Autonomous vehicles legislation in the United States is split between federal agencies that regulate how self-driving cars are built and state governments that control where and how those cars operate on public roads. That divide produces a patchwork: a vehicle cleared for driverless operation in one state may need a completely different permit next door, and a car designed without a steering wheel cannot legally be sold at all until federal safety standards are amended to allow it. In September 2025, the National Highway Traffic Safety Administration proposed the first formal amendments to federal vehicle safety standards for cars without manual controls, the most significant federal step yet toward removing that barrier.
Federal Design and Safety Rules
NHTSA runs federal autonomous vehicle regulation through the Federal Motor Vehicle Safety Standards, the design and performance requirements every car sold in the country must meet.1National Highway Traffic Safety Administration. NHTSA Statutes, Regulations, Authorities and FMVSS Those standards were written for human-driven vehicles. They assume a steering wheel, brake pedal, and windshield wipers, so a fully automated car built without traditional controls technically fails them. Until NHTSA revises or waives those requirements, the vehicle cannot legally be sold.
To track how automated systems perform once they reach public roads, NHTSA issued a Standing General Order requiring manufacturers and fleet operators to report crashes involving vehicles equipped with automated driving systems or Level 2 driver assistance features. Severe crashes must be reported within five days; less severe incidents are reported monthly.2National Highway Traffic Safety Administration. Standing General Order on Crash Reporting The agency draws a firm line between automated driving systems at SAE Levels 3 through 5, where software handles the entire driving task within defined conditions, and Level 2 systems, where the car controls speed and steering but the human must stay fully engaged. NHTSA is working to codify those reporting requirements into permanent regulation.3National Highway Traffic Safety Administration. Report to Congress on Research and Rulemaking for Automated Driving Systems
The 2025 AV Framework
In September 2025, NHTSA announced a formal AV Framework built on three principles: prioritizing safety of current autonomous operations, removing unnecessary regulatory barriers, and enabling commercial deployment. The agency proposed rulemakings to amend specific safety standards for vehicles with automated driving systems and no manual controls, including rules on transmission interlocks, windshield defogging and wiping systems, and exterior lighting.4National Highway Traffic Safety Administration. AV Framework Plan to Modernize Safety Standards These sound mundane and they are not. A shuttle-style vehicle designed with wraparound sensors instead of a windshield violates the current wiping and defogging rules, which makes it unsellable.
NHTSA also proposed the AV STEP program, short for Automated Driving System-Equipped Vehicle Safety, Transparency, and Evaluation Program. It would create a structured review and monitoring process for manufacturers deploying autonomous systems and give the agency better real-world data while it develops longer-term standards.3National Highway Traffic Safety Administration. Report to Congress on Research and Rulemaking for Automated Driving Systems
What Congress Has and Has Not Done
Congress has tried for nearly a decade to pass comprehensive autonomous vehicle legislation and has not yet succeeded. The SELF DRIVE Act passed the House in 2017, and the companion AV START Act was introduced in the Senate the same year.5Congress.gov. S.1885 – AV START Act Both aimed to give NHTSA clear authority over autonomous system design, preempt conflicting state rules on vehicle construction, and create a path for manufacturers to get exemptions from safety standards that assume a human driver. Neither reached the president’s desk. Sticking points included how much state authority to preempt, how many exemption vehicles to allow, and whether manufacturers would face real accountability for cybersecurity and safety failures.
A new version of the SELF DRIVE Act was introduced in the 119th Congress as H.R. 7390, revisiting many of the same issues.6Congress.gov. H.R. 7390 – SELF DRIVE Act Until comprehensive legislation passes, manufacturers rely on NHTSA’s existing exemption authority under federal law, which allows the agency to temporarily exempt up to 2,500 vehicles per year from safety standards for a maximum of two years per exemption.7Office of the Law Revision Counsel. 49 USC 30113 – Exemption for Low-Emission Vehicles and Motor Vehicle Safety That cap is a real bottleneck for any company trying to scale a commercial robotaxi or delivery fleet. Multiple congressional proposals have sought to raise it. None have been enacted.
State Rules on Testing and Driverless Operation
States control licensing, vehicle registration, traffic law enforcement, and the conditions under which autonomous vehicles can operate on local roads. Each state sets its own rules for testing permits, insurance minimums, and whether a human safety operator must be present in the vehicle.
Many states require companies to obtain testing permits that come with reporting obligations. A common requirement is the disengagement report, which tracks how often the automated system hands control back to a human or fails during testing. These reports give regulators and the public a rough measure of how reliably the software performs in real traffic. States also mandate liability insurance or surety bonds before granting permits, with required coverage amounts typically ranging from $2 million to $5 million depending on the jurisdiction and whether the vehicle operates with or without a safety driver.
The sharpest divide among states is whether they allow fully driverless operation. Some states require a licensed human safety operator behind the wheel at all times during testing, ready to take manual control if the system fails. Others permit fully driverless vehicles on public roads, provided the car can safely pull over on its own if a critical system malfunction occurs. As of early 2026, commercial driverless ride services operate in roughly half a dozen states, concentrated in specific city deployments rather than statewide. More than 30 states have enacted some form of autonomous vehicle legislation or executive order, though permissiveness varies widely.
Local Preemption
A growing friction point is whether cities and counties can impose their own restrictions on autonomous vehicles, or whether state law preempts local regulation. Some state legislatures have structured their AV laws to prevent a city-by-city patchwork that could effectively block deployment. Other states face active proposals to give municipalities more control, including the ability to restrict where autonomous vehicles operate within city limits. For manufacturers, a fragmented local environment in a single state can be as burdensome as navigating 50 different state laws.
Liability When a Self-Driving Car Causes a Crash
Traditional car accident liability centers on the driver: who ran the red light, who was texting, who failed to yield. When the software is driving, that framework breaks down. The legal question shifts from human negligence to product liability, and the defendant is more likely to be the manufacturer or the company that developed the automated driving system than the person sitting in the vehicle.
Product liability claims against autonomous vehicle manufacturers generally follow three theories. A manufacturing defect claim argues the specific vehicle deviated from its intended design. A design defect claim argues the system’s design was unreasonably dangerous even when working as intended, often evaluated through a risk-utility test that weighs whether a safer alternative design was feasible. A failure-to-warn claim argues the manufacturer didn’t adequately disclose the system’s limitations to the user. Courts evaluating design defects in autonomous systems will need to assess whether the software’s decision-making logic met the standard of care, which is new territory compared to evaluating a bent axle or a faulty brake line.
Strict liability matters most here. Under strict liability, a manufacturer can be held responsible for injuries caused by a defective product regardless of whether the company was negligent. If the automated driving system misjudges a pedestrian’s trajectory because of a sensor limitation or a coding error, the company may be liable even if it followed industry best practices during development.
Who Counts as the Operator
Defining the operator of a self-driving car has real consequences for insurance claims, traffic enforcement, and fault allocation. There is no federal definition. NHTSA has recommended that states treat the automated driving system itself as the “driver” for purposes of traffic laws when the system is performing the driving task at SAE Levels 3 through 5. Several states have adopted this approach, deeming the ADS to be the operator whenever it is engaged, regardless of whether a human is in the vehicle. Other states assign operator status to the person who activates the technology or the entity that deployed the vehicle.
Enforcement is adapting. At least one state now authorizes police officers to issue traffic violation notices directly to autonomous vehicle manufacturers when their driverless cars break traffic laws, rather than requiring a citation to a human behind the wheel. More states are likely to follow as driverless fleets expand.
Data, Privacy, and Cybersecurity
Autonomous vehicles collect large amounts of data through cameras, radar, and lidar. That data includes detailed location history, surrounding vehicle movements, and in some cases biometric information like eye-tracking or facial recognition used to monitor whether a human backup driver is paying attention. The legal questions center on who owns this data, who can access it, and what protections apply.
Federal law addresses part of this through the Driver Privacy Act, which establishes that data retained by a vehicle’s event data recorder belongs to the vehicle’s owner or lessee. That data cannot be accessed by anyone else unless the owner gives written or electronic consent, a court authorizes retrieval, the data is needed for emergency medical response after a crash, or it is used for traffic safety research with personal information stripped out.8Congress.gov. S.766 – Driver Privacy Act of 2015 Federal crash investigators at NHTSA also retain access for safety investigations. These protections apply to the event data recorder specifically, and autonomous vehicles generate far more data than a traditional black box captures.
State privacy laws add another layer. Several states have enacted broad consumer privacy statutes that require businesses to disclose what personal information they collect, give consumers the right to delete that data, and restrict its sale or sharing. These laws apply to autonomous vehicle operators collecting location and biometric data, though enforcement and scope vary by state.
On cybersecurity, there is currently no standalone federal mandate specific to autonomous vehicles. Both the failed SELF DRIVE Act and AV START Act would have required manufacturers to develop and publicize written cybersecurity plans identifying vulnerabilities and corrective processes. Those bills never became law. Manufacturers that build in cybersecurity protections do so voluntarily or in response to NHTSA guidance rather than binding regulation. The 2025 SELF DRIVE Act reintroduction could change that if it advances further than its predecessors.
Autonomous Trucking
Autonomous freight trucks present regulatory challenges distinct from passenger vehicles. The Federal Motor Carrier Safety Administration, which oversees commercial vehicle safety, is reviewing its regulations to determine which rules need to be amended or eliminated to accommodate trucks equipped with automated driving systems.9Federal Motor Carrier Safety Administration. Safe Integration of Automated Driving Systems-Equipped Commercial Motor Vehicles Current federal rules were built around human drivers and include requirements like hours-of-service limits that cap how long a trucker can drive before resting. A driverless truck doesn’t fatigue, so those rules may not apply in their current form, but FMCSA has not yet issued formal guidance on how hours-of-service regulations interact with fully autonomous commercial vehicles.
Roadside inspections are being reworked too. The Commercial Vehicle Safety Alliance developed an Enhanced CMV Inspection Program specifically for trucks with automated driving systems. Instead of a traditional driver-led pre-trip inspection, trained motor carrier personnel conduct a no-defect inspection at the point of origin before dispatch, with additional inspections at set intervals throughout the trip. Once on the road, the autonomous truck communicates to law enforcement that it passed its inspection, its driving systems are functioning, and it is operating within its approved conditions. Vehicles meeting those criteria can bypass fixed inspection stations. Roadside stops by law enforcement are limited to situations involving an imminent hazard or a post-crash investigation. The program also requires that every autonomous truck be capable of responding if an officer attempts to pull it over.
The Accessibility Gap
Autonomous vehicles have the potential to change mobility for the more than 25 million Americans who report travel-limiting disabilities. The legal framework has not caught up. No federal law specifically addresses accessibility requirements for autonomous vehicles.10U.S. Access Board. Inclusive Design of Autonomous Vehicles: A Public Dialogue Summary Report The ADA’s existing accessibility specifications for transportation vehicles, at 49 CFR Part 38, cover buses and vans but were not written with driverless cars in mind. The U.S. Access Board has noted that those guidelines may be informative for certain types of autonomous vehicles, and the Department of Transportation has not yet adopted updated standards that apply to the new vehicle designs.
Practical accessibility challenges include wheelchair boarding, audio and visual interface design for passengers who are blind or deaf, and the ability to summon and direct a vehicle without using a smartphone screen.11U.S. Department of Transportation. Inclusive Design Challenge Resources Until federal rules catch up, accessible design depends largely on manufacturer initiative and whatever conditions states or cities attach to deployment permits.