Autonomous vehicles law and regulation in Germany

With the 2017 amendment to the Road Traffic Act (StVG) and the 2021 Autonomous Driving Act, Germany has established a model legal framework for the operation of SAE Level 2-4 AVs.

SAE Level 2 AVs requiring a driver constantly responsible for the operation of the vehicle are not subject to specific approval and operational requirements. As a consequence the driver needs to per-manently supervise the system which in turn needs to enable the driver to fulfil his behavioral obliga-tions.

SAE Lever 3 and 4 AVs are subject to specific requirements pursuant to §§ 1a and 1b StVG under which the driver may divert its attention from the operation of system if still able to retake control if required.

The 2021 Autonomous Driving Act has introduced the possible use of SAE Level 4 AVs without a fall-back driver present in the vehicle. Such limited autonomy is restricted to vehicle specific opera-tional areas (and potentially operating conditions) that must be approved by the responsible state authority. While no driver is required on board, a ‘Technical Supervisor’ must monitor the vehicle and deactivate it in the event of difficulties.

On private grounds, AV operations are not subject to public road traffic laws. However, general safe-ty and liability regulations, including workplace safety and insurance requirements, still apply.

On public roads, Germany’s regulatory framework allows for the testing and gradual integration of autonomous driving functions. The Federal Motor Transport Authority (KBA) can issue testing per-mits for AV trials (§ 1i StVG). Additionally, vehicles that are not yet fully compliant with EU or UN/ECE regulations due to autonomous functions can still receive operational approval, as long as the unapproved functions remain deactivated in public traffic and do not affect vehicle operation (§ 1h StVG).

The use and testing of SAE Level 2 AVs does not require special permits as long as a driver remains in control.

Liability for damages and insurance in autonomous traffic is currently largely governed by general traffic liability rules as opposed to rules that are specific to AVs.

Vehicle holder: Liability of the holder is generally subject to strict civil liability according to existing general rules. The amendment to the Road Traffic Act of 2017 has doubled the maximum amount of strict liability for highly and fully automated driving functions to EUR 10 million for personal injury and EUR 2 million for property damage. In addition, civil and criminal liability for negligence applies according to general regulations.

Driver / operator: Liability of the driver (if one is required) is subject to civil liability for presumed negligence according to existing general rules. Depending on the level of automation the reference for driver obligations varies, e.g. relating to the obligation to supervise the system or take control of a malfunctioning system.

Manufacturer: Liability of the manufacturer is subject to strict civil liability for product defects and liability for negligence according to existing general rules. Criminal liability for product defects is well established, but its application to autonomous driving has not yet been clarified.

System provider: AV system providers may be subject to civil and criminal liability for negligence for damages caused by the operated system according to existing general rules. However, there is currently no specific legal framework explicitly assigning liability to software providers, and liability claims would likely be pursued under general product liability and tort law.

Technical Supervisor: The Technical Supervisor is not considered a driver and is therefore not sub-ject to driver liability. However, they may be held accountable under general tort law.

Ongoing discussions in Germany and the EU indicate a potential shift of liability scenarios into the area of responsibility of manufacturers and system providers.

Autonomous decisions and human life: AVs are legally prohibited from prioritizing one human life over another based on personal characteristics. However, the law does not explicitly prohibit quanti-tative assessments.

Cyberattacks: In the event of a cyberattack, failure to comply with cybersecurity duties under § 1f para. 3 StVG can result in civil liability for the manufacturer. However, the holder can generally not be held responsible for a not negligently enabled unauthorized use of the vehicle, regardless of whether the vehicle was already in operation or was only put into operation as a result of the attack which may limit holder liability.

Insurance: There are no mandatory insurance requirements that apply specifically to the use of AVs in Germany, but there are general mandatory insurance requirements for third party damages that apply to all vehicles driving on roads in Germany.

AV owners must (and may only) store certain operational data to ensure traceability of liability-relevant events and determine responsibility in case of incidents (§ 1g para. 1 StVG). This includes safety-relevant and communication data that provide insights into vehicle operation and supervision. Additionally, data must be recorded in predefined situations, such as when the Technical Supervisor intervenes, or the vehicle makes an unplanned lane change.

Any collection of external data, including from unspecified subjects, must comply with the GDPR. The relationship between the storage obligation under the StVG and the GDPR has not yet been clari-fied in full.

The KBA is authorized to collect data from AV owners to monitor safe operation of the vehicle. Non-personal data may also be made available for traffic-related public interest purposes.

Regarding data security, the AV manufacturer must demonstrate that the vehicle’s electrical and elec-tronic architecture, as well as any architecture connected to the vehicle, is protected against cyberat-tacks (§ 1f para. 3 StVG).

The German government intends to expand the deployment of AVs in the coming years. The current government coalition has reaffirmed its aim to make Germany a lead market for AVs. AV deploy-ment is tied to broader goals of digitalization, climate policy, and improved mobility. Public invest-ment, including a €500 billion infrastructure fund, supports digital and transport upgrades.

Several pilot projects are already active. The KIRA project operates Level 4 autonomous shuttles in public transport in the Darmstadt region. Volkswagen's Moia is trialing autonomous ride-pooling in Hamburg. In logistics, semi-autonomous trucks are tested by firms like Iveco and Plus Now.

The A9 motorway, stretching between Munich and Berlin, serves as one of Germany’s foremost test corridors for automated and connected vehicles. Among its activities, the A9 hosts KoRA9, a re-search initiative deploying cooperative radar sensors alongside edge-computing units to enrich onboard vehicle data and improve detection capabilities. Aside from infrastructure-focused testing, major OEMs like MAN Truck & Bus have conducted SAE-Level 4 autonomous truck trials on the A9.