National and State-Level Approaches to Automated Vehicle Certification: A Comparative Framework for State Operational Governance

National and State-Level Approaches to Automated Vehicle Certification: A Comparative Framework for State Operational Governance Sk Nahia Ahsan* Graduate Research Assistant, Department of Civil, Construction & Environmental Engineering North Carolina State University, Raleigh, NC 27606 Email: sahsan@ncsu.edu Md. Abdullah Al Hasan Graduate Research Assistant, Department of Civil, Construction & Environmental Engineering North Carolina State University, Raleigh, NC 27606 Email: malhasa2@ncsu.edu Danjue Chen Associate Professor, Department of Civil, Construction & Environmental Engineering North Carolina State University, Raleigh, NC 27606 Email: dchen33@ncsu.edu George List Professor, Department of Civil, Construction & Environmental Engineering North Carolina State University, Raleigh, NC 27606 Email: gflist@ncsu.edu Total number of pages: 19 Submitted [1st August 2026] *Corresponding Author

1

Ahsan, Al Hasan, Chen, List ABSTRACT Objectives: Automated vehicle (AV) deployment in the United States is expanding despite the absence of a unified federal certification framework, resulting in substantial variation in how states authorize and oversee AV testing and deployment. This paper examines how U.S. states regulate Society of Automotive Engineers (SAE) Level 4–5 automated driving systems (ADS), identifies common certification approaches, compares them with international practices, and evaluates the implications for North Carolina's future regulatory strategy. Methods: The study reviewed publicly available state statutes, administrative regulations, agency guidance documents, and federal policy documents governing AV deployment. Ten U.S. states, selected to capture the range of observed regulatory approaches, were analyzed using a structured framework covering operational scope, governance and oversight, federal interaction, and implementation outcomes. International certification practices from the European Union, China, Japan, and Australia were reviewed for comparative context, and findings were synthesized into a comparative framework of state certification models. Findings: Three distinct state certification models were identified, representing increasing levels of regulatory involvement: baseline legal compliance, administrative self-certification with ongoing oversight, and permit-based authorization requiring formal agency review before deployment. North Carolina currently aligns with the baseline compliance model. International frameworks are converging toward scenario-based testing, operational-design-domain-specific approval, and safety-case documentation, cybersecurity assurance, and lifecycle oversight, although direct transferability to the U.S. is limited. Novelty: This paper develops a structured three-model typology for comparing state AV certification approaches and integrates state-level regulatory practices with international certification frameworks, providing a consistent basis for evaluating differences in regulatory involvement, governance complexity, and institutional responsibilities across jurisdictions. Practical Applications: The proposed framework offers transportation agencies and policymakers a practical decision-support tool for evaluating alternative approaches to AV governance, supporting future legislative and institutional planning by clarifying trade-offs among safety oversight, administrative burden, deployment flexibility, and organizational capacity.

2

Ahsan, Al Hasan, Chen, List INTRODUCTION The emergence of automated driving systems (ADS) at Society of Automotive Engineers (SAE) Levels 4 and 5 presents a fundamental challenge to existing vehicle safety and certification frameworks. Traditional regulatory pathways were designed for human-operated, mechanically oriented vehicles in which safety performance is assessed through static hardware tests and driver licensing. The integration of software-intensive systems, artificial intelligence (AI), sensor fusion, and continuous over-the-air updates introduces new dimensions of uncertainty that static one-time approval processes are ill equipped to address. As ADS development progresses, driving responsibility increasingly shifts from the human driver to a computer-based system. In some configurations, the human is removed from the control loop entirely. This paradigm shift creates novel verification challenges across multiple fronts: AI-based perception and decision-making modules require specialized evaluation for model generalization and edge-case robustness; cybersecurity threats affect both safety-critical and non-safety-critical vehicle functions; and software updates alter system behavior over time in ways that periodic certification cannot track (Baldini 2020; Koopman and Wagner 2017). The United States adds a structural complication: there is no unified federal regulatory framework governing ADS certification. The National Highway Traffic Safety Administration (NHTSA) exercises authority over vehicle design standards through a self-certification model under the Federal Motor Vehicle Safety Standards (FMVSS), but these standards do not explicitly address fully driverless systems. Operational permissions—testing, deployment, insurance, and enforcement—rest with individual states, producing significant regulatory fragmentation (Congressional Research Service 2025; Urban SDK 2025). In a 2025 survey, more than 93% of AV industry chief executives identified the establishment of a federal policy framework as the single most consequential action needed for safe deployment (AVIA 2025). Against this backdrop, state governments serve as the primary operational governors of ADS on public roads. Understanding how states currently structure authorization and oversight—and how those structures compare internationally—provides essential context for states such as North Carolina that must decide how to calibrate their regulatory posture as AV technologies mature. Although several studies and policy reports describe individual state regulations or federal guidance, a systematic framework that compares state operational governance models and synthesizes them into a unified classification remains lacking. Such a framework is needed to better understand differences in regulatory complexity, institutional responsibilities, and potential pathways for states considering future AV oversight. This paper addresses the following research question: when an AV operator seeks to test or deploy an ADS within a U.S. state, how does the state regulate that activity, what requirements are imposed, and where do state practices converge or diverge? The analysis draws on publicly available state statutes, administrative rules, agency guidance documents, and interview-based insights from complementary NCDOT-sponsored research (Feng et al. 2026). The remainder of the paper reviews the U.S. federal regulatory context, examines state-level certification practices and develops a three-model typology, compares these practices with international regulatory approaches, evaluates their implications for North Carolina, and concludes with key findings and considerations for future AV governance. FEDERAL REGULATORY CONTEXT Federal authority over AV safety in the United States is exercised primarily through NHTSA under existing motor vehicle safety law. In the absence of AV-specific regulations, federal oversight relies on the traditional self-certification model: manufacturers certify that their vehicles comply with FMVSS, even though these standards were not designed with autonomous architectures in mind. NHTSA has supplemented this framework with non-binding policy guidance—Automated Driving Systems 2.0, 3.0, and 4.0—covering system design, operational domains, and cybersecurity considerations, but these documents do not constitute regulatory approval or a formal certification process (NHTSA 2017, 2020, 2021). 3

Ahsan, Al Hasan, Chen, List Post-deployment federal oversight operates through defect investigations, mandatory crash reporting for ADS-equipped vehicles under a Standing General Order, and recalls. Limited FMVSS exemptions are available to facilitate testing, but they are constrained in scope and unsuitable for largescale commercial deployment. Key issues—liability assignment, cybersecurity standards, and operational governance—remain largely unresolved at the federal level and have been addressed piecemeal by states (Congressional Research Service 2025). Potential future directions under discussion include minimum standards for ADS safety behaviors (e.g., fallback performance, object detection benchmarks), operational design domain (ODD)-specific certification approvals, nationally standardized scenario-based performance tests, safety-case submission requirements aligned with UL 4600 and ISO 21448, and continuous post-market data reporting requirements (NHTSA 2017, 2021; RAND Corporation 2018; Congressional Research Service 2025). The current absence of a unified national framework has led to a patchwork of state permitting systems and substantial variation in how ADS operations are authorized and monitored across the country. STATE LEVEL CERTIFICATION PRACTICES Analytical Framework Ten U.S. states — California, the District of Columbia, Pennsylvania, Texas, Washington, Arizona, Georgia, North Carolina, Wyoming, and Michigan — were selected for review to capture the range of observed regulatory approaches, from minimal baseline compliance to formal permit-based authorization, and to reflect states with documented AV testing or deployment activity. To support a systematic review, a set of analytical questions covering four dimensions was developed: (A) scope and operational conditions, (B) governance, evidence requirements, and oversight, (C) interaction with federal policy and cross-state portability, and (D) implementation outcomes as shown in Table 1. These questions were applied consistently across all reviewed jurisdictions to enable structured comparison and identification of common regulatory patterns. Sources included state statutes, administrative rules, agency guidance documents, official websites, and interviews conducted in January–February 2026. The synthesis focuses on SAE Level 4–5 vehicles—commonly described in state statutes as 'fully autonomous vehicles'—because Level 4 ADS increasingly enables driverless operation and therefore attracts more stringent and consequential state oversight. Level 3 deployments remain limited in practice. TABLE 1 Questions Used to Review State AV Certification Practices Category Question Question ID A. Scope and A1 What certification or authorization model is used (e.g., selfOperational certification, submission-based approval, authority-issued permit)? Conditions A2 Does certification or authorization differentiate by AV vehicle type or use case? A3 Is certification or authorization tied to specific operational phases (e.g., testing, pilot, deployment)? A4 Is certification or authorization explicitly conditioned on an Operational Design Domain (ODD)? B. Governance, B1 Which entity is responsible for issuing AV certification or Evidence, and authorization? Oversight B2 How are roles and responsibilities allocated between state and local governments? B3 What types of evidence or documentation are typically required for certification or authorization? B4 Under what conditions is re-certification or renewal required? B5 Under what conditions can certification or authorization be suspended or revoked? 4

Ahsan, Al Hasan, Chen, List

C. Federal Interaction and Portability D. Implementation Outcomes

B6 C1 C2 D1

What reporting obligations apply after deployment? Is AV certification or authorization portable or recognized across states? How does state certification or authorization interact with federal policy and requirements? Which AV developers or operators have obtained certification or authorization?

A Three-Model Typology Comparative analysis of the reviewed jurisdictions identified a consistent pattern that can be generalized into three regulatory models representing increasing levels of regulatory involvement and administrative workload. Higher tiers generally incorporate the requirements of lower tiers. • Tier 1 — Baseline Legal Compliance: Requirements applicable universally, including self-certified compliance with applicable federal standards and state traffic laws, vehicle registration as a fully autonomous vehicle, and state-minimum liability insurance. Compliance is implicit and grounded in existing law without AV-specific administrative programs. • Tier 2 — Administrative Oversight and Self-Certification: Explicit AV-specific administrative elements including safety management plan submission (notably law enforcement interaction procedures), self-certification through an authority-designated platform, and post-deployment reporting obligations such as crash reporting. • Tier 3 — Authority-Issued Permit or Authorization: An explicit permit issued by a public authority prior to any AV testing or operation, entailing a formal review process, defined application requirements, and structured conditions for modification, renewal, and revocation. Based on these tiers, the reviewed jurisdictions naturally cluster into three regulatory groups. Table 2 summarizes the relationship between individual requirements and the resulting classification. TABLE 2 State Certification Models Requirement Item Regulatory Group 1 Group Group 3 Workload & GA, NC 2 AZ, CA, PA, TX, DC Capacity WA Needs Tier 1 Compliance with Light Y Y Y federal standards & state laws Registration Y Y Y Insurance Y Y Y Tier 2 Law enforcement Moderate No Y Y coordination plan Self-certify via No Y Y authority channel Reporting No Y Y Tier 3 Permit prior to High No No Y operate Group 1 — Minimalist (e.g., Georgia and North Carolina): These states use Tier 1 requirements only. AV operation is permitted once baseline legal conditions are met, without AV-specific administrative programs or permitting frameworks. Authorization is largely implicit, grounded in compliance with existing federal and state laws. Group 2 — Administrative Self-Certification (e.g., Arizona and Washington): These states incorporate Tier 2 requirements in addition to Tier 1. Formal administrative processes are established— 5

Ahsan, Al Hasan, Chen, List safety plan submission, self-certification through official platforms, and reporting obligations—without requiring an authority-issued permit prior to operation. Authorization is based on documented compliance and post-deployment oversight. Group 3 — Permit-Based Authorization (e.g., California, Pennsylvania, Texas, and the District of Columbia): These states require an explicit permit or authorization prior to AV testing or operation, through a formal application and review process. Permitting frameworks generally impose more elaborate Tier 2 requirements and may expand to include renewal conditions, operational constraints, data retention requirements, and differentiated permit types by phase or vehicle class. It is worth noting that within Group 3, there is substantial variation in both the level of program elaboration and the stringency of permitting requirements. Although all Group 3 states require authorityissued authorization prior to AV testing or operation, the scope, detail, and procedural rigor of these permitting frameworks differ significantly. California operates the most elaborate and prescriptive program among Group 3 states. Its framework differentiates permits by operational phase (e.g., testing with a safety driver, driverless testing, deployment) and by vehicle type (e.g., seating capacity), and includes detailed reporting obligations and clearly defined renewal and modification conditions. The program reflects a relatively high level of regulatory stringency and well-defined procedures. The program is supported by a distinct regulatory structure involving two primary agencies: the Department of Motor Vehicles (DMV), which handles the technology and vehicle aspects to issue the prerequisite permits, and the California Public Utilities Commission (CPUC), which regulates the commercial service of carrying passengers. Permits from both agencies are required for passenger-carrying operations. Pennsylvania also provides detailed certification guidance; however, much of this material is framed as guidance rather than mandates. As a result, while expectations for AV operation are articulated with substantial details, formal permitting requirements are less prescriptive than in California. Overall, the program is less stringent than California’s. Texas requires authorization for AV operation but maintains comparatively brief statutory requirements. The authorization framework establishes baseline conditions (e.g., presence of a recording device) while avoiding detailed procedural or reporting specifications, resulting in a lower level of elaboration within the permit-based model. Texas only recently adopted a formal permit requirement (effective September 1, 2025), corresponding with increased AV deployment activity and emerging safety concerns (Texas Department of Motor Vehicles [TxDMV] 2025; Robles 2025). The District of Columbia applies a highly restrictive permitting approach, currently requiring a human safety driver behind the wheel for AV operation. The existing permitting framework is interim. A formal framework addressing operation both with and without safety drivers is anticipated and is likely to involve elaborate requirements and a formalized approval process. The district’s permit requirement is also relatively recent, with emergency legislation first enacted in March 2024 (District of Columbia Council 2024).

6

Ahsan, Al Hasan, Chen, List

Figure 1 Conceptual positioning of reviewed states according to relative regulatory elaboration and stringency The states have been positioned across the three groups in Figure 1 using a 2-dimensional plot to illustrate relative levels of elaboration and stringency. While most states align with one of the three groups, several cases fall between categories. For example, Michigan requires that prior to research testing, manufacturer or upfitter must be recognized and submit proof of insurance to the Secretary of State (Mich. Comp. Laws § 257.665 et seq. 2023). However, Michigan has removed permit systems to remain flexible. Thus, Michigan’s model shows features spanning Group 1 and 2. Wyoming represents another situation in which AV operations remain unregulated. In Wyoming, AV operators are encouraged, but not required, to notify the Wyoming Department of Transportation and Wyoming Highway Patrol prior to entry. Please note that these positions only reflect the status as of January 2026 and they may change as legislation evolves. Notably, the different models entail distinct levels of workload and institutional capacity requirements for regulating agencies. • Group 1 model: Light workload and minimum institutional changes. Implementation is typically embedded within existing regulatory frameworks rather than AV-specific programs, requiring little modification to current institutional arrangements. • Group 2 model: Moderate workload and institutional complexity. This model introduces Tier 2 requirements, which require regulatory authorities to review submitted documentation (e.g., safety management plans), conduct post-deployment oversight, and exercise regulatory judgment (e.g., suspending or restricting operations when warranted). As a result, additional institutional considerations arise, including which agencies are best positioned to perform these functions and how responsibilities should be allocated. Multiple agencies may be involved as in Arizona, where both the State Department of Transportation and Department of Public Safety are involved. When multiple agencies are designated, inter-agency coordination becomes an important consideration. • Group 3 model: High workload and institutional design complexity. This model entails formal permitting processes, pre-operation review, and sustained regulatory oversight, placing the greatest demands on administrative capacity and institutional design. Detailed certification practices for all reviewed states are summarized in Table 3, Table 4, Table 5.

7

1

TABLE 3 AV Certification Practice — California, District of Columbia, Pennsylvania, and Texas Category

Question

California (CA)

A. Scope & Operational Conditions

A1. Certification model used?

Permit-based; formal tiered permit program.

A2. Specific to vehicle type or use case?

Yes — differentiates by operational phase and seating capacity.

A3. Tied to specific operational phases?

Yes — Driver Pilot, Driverless Pilot, Phase I Driver Deployment, Phase I Driverless Deployment. Yes — authorization is contingent on the certified ODD.

A4. Conditioned on ODD? B. Governance, Evidence & Oversight

B1. Which entity issues approval?

B2. Role of state vs. local government?

B3. Evidence typically required?

Two agencies: DMV (technology/vehicle) and CPUC (commercial passenger service). Both required. State agencies primary; local agencies have very limited authority.

Varies by permit type; deployment permit requires: DMV AV Manufacturer's Permit, prior 30-day CA road

District of Columbia (DC) Interim permit program; moving toward formal permitting. Distinguishes testing vs. deployment; requires invehicle safety operators. Focus on L3+. Testing allowed; deployment legislation still developing.

Pennsylvania (PA)

Texas (TX)

Self-certification with elaborate guidelines.

Authorization-based; state permit required for driverless AVs. Driverless AVs only (SAE L4–L5).

Uses geofences; retains authority to order vehicles off road for unique events. Department of Transportation (oversight moved from DMV).

ODD defined by developer; expansion requires re-application.

No state-defined ODD.

PennDOT.

Texas Department of Motor Vehicles (TxDMV).

City-state; direct control via Council/Mayor.

PennDOT is sole authority; municipalities prohibited from enacting own regulations.

Certified driving records for remote operators; training frameworks.

Safety Management Plan (driver training, response procedures), insurance.

State maintains authorization authority; local governments explicitly prohibited from regulating driverless vehicles (SB 2205). Authorization materials: safety documentation, insurance, recording device, emergency

8

Applies to Highly Automated Vehicles (HAVs), SAE Levels 3– 5. Approval issued in perpetuity unless material change occurs.

Authorization required prior to driverless publicroad operation.

Ahsan, Al Hasan, Chen, List

B4. When is recertification required? B5. When can it be suspended or revoked?

B6. Reporting requirements?

C. Federal Interaction & Portability

C1. Certification portable across states?

C2. Interaction with federal policy? D. D1. Certified / Implementation authorized Outcomes companies (examples)?

testing, TCP (California charter-party permit) authority, ODD documentation, law enforcement & collision plan, passenger safety plan. TCP Permit Renewal every 3 years; material changes (ODD updates, added shared rides). Administrative failures or extended regulatory review.

interaction info, FMVSS compliance.

Not mentioned.

Implicit authority to restrict road access for safety/security.

Material changes (ODD expansion, vehicle type change, driverless transition). If company operates outside conditions of self-certification.

Extensive; CPUC requires all DMV reports (collision, annual disengagement), quarterly reports, and operational/financial reporting. Not addressed.

(Proposed) digital data via Mobility Data Specification for geofence monitoring.

Crash reporting within 6 hours.

Not mentioned.

FMVSS and NHTSA rules baseline.

National security concerns involving FBI and Homeland Security. Waymo, Zoox.

Not mentioned; PennDOT has authority to negotiate interstate agreements. Uses NHTSA crash data for context.

Waymo, Zoox, Tensor Auto, Apollo Autonomous Driving USA, WeRide Corp.

9

Waymo, Zoox, May Mobility.

No periodic recertification; updates required within 30 days of material changes. Failure to update required info; failure to respond to TxDMV; unsafe operation endangering the public (with notice and opportunity to cure). Standard crash reporting; additional reporting may be imposed via authorization conditions.

Not addressed.

FMVSS and NHTSA definitions remain baseline. Not publicly listed.

Ahsan, Al Hasan, Chen, List 1 2

TABLE 4 AV Certification Practice — Washington, Arizona, Georgia, and North Carolina Category A. Scope & Operational Conditions

Question A1. Certification model used?

Washington Permit-based; formal tiered permit program.

A2. Specific to vehicle type or use case?

Yes — differentiates by operational phase and seating capacity.

A3. Tied to specific operational phases?

Yes — Driver Pilot, Driverless Pilot, Phase I Driver Deployment, Phase I Driverless Deployment. Yes — authorization is contingent on the certified ODD.

A4. Conditioned on ODD? B. Governance, Evidence & Oversight

B1. Which entity issues approval?

B2. Role of state vs. local government?

B3. Evidence typically required?

Two agencies: DMV (technology/vehicle) and CPUC (commercial passenger service). Both required. State agencies primary; local agencies have very limited authority.

Varies by permit type; deployment permit requires: DMV AV Manufacturer's Permit, prior 30-day CA road

Arizona Interim permit program; moving toward formal permitting. Distinguishes testing vs. deployment; requires invehicle safety operators. Focus on L3+. Testing allowed; deployment legislation still developing.

Georgia Self-certification with elaborate guidelines.

Uses geofences; retains authority to order vehicles off road for unique events. Department of Transportation (oversight moved from DMV).

ODD defined by developer; expansion requires re-application.

No state-defined ODD.

PennDOT.

Texas Department of Motor Vehicles (TxDMV).

City-state; direct control via Council/Mayor.

PennDOT is sole authority; municipalities prohibited from enacting own regulations.

Certified driving records for remote operators; training frameworks.

Safety Management Plan (driver training, response procedures), insurance.

State maintains authorization authority; local governments explicitly prohibited from regulating driverless vehicles (SB 2205). Authorization materials: safety documentation, insurance, recording device, emergency

10

Applies to Highly Automated Vehicles (HAVs), SAE Levels 3– 5. Approval issued in perpetuity unless material change occurs.

North Carolina Authorization-based; state permit required for driverless AVs. Driverless AVs only (SAE L4–L5). Authorization required prior to driverless publicroad operation.

Ahsan, Al Hasan, Chen, List

B4. When is recertification required? B5. When can it be suspended or revoked?

B6. Reporting requirements?

C. Federal Interaction & Portability

1

C1. Certification portable across states?

C2. Interaction with federal policy? D. D1. Certified / Implementation authorized Outcomes companies (examples)?

testing, TCP authority, ODD documentation, law enforcement & collision plan, passenger safety plan. TCP Permit Renewal every 3 years; material changes (ODD updates, added shared rides). Administrative failures or extended regulatory review.

interaction info, FMVSS compliance.

Not mentioned.

Implicit authority to restrict road access for safety/security.

Material changes (ODD expansion, vehicle type change, driverless transition). If company operates outside conditions of self-certification.

Extensive; CPUC requires all DMV reports (collision, annual disengagement), quarterly reports, and operational/financial reporting. Not addressed.

(Proposed) digital data via Mobility Data Specification for geofence monitoring.

Crash reporting within 6 hours.

Not mentioned.

FMVSS and NHTSA rules baseline.

National security concerns involving FBI and Homeland Security. Waymo, Zoox.

Not mentioned; PennDOT has authority to negotiate interstate agreements. Uses NHTSA crash data for context.

Waymo, Zoox, Tensor Auto, Apollo Autonomous Driving USA, WeRide Corp.

2 11

Waymo, Zoox, May Mobility.

No periodic recertification; updates required within 30 days of material changes. Failure to update required info; failure to respond to TxDMV; unsafe operation endangering the public (with notice and opportunity to cure). Standard crash reporting; additional reporting may be imposed via authorization conditions.

Not addressed.

FMVSS and NHTSA definitions remain baseline. Not publicly listed.

Ahsan, Al Hasan, Chen, List 1

TABLE 5 AV Certification Practice — Wyoming and Michigan Category A. Scope & Operational Conditions

B. Governance, Evidence & Oversight

C. Federal Interaction & Portability

Question A1. Certification model used? A2. Specific to vehicle type or use case? A3. Tied to specific operational phases? A4. Conditioned on ODD?

Wyoming (WY) Voluntary notification only; no state-led certification or permitting. N/A — no certification requirement.

B1. Which entity issues approval?

N/A — no approval issued.

B2. Role of state vs. local government? B3. Evidence typically required?

Voluntary state notification; local governments may draft ordinances.

B4. When is recertification required? B5. When can it be suspended or revoked? B6. Reporting requirements? C1. Certification portable across states?

N/A.

Prior to research or testing: manufacturer or upfitter must be recognized by Secretary of State and submit proof of insurance under Chapter 31 of the Insurance Code of 1956. N/A.

N/A.

N/A.

No.

N/A; encourages close operating discussion with DOT and law enforcement. Not addressed.

N/A.

No; vehicles must comply with standard road closures (e.g., wind/snow).

AV operators are encouraged (not required) to notify state DOT and Highway Patrol prior to entry.

N/A.

12

Michigan (MI) No permit system; recognition and proof of insurance required by Secretary of State. Yes — applies to manufacturers and upfitters of ADS; also covers SAVE projects (on-demand automated networks) and participating fleets. Applies for research or testing; also for SAVE project operations. Implicit only; operator self-attests safe operation and ability to reach minimal risk condition; no ODD review or approval. Secretary of State responsible for recognizing manufacturers and upfitters of ADS and receiving proof of insurance. Undefined in statute.

Ahsan, Al Hasan, Chen, List

1

C2. Interaction with federal policy? D. D1. Certified / Implementation authorized Outcomes companies (examples)?

Relies on guidance from NHTSA and AAMVA.

Non-automakers required to pass FMVSS.

Not publicly listed.

Not publicly listed.

13

GLOBAL PERSPECTIVE Overview Viewing U.S. practices against international models illuminates both the distinctive features of the U.S. decentralized approach and the direction of global regulatory convergence. Table 6 provides a structured overview of how major regions approach AV certification. TABLE 6 Perspectives on AV Certification Around the Globe Region Main Style Key Strength Approach U.S. SelfEmerging Innovationcertification + hybrid (not friendly, flexible state permits yet defined) European UNECE type Formal, testMost mature and Union approval based, coherent global scenariomodel driven China National Centralized Fast-moving; standards + and extensive scenario mandatory mandatory validation at scale scenario testing Japan ODD-based Cautious, World's first L3 approval + safetycertified vehicle; safety case focused structured safety cases Australia Proposed Safety-case, Clean-slate design; national safety performance- balanced safety law based case and metrics

Key Weakness No unified certification test; fragmented oversight Slower regulatory cycles; limited ODD flexibility Opaque decision-making; IP/data access issues; city fragmentation Slow, individualized; scalability concerns Not yet implemented

United States: An Emerging Hybrid Framework As noted in Section 2, the U.S. regulatory philosophy rests on self-certification and state-level operational permitting, without a unified federal certification program. NHTSA exercises oversight through recalls, investigations, and voluntary guidance. Strengths include rapid innovation and extensive test deployment by developers such as Waymo, Cruise, Aurora, and Kodiak through state testing permit programs. Limitations include uneven safety oversight, no national-level validation tests, and public trust concerns following major AV crash events (NTSB 2022; RAND Corporation 2018; Litman 2025). European Union: UNECE Type Approval with Scenario Testing The EU employs a unified type-approval framework anchored in UNECE WP.29, supported by UN Regulation No. 157 (Automated Lane Keeping Systems), UN Regulation No. 155 (Cybersecurity), and UN Regulation No. 156 (Software Updates). Testing requirements include defined scenario suites for lane keeping, obstacle avoidance, emergency braking, and vulnerable road user protection, combining on-road and closed-course validation with simulation evidence. The framework provides the most complete and harmonized international certification system, though regulatory update cycles are slower and ODD flexibility remains limited (European Commission 2022; UNECE 2021a, 2021b). China: Centralized Standards with Mandatory Scenario Verification China adopts a centralized approach with strong national control and rapidly evolving technical standards from MIIT and MPS (China's regulators), implemented through designated pilot zones in Beijing, Shanghai, and Shenzhen. Mandatory elements include scenario-based testing libraries, closed-course and public-road validation, cybersecurity reviews, data localization requirements, and real-time data access for regulators. Large-scale real-world AV fleets operated by Baidu Apollo and Pony.ai demonstrate the rapid deployment 14

Ahsan, Al Hasan, Chen, List pace. Limitations include opacity for external stakeholders and heavy data compliance burdens (CAICT 2024). Japan: ODD-Based Approval and Safety Case Japan requires formal government approval for each ADS with strong emphasis on ODD documentation. Honda's 2021 approval for the Level 3 Sensing Elite system—the world's first commercially available L3 consumer vehicle—required safety-case documentation, hazard analysis, ODD mapping, redundant hardware validation, and human-machine interface assessment. Japan is moving toward Level 4 robotaxi operations in limited zones during 2025–2030, with close collaboration between national government and major OEMs including Honda, Nissan, and Toyota (METI 2023; Law.asia 2024). Australia and Other Regions Australia is designing a centralized national certification framework built around a mandatory safety case, risk assessment, deploy-and-monitor program, incident reporting system, and change-management system, though implementation is not yet complete. Singapore pursues safety-case approval for each ODD with mandatory simulation-based scenario testing and strong emphasis on remote operator requirements. South Korea combines type-approval with a pilot zone system and cybersecurity integration under its 2020 National AV Act. Dubai has the fastest regulatory approval process outside China, involving mandatory third-party certification and a focus on fleet-based AV services. Comparative Summary of Global Approaches Table 7 provides structured comparisons across the five major regions on certification components, software integrity, performance recording and data sharing, review and oversight elements, and reporting requirements. TABLE 7 Comparison of Global AV Certification Approaches Overview of Regulatory Strategies Across Major Regions Category United States European China Union Regulatory Industry-led Centralized Centralized philosophy selfand national certification harmonized control Main authority NHTSA + UNECE MIIT, MPS, state DOTs WP.29 / local pilot national zones ministries Federal/unified ✖ ✔ ✔ rules Speed of Slow Medium Very fast regulation Certification Components Category U.S. EU China Type approval ● city/national ✖ ✔ required Safety case ● voluntary ✔ integrated ✔ required required (UL 4600) Scenario-based ● developing ✔ mandatory ✔ mandatory testing ODD-specific ● developing ✔ emerging ✔ pilot certification zones Simulation ● informal ✔ mandatory ✔ mandatory evidence required 15

Japan

Australia

Cautious, ODD-based MLIT (Transport ministry)

Safety-case, performancebased National Transport Commission

✔

✔ proposed

Slow– medium

Medium

Japan ✔

Australia ● proposed

✔ required

✔ required

✔ limited

✔ proposed

✔ core

✔ proposed

✔ used

✔ proposed

Ahsan, Al Hasan, Chen, List Closed-course ● ✔ testing National scenario ✖ ✔ in library development Software Integrity Category U.S. EU Functional safety ✔ industry✔ required (ISO 26262) led SOTIF (ISO ● ✔ 21448) integration Cybersecurity ● developing ✔ UNECE certification R155 Software update ✖ ✔ UNECE certification R156 HMI and fallback ● ✔ requirements Performance Recording and Data Sharing Category U.S. EU Robotaxi State and local National deployment approvals Data logging ● ✔ requirements Real-time data ✖ ✖ access to regulators Remote operator ✖ ✔ emerging certification Geographic ODD ● ✔ fencing Review and Oversight Elements Category U.S. EU Recalls for AV ✔ NHTSA ✔ systems Mandatory ● varies by ✔ incident reporting state Continuous ● ✔ oversight National AV ✖ ✔ registry Reporting Requirements Category U.S. EU Public reporting ● CA only ✖ of disengagements Required safety ✖ voluntary ✔ reports

16

✔

✔

✔

✔

●

●

China ✔ required

Japan ✔ required

Australia ✔ required

✔

✔

✔

✔ mandatory

✔ required

✔ proposed

✔ required

✔ required

●

✔

✔

✔

China City and national

Japan National

Australia Proposed

✔

✔

✔

✔ required

✖

✖

✔ required

✔

✔

✔

✔

✔

China ✔

Japan ✔

Australia ✔

✔

✔

✔

✔

●

✔ planned

✔

✖

✔ planned

China ✖

Japan ✖

Australia ✖

✔

✔

✔

Ahsan, Al Hasan, Chen, List Required crash ✔ ✔ ✔ reports Testing database ● NHTSA AV ✔ ✔ access TEST Note: ✔ = Yes / Mature; ● = Partial / Emerging; ✖ = No / Absent

✔

✔ planned

●

●

Across the globe, there is convergence toward scenario-based testing (ISO 34502), ODD-specific certification, safety-case requirements (ISO 21448 / UL 4600), cybersecurity certification (ISO/SAE 21434; UNECE R155), continuous post-market monitoring, and digital infrastructure integration. Europe leads in regulatory completeness and harmonization; China leads in large-scale scenario testing and deployment data; Japan maintains a structured safety-focused program; Australia is designing an integrated national model. The United States focuses on technology development but lags in unified certification (NTSB 2022; RAND Corporation 2018). IMPLICATIONS FOR NORTH CAROLINA Current Position North Carolina currently aligns with the Group 1 baseline legal compliance model, similar to Georgia. AV operation is authorized through compliance with existing federal and state laws—including FMVSS selfcertification, registration as a fully autonomous vehicle, and minimum liability insurance under G.S. 20279.21—without AV-specific administrative programs or permitting frameworks. Local governments are prohibited from enacting additional AV-related regulations. This approach minimizes administrative burden and preserves deployment flexibility but provides limited proactive oversight as driverless operations expand. The State Role: Operational Governance Even absent formal technical certification authority, state agencies occupy a central position in AV governance. Federal authorities retain responsibility over vehicle design standards, recalls, and post-market enforcement. State departments of transportation and motor vehicles sit at the frontline of operational governance: testing authorization, operational rule-setting, vehicle registration, enforcement, and coordination with law enforcement and emergency responders (NHTSA 2017; NCSL 2020; AAMVA 2018). North Carolina may also contribute to federal and national frameworks by raising state-specific test cases, advocating for inclusion of state operating conditions in federal standards, and seeking transparency and advisory participation in certification and oversight processes as they develop (RAND Corporation 2018; NTSB 2022). Pathways Toward More Elaborate Oversight A shift from Group 1 toward Group 2 or Group 3 would expand the scope of operational governance without introducing technical certification responsibilities—algorithm validation, software testing, and hardware certification would remain with manufacturers or federal authorities. If North Carolina were to pursue more elaborate oversight, state-designated authorities could be expected to undertake the following functions: • Establishing operational rules governing permitted vehicle classes, SAE automation levels, geographies, roadway types, speed limits, and operating conditions including ODD boundaries. • Developing administrative mechanisms for authorization such as enhanced registration requirements, expanded insurance provisions, safety management plan submissions, law enforcement interaction protocols, emergency response procedures, and post-deployment reporting obligations. For driverless operations specifically, requirements related to remote operators would be critical, including operator-to-vehicle ratios and workload limits. • Updating incident response capabilities, including AV-informed crash investigation protocols, guidance for law enforcement interactions with driverless vehicles, and procedures for accessing AV operational data to support accountability and liability assessment. 17

Ahsan, Al Hasan, Chen, List • Creating public information mechanisms, including data-sharing protocols within and across state agencies and public-facing transparency tools such as AV operational dashboards. A transition toward more elaborate oversight would likely require legislative action and would involve balancing potential public benefits—enhanced safety assurance and public trust—against increased administrative workload, institutional capacity requirements, and broader economic implications for AV development activity in the state. Supporting Institutional Readiness Beyond authorization mechanisms, expanded ADS oversight would require supporting institutional capabilities across several areas. Planning functions may need to incorporate AV accommodation into infrastructure investment decisions, including work zone protocols for machine-readable layouts, more current digital representations of lane markings and signal phasing and timing, and integration with Transportation Systems Management and Operations responsibilities. Freight AVs will affect truck flow patterns and corridor support needs; rural mobility implications are also anticipated. Technical and policy expertise would be needed in areas such as ADS safety concepts, ODD definition and risk minimization, simulation-based scenario analysis, cybersecurity fundamentals, AVrelated legal and liability frameworks, and public communications. Inter-agency coordination would be essential, involving interfaces with NHTSA (vehicle recalls), FHWA (roadway standards and digital infrastructure), the FCC (V2X communications), state public utility commissions, and neighboring states for freight and autonomous truck corridors. Management of mixed-fleet conditions warrants attention regardless of the regulatory model chosen. As AVs operate alongside human-driven vehicles, states may need to update driver education materials, traffic law, and operational procedures to address AV interaction dynamics—including emergency vehicle encounters, traffic stops involving driverless cars, and the impact of AV behavior on congestion and incident clearance. States may also want to update driver manuals and training materials to reflect mixed-fleet realities. CONCLUSIONS This paper has examined how ADS at SAE Levels 4–5 are authorized and overseen across U.S. states, and compared these practices with emerging international regulatory models. Five findings are particularly noteworthy for state policymakers and transportation agencies. State governments play a central operational role in ADS governance even without formal certification authority. Across the United States, states regulate operation rather than technology design, using registration, insurance, self-certification statements, reporting obligations, and—in some cases— permit-based authorization. Federal oversight remains focused on vehicle design standards, recalls, and post-market enforcement. State ADS practices cluster meaningfully into three models—baseline legal compliance, administrative self-certification, and permit-based authorization—with increasing regulatory workload and institutional complexity. North Carolina currently aligns with Group 1. The three-model typology provides a practical lens for evaluating trade-offs between safety assurance, administrative burden, and deployment flexibility. More elaborate regulatory models involve expanded operational governance, not technical certification. States adopting Group 2 or Group 3 approaches focus on clearer operational rules, formal authorization mechanisms, enhanced incident response, structured data access, and defined conditions for suspension or revocation—measures oriented toward accountability, public safety, and transparency rather than algorithmic validation. A transition toward more elaborate oversight would have significant institutional and planning implications, including the need for workforce expertise in ADS safety and cybersecurity, strengthened inter-agency coordination, public communication readiness, and integration of ADS considerations into infrastructure planning and operations.

18

Ahsan, Al Hasan, Chen, List International experience offers instructive context, though direct transferability is limited by the U.S. federal–state division of authority. Global convergence toward scenario-based testing, ODD-specific authorization, safety-case requirements, cybersecurity assurance, and lifecycle oversight points to principles that may ultimately shape future U.S. federal frameworks within which states will continue to exercise operational governance. The proposed Group 1–Group 3 framework provides a practical basis for comparing state AV governance strategies and may assist policymakers in evaluating future regulatory pathways as automated driving systems continue to evolve within the existing U.S. federal–state regulatory structure. However, the proposed typology is based on comparative analysis of publicly available statutes, regulations, agency guidance, and supporting interviews, and therefore reflects regulatory conditions during the study period. State AV legislation continues to evolve, and individual jurisdictions may transition between regulatory groups over time. ACKNOWLEDGEMENTS This study was conducted as part of a research project sponsored by the North Carolina Department of Transportation (NCDOT). The authors gratefully acknowledge Ms. Sarah Searcy of NCDOT for her guidance and review throughout the project. AUTHOR CONTRIBUTIONS The authors confirm contribution to the paper as follows: study conception and design: George List, Danjue Chen; draft manuscript preparation: Sk Nahia Ahsan, Md. Abdullah Al Hasan. All authors reviewed the results and approved the final version of the manuscript. REFERENCES American Association of Motor Vehicle Administrators (AAMVA). 2018. Jurisdictional Guidelines for the Safe Testing and Deployment of Highly Automated Vehicles. https://www.aamva.org. Autonomous Vehicle Industry Association (AVIA). 2025. AVIA Releases 2025 State of AV Report: AV Industry Surges Past 145 Million Autonomous Miles. https://www.theavindustry.org. Baldini, G. 2020. Testing and Certification of Automated Vehicles Including Cybersecurity and Artificial Intelligence Aspects. EUR 30472 EN. Publications Office of the European Union. https://doi.org/10.2760/86907. China Academy of Information and Communications Technology (CAICT). 2024. Autonomous Driving Strategy and Policy Observation. https://www.caict.ac.cn. Congressional Research Service. 2025. Safety Considerations for Automated Passenger Vehicles. CRS Report No. R48605. Washington, DC: Library of Congress. District of Columbia Council. 2024. Autonomous Vehicle Testing Permit Requirements. D.C. Code § 502352.01. European Commission. 2022. Commission Implementing Regulation (EU) 2022/1426 Laying Down Rules for the Type-Approval of Automated Driving Systems. Official Journal of the European Union, L 221: 1–64. Feng, J., D. Chen, G. List, and Z. Pugh. 2026. State DOT Policy and Regulatory Approaches to Robotaxi Remote Operation. Prepared for the North Carolina Department of Transportation. In review. Koopman, P., and M. Wagner. 2017. “Autonomous Vehicle Safety: An Interdisciplinary Challenge.” IEEE Intelligent Transportation Systems Magazine 9 (1): 90–96. 19

Ahsan, Al Hasan, Chen, List Law.asia. 2024. Latest Legal Trends in Japan on Automated Vehicles. https://law.asia/japan-autonomousvehicle-regulations/. Litman, T. 2025. Autonomous Vehicle Implementation Predictions: Implications for Transport Planning. Victoria Transport Policy Institute. Ministry of Economy, Trade and Industry (METI). 2023. Automated Driving Vehicle Approved as Automated Operation Level 4 System for the First Time in Japan. https://www.meti.go.jp. National Conference of State Legislatures (NCSL). 2020. Autonomous Vehicles | Self-Driving Vehicles Enacted Legislation. https://www.ncsl.org. National Highway Traffic Safety Administration (NHTSA). 2017. Automated Driving Systems: A Vision for Safety. Washington, DC: U.S. Department of Transportation. National Highway Traffic Safety Administration (NHTSA). 2020. Automated Vehicles 4.0: Ensuring American Leadership in Automated Vehicle Technologies. Washington, DC: U.S. Department of Transportation. National Highway Traffic Safety Administration (NHTSA). 2021. Standing General Order on Crash Reporting for ADS-Equipped Vehicles. Washington, DC: U.S. Department of Transportation. National Transportation Safety Board (NTSB). 2022. NHTSA Data on Advanced Vehicle Systems Should Be Standardized. RAND Corporation. 2018. Measuring Automated Vehicle Safety: Forging a Framework. Robles, Daniella. 2025. “Texas to Enforce New Autonomous Vehicle Rules amid Safety Concerns.” The Daily Texan, August 27, 2025. https://thedailytexan.com/2025/08/27/texas-to-enforce-newautonomous-vehicle-rules-amid-safety-concerns/. Texas Department of Motor Vehicles (TxDMV). 2025. Automated Vehicles Regulatory Program. https://www.txdmv.gov/AVprogram. United Nations Economic Commission for Europe (UNECE). 2021a. UN Regulation No. 157: Automated Lane Keeping Systems. UNECE. United Nations Economic Commission for Europe (UNECE). 2021b. UN Regulation No. 156: Software Update and Software Update Management Systems. UNECE. Urban

SDK. 2025. The Current https://www.urbansdk.com.

State

of

20

Self-Driving

Car

Regulations

in

the

U.S.

Related documents

• The Impact of Shared Autonomous Vehicles in Microtransit Systems: A Case Study in Atlanta#629912
• The Impact of Shared Autonomous Vehicles in Microtransit Systems: A Case Study in Atlanta#628050
• Education and Training in Water Operator Certification and its Role in Water Utility System Performance#416005
• DriveSafe DriveAware: A systematic review#824171
• Distributional Patterns in Commercial Trucking Contracts: National Origin, Immigration Status, and Disparate Contract Terms in the Central Valley Owner-Operator Corridor#352802