Autonomous vehicles law and regulation in California, United States

Note: The United States is not a CMS office. This chapter is provided for informational purposes only and is considered additional content outside the core CMS jurisdictional structure.

Due to the United States’ system of Federal and State laws, each state is left to create its own laws and regulations with no Federal control.

The California Department of Motor Vehicles (DMV) and the California Public Utilities Commission (CPUC) are the primary regulators of AV operations within the State of California.

The relevant regulatory framework is found in:

• California Vehicle Code – Cal. Veh. Code §§ 38750–38755 (Deering 2024)
  • § 38750. Operation of autonomous vehicle on public roads for testing purposes; Requirements; Contents of application; Adoption and public notice of regulations; Approval of application; Disclosure and fee
  • § 38751. Requirements for autonomous vehicle manufacturers to enable emergency response [Operative July 1, 2026]
• California Code of Regulations – Cal. Code Regs. tit. 13, §§ 227.00–228.28 (2025)                                                                                                                

What are the primary commercial applications of AVs currently permitted in your jurisdiction?

AV use is currently more prominent in urban areas. In California, SAE level 4 AVs are actively being deployed as:

• Driverless taxi services
  • Waymo offers approximately 200,000 paid rides per week across Los Angeles, San Francisco, and the Bay Area
• Delivery vehicles for retailers such as Kroger, Walmart, and UberEats

Are there specific restrictions on AV usage, such as geofencing, operational limits, or specific road types where AVs are allowed or prohibited?

Generally, all light-duty AVs (those weighing under 10,001 lbs.) are allowed to operate on public roads in California once a permit has been given to the manufacturer. That being said, manufacturers must define the Operational Design Domains (ODDs) for their vehicles to specify which conditions and areas are safe and permitted for the AV. The ODDs can include weather conditions, speed limits, hours of operation, and geofences.

The regulations state that:

1. “The manufacturer shall identify in the application the operational design domain in which the subject autonomous vehicles are designed to operate and certify that the vehicles are designed to be incapable of operating in the autonomous mode in areas outside of the disclosed operational design domain.
2. The manufacturer shall identify any commonly-occurring or restricted conditions, including but not limited to: snow, fog, black ice, wet road surfaces, construction zones, and geo-fencing by location or road type, under which the vehicles are either designed to be incapable of operating or unable to operate reliably in the autonomous mode or state the mechanism for safely disengaging out of autonomous mode in the event of experiencing conditions outside of its operational design domain.
3. The manufacturer shall describe how the vehicle is designed to react when it is outside of its operational design domain or encounters the commonly-occurring or restricted conditions disclosed on the application. Such reactions can include measures such as notifying and transitioning control to the driver, transitioning to a minimal risk condition, moving the vehicle a safe distance from the travel lanes, or activating systems that will allow the vehicle to continue operation until it has reached a location where it can come to a complete stop.”

 Cal. Code Regs. tit. 13, § 228.06

Is there any regulation for the operation of AVs on private grounds?

There is no specific statewide legislation that governs the use of AVs on private property. The rules and permissions are determined by the individual property owner.

Are there any legal or regulatory safety parameters regarding the testing of AVs on public roads?

• Under California Vehicle Code § 38750
  • Manufacturers must obtain a permit from the California Department of Motor Vehicles (DMV)
  • The driver must be seated in the driver's seat, monitoring the safe operation of the vehicle, and be able to take over immediate manual control in the event of an autonomous technology failure or other emergency
  • Manufacturers must maintain liability insurance
    • Must obtain and provide evidence of an instrument of insurance, surety bond, or proof of self-insurance in the amount of $5M
• The DMV, under Title 13 of the California Code of Regulations, §§ 227.00 et seq. & 228.00 et seq., governs the approval process for driverless AV testing and deployment. 
  • Key requirements include certifying notification of local authorities in areas of testing, having communication links and processes for law enforcement interaction, complying with safety standards, demonstrating Level 4 or 5 automation capability, disclosing operational design domains, providing law enforcement interaction plans, maintaining remote operator training programs, providing safety assessments if publicly disclosed, disclosing data collection from passengers, paying permit fees, notifying changes in contact information, and submitting revisions for certain vehicle capability changes.

In cases of accidents resulting from decisions made by crash algorithms, who can be held liable?

As of right now, there is minimal law addressing accidents involving AVs. The regulations do not specifically mention liability for crashes, and there is minimal case law that has been published involving AV accidents.

Liability will likely be determined depending on the circumstances

• Operator/owner if there was any negligence on their end
• Manufacturer (and software developer, if different) if there was any product liability issue or negligence on their end

In your jurisdiction, it there a legal basis supporting the lawfulness of autonomous decisions that, in extreme situations, impact the physical integrity or life of passengers or other participants to protect one of the involved parties?

There is no law specifically addressing this topic. But, there is also no immunity for AV systems that cause harm. This is meant to encourage conservative programming that maximizes safety. Factors that would most likely be considered in a situation like this are negligence standards, product liability, and comparative fault.  

Are there any legal implications regarding the manufacturer’s liability in the event of cyberattacks that affect the operation of AVs (SAE Levels 2-4) or cause harm to passengers?

There are currently no regulations directly addressing where the liability would fall. But, the California Code of Regulations establishes that a manufacturer, in order to get a permit to deploy Avs, must have “a certification that the autonomous vehicles meet appropriate and applicable current industry standards to help defend against, detect, and respond to cyber-attacks, unauthorized intrusions, or false vehicle control commands.” Cal. Code Regs. tit. 13, § 228.06. This legislation likely implies that the liability will fall on the manufacturer in the event of a harmful cyberattack.

These regulations are primarily driven by the California Consumer Privacy Act and the California Privacy Rights Act.

Are there legal grounds authorizing the collection of external data and data from unspecified subjects for system improvement and learning, whether during testing or while in operation?

Yes. The regulations state that, “The manufacturer shall also certify that it will make available updates pertaining to location and mapping information utilized or referenced by the autonomous technology for the safe operation of the vehicle in the operational design domain on a continual basis consistent with changes to the physical environment captured by the maps sensors, or other information.” Cal. Code Regs. tit. 13, § 228.06.

Additionally, the regulations also address personal information collected by the AV. They state:

“(a) The manufacturer shall either:

1. Provide a written disclosure to the driver of an autonomous vehicle, and for vehicles that do not require a driver, the passengers of the vehicle, that describes the personal information collected by the autonomous technology that is not necessary for the safe operation of the vehicle and how it will be used; or,
2. Anonymize the information that is not necessary for the safe operation of the vehicle.

(b) With respect to a vehicle the manufacturer sells or leases to a customer, if the information is not anonymized, the manufacturer shall obtain the written approval of the registered owner or lessee of an autonomous vehicle to collect any personal information by the autonomous technology that is not necessary for the safe operation of the vehicle.

(c) A manufacturer shall not deny use of an autonomous vehicle to any person on the basis that they do not provide the written approval specified in subsection (b) of this section.”

Cal. Code Regs. tit. 13, § 228.24

Is there any obligation for AV operators to collect and provide operation data, e.g. telemetrics?

Yes. Operators have a duty to collect and provide data, as established in the California Code of Regulations.

“The manufacturer shall certify in the application that the autonomous vehicles are equipped with an autonomous technology data recorder that captures and stores autonomous technology sensor data for all vehicle functions that are controlled by the autonomous technology at least 30 seconds before a collision with another vehicle, person, or other object while the vehicle is operating in autonomous mode. The data captured and stored by the autonomous technology data recorder, in a read only format, must be capable of being accessed and retrieved by a commercially available tool.” Cal. Code Regs. tit. 13, § 228.06.

***California’s approach is being largely being followed by states such as New York and Michigan, among other left-leaning (Democratic party) states***

What incentives, subsidies, or regulatory support exist for businesses developing and deploying AV technology?

Contra Costa Transportation Authority conducts many projects to further the development of AVs and are supported by grants from the U.S. Department of Transportation (USDOT) and the California State Transportation Agency.

Additionally, regulations such as the California Health and Safety Code, § 39719.2, offer funding for projects involving advanced transportation technology. This includes projects involving vehicles that advance freight efficiency and reduce greenhouse gas emissions, like AVs.

What major AV projects, pilot programs, or business partnerships are currently active in your jurisdiction?

Pilot projects by Contra Costa Transportation Authority (CCTA):

• PRESTO Rossmoor: Partnership with Beep, which features two zero-emission PRESTO shuttles that travel in a one-mile loop in a over-55 community in Walnut Creek, CA.
• PRESTO Martinez: Partnership with May Mobility, which features 7 self-driving vehicles providing free shuttle service for patients at the Contra Costa County hospital, aiming to provide accessible health care transportation. They also offer general trips around Martinez, CA during off-peak hours.
• Personal Mobility Pilot: Nissan vehicles will be equipped with self-driving technology to test how connected vehicles can help traffic flow more smoothly and safely. Verizon video systems will be installed along a two-mile stretch of I-680 to monitor the vehicles and collect data. The pilot also includes the installation of equipment at four intersections that will alert the self-driving vehicles of nearby pedestrians, cyclists, and cars.

Changes proposed by the DMV in the 2025 CA REG TEXT 691799 (NS):

Operation of Autonomous Commercial Vehicles

Permit testing and deployment of heavy-duty AVs. Under these draft rules, their operation would be allowed but limited to roads with speed limits of 50 mph or higher and frontage access roads. Additionally, the regulations would prevent the trucks from carrying certain payloads, like hazardous chemicals.

Phased permit process

Manufacturers will be required to initially hold a permit to test with a safety driver in the vehicle and then apply in subsequent phases for a Driverless Testing Permit and a Deployment Permit. Manufacturers will be required to conduct testing for a minimum number of miles prior to applying for a driverless testing permit and a deployment permit and are required to submit a Safety Case with each permit application that describes how they are comprehensively addressing safety at an organizational, operational and vehicle level (Sections 227.28, 228.08). For deployment, the manufacturer's safety case shall include evidence demonstrating that operation of the subject automated driving system does not pose an unreasonable risk of accident, death, injury, or exacerbating injury and explain why that evidence supports the claim.

Light-Duty Operations

To apply for a Driverless Testing Permit for light-duty operations, a manufacturer will be required to conduct testing with a Drivered Testing Permit within the proposed operational design domain for a minimum of 50,000 miles, as well as provide the department with an assessment supporting the manufacturer's safety claims (Section 227.42). To apply for a Deployment Permit, a manufacturer would be required test a minimum of 50,000 miles throughout the intended operational design domain with a valid Drivered Testing permit for vehicles that require a driver physically located in the driver's seat or with a valid Driverless Testing permit for vehicles that are capable of operating without the presence of a driver physically located in the driver's seat (Section 228.08).

Heavy-Duty Operations

To apply for a Driverless Testing Permit for heavy-duty operations, a manufacturer would be required to conduct testing with a Drivered Testing Permit within the proposed operational design domain for a minimum of 500,000 autonomous miles and provide the department with an assessment supporting the manufacturer's safety claims. Up to 400,000 of these miles may occur in other jurisdictions contingent on the manufacturer providing a summary of testing from that jurisdiction, including collisions, disengagements, and braking events. 100,000 miles must occur within the intended operational design domain in California (Section 227.42). To apply for a Deployment Permit, a manufacturer would be required to test a minimum of 500,000 autonomous miles throughout the intended operational design domain with a valid Driverless Testing Permit. Up to 400,000 of these miles may occur in other jurisdictions contingent upon the manufacturer providing a summary of testing. 100,000 miles must occur within the intended operational design domain in California (Section 228.08).

Expanded Data Reporting Requirements

In support of the department's role related to monitoring and tracking the safe operation of autonomous vehicles on public roads, the regulations expand both the frequency and type of data reported to the department during testing and deployment. For both light-duty and heavy-duty operations, changes to data reporting requirements includes aligning crash reporting with the current requirements of the National Highway Traffic Safety Administration's Standing General Order (Sections 227.54, 228.34), as well as requiring monthly reporting on disengagements (Section 227.56), vehicle immobilizations (Sections 227.58, 228.36), hard braking events (Section 227.46), and Dynamic Driving Task Performance Relevant System Failures (Section 228.38). This expanded data reporting will increase public transparency and enhance conversations and coordination with local entities.

Incidents Involving Operation of Autonomous Vehicles on Public Roads

The regulations further define the department's processes for obtaining information from a manufacturer regarding any incidents involving the operation of their autonomous vehicles and for reviewing what steps the manufacturer has taken to address the cause(s) of any incidents. The "Preliminary Information Notice" process would require manufacturers to provide preliminary information on an incident (Sections 227.68, 228.42). The additional "Request for Information" process would require manufacturers to submit any additional substantive information within 10 business days (Sections 227.70, 228.44). A manufacturer's failure to comply with the department's requests for information could serve as a basis for a permit suspension, revocation, or restriction. The regulations also define the process and create the form associated with the AV Notice of Noncompliance, whereby a peace officer may issue a notice to the manufacturer when an alleged traffic violation is observed. A peace officer may indicate a need for priority review of an incident if the officer observes that the autonomous vehicle exhibited driving behavior which reasonably led the officer to believe that the operation presented a clear or potential danger or risk of injury to others. If a priority review is marked on the form, the manufacturer shall submit the notice to the department within 24 hours of issuance.

Testing and Deployment Permit Restrictions

In addition to the department's current authority to suspend or revoke a permit, the regulations provide greater discretion to assess incremental enforcement measures against a manufacturer where the department determines that the circumstances of the incident do not require a full suspension or revocation to address or mitigate the precipitating issue. These temporary operational restrictions could include reductions in the manufacturer's fleet, hours of operation, or geographic area of operation. Such restrictions could be lifted after the manufacturer provides the department with data verifying that the circumstances initially prompting the operational restriction have been remediated (Sections 227.46, 228.22).

Interactions with First Responders

The regulations include provisions to further enhance interactions between first responders and driverless autonomous vehicles, including the vehicle's ability to recognize emergency vehicles and respond to directions from first responders. To enable ongoing communication and coordination with first responders, manufacturers would be required to review and update their First Responder Interaction Plan more frequently and provide ongoing training to first responders in their geographic area of operation (Section 227.42). The regulations also include requirements associated with the issuance of a Notice of Autonomous Vehicle Noncompliance in instances where a peace officer observes an alleged violation of the Vehicle Code, or a local traffic ordinance adopted pursuant to the Vehicle Code (Sections 227.66, 228.40).

Requirements for Autonomous Vehicle Remote Drivers and Remote Assistants

Remote operations personnel may provide support to an autonomous vehicle in certain circumstances, such as when the vehicle achieves a minimal risk condition or while interacting with first responders. The regulations create a standardized framework of requirements, training, and qualifications for both remote assistants (Sections 227.40, 228.06) and remote drivers (Sections 227.38, 228.06).