.
A growing number of states have passed laws that stop cities and counties from banning or adding restrictions on autonomous vehicles beyond what state law requires. That preemption prevents the situation where a company holds a valid state permit but gets blocked by a local ordinance. Not every state takes this approach, so the balance between state authorization and local control depends on where the vehicle operates.
Insurance and Financial Responsibility
Standard personal auto insurance falls far short of what testing or deployment requires. Multiple states require a primary liability policy of at least $5 million per vehicle before granting a testing or deployment permit.9Insurance Institute for Highway Safety. Highly Automated Vehicles – Laws and Regulations The threshold reflects the scale of damage a multi-ton, software-driven vehicle can cause if the system fails.
Companies can meet the financial responsibility requirement in more than one way:
- A commercial liability insurance policy from a licensed insurer, tailored to software-driven vehicle risks.
- A surety bond from a bonding company guaranteeing payment of claims up to the required limit.
- A self-insurance certificate, available to large corporations with enough net worth to cover potential liabilities from their own assets.
If coverage lapses, states enforcing the $5 million minimum typically invalidate the vehicle’s registration and operating authority the moment the insurance expires. Regulators verify coverage at permit issuance, when vehicles are added to a fleet, and at renewal.
Who Is Liable When an Autonomous Vehicle Crashes
Traditional traffic law assumes a human driver made a mistake. Autonomous vehicles undo that framework. When a Level 4 or Level 5 system is driving and causes a crash, there is no human driver to blame, and liability shifts toward the manufacturer under product liability law. That analysis focuses on whether the vehicle had a design defect, a manufacturing defect, or inadequate warnings.
No federal statute directs this shift. It flows from existing state tort law: if the automated system was in control, the manufacturer is responsible for the system’s performance. Courts look at whether the software failure falls within industry norms, whether a reasonable human driver could have avoided the collision, and whether the crash stems from a flaw in design or manufacturing. Voluntary safety self-assessments and crash data become part of the record plaintiffs’ attorneys and regulators use to evaluate whether the manufacturer acted reasonably.
Criminal liability is less settled. When a corporation faces criminal accountability for an AV-related death, existing prosecutorial frameworks were not built for situations where software, not a person, made the driving decisions.
Data Privacy and Cybersecurity
Autonomous vehicles generate enormous volumes of data. Cameras, lidar sensors, and GPS units record surroundings, movement patterns, and in some cases biometric information about occupants. That raises two separate regulatory concerns: consumer privacy and cyberattacks on safety-critical systems.
On privacy, the Federal Trade Commission can take enforcement action against manufacturers that engage in deceptive or unfair data practices under Section 5 of the FTC Act. Companies that receive notice from the FTC about prohibited practices and continue them face civil penalties of up to $53,088 per violation.10Federal Register. Adjustments to Civil Penalty Amounts Several states have also enacted comprehensive consumer privacy laws that require manufacturers to disclose what personal information they collect, give vehicle owners the right to request deletion, and allow consumers to opt out of having their information sold.
Cybersecurity is a distinct risk because a compromised steering or braking system can endanger lives. NHTSA has published voluntary guidance titled “Cybersecurity Best Practices for the Safety of Modern Vehicles,” recommending layered defenses, monitoring for intrusion attempts, and systems designed to fail safely if breached.11National Highway Traffic Safety Administration. Cybersecurity Best Practices for the Safety of Modern Vehicles The guidelines are non-binding, but they set a benchmark for what courts consider reasonable care. No state currently mandates a separate cyber-specific insurance policy for autonomous fleets.
Pending Federal Legislation
Congress has struggled for years to pass comprehensive autonomous vehicle legislation. The most recent effort is the Autonomous Vehicle Acceleration Act of 2025, introduced in the Senate. It would direct the Secretary of Transportation to update any federal safety standard, regulation, or guidance that assumes a traditional human-driver design, including rules on seating arrangements, driver controls, and cabin configurations, so Level 4 and Level 5 vehicles can move through certification without unnecessary obstruction.12Congress.gov. S.1798 – Autonomous Vehicle Acceleration Act of 2025 It also requires the Secretary to develop a roadmap for commercial-scale deployment of fully autonomous vehicles. As of mid-2026, the bill has not been enacted, and no comprehensive federal AV law is in place.