NHTSA ADS-DV Requirements and AV STEP

Regulatory Context

The Federal Motor Vehicle Safety Standards at 49 CFR Part 571 were promulgated under the National Traffic and Motor Vehicle Safety Act of 1966 and presuppose a human driver and a conventional vehicle layout. An Automated Driving System Dedicated Vehicle, defined as a vehicle whose driving operation does not require a human driver, sits in tension with FMVSS provisions written around steering wheels, brake pedals, and driver-facing telltales. NHTSA's response has been twofold: targeted FMVSS amendments (notably the March 2022 Final Rule on occupant protection for vehicles without manual driving controls, which revised FMVSS 208 and related standards), and the exemption pathway under 49 CFR Part 555 by which a manufacturer may petition for a temporary exemption from a specific FMVSS on grounds including the development or field evaluation of a low-emission, advanced, or otherwise innovative vehicle.

The Voluntary Safety Self-Assessment (VSSA), introduced in NHTSA's Automated Driving Systems: A Vision for Safety 2.0 in September 2017 and reinforced in subsequent guidance, invites ADS developers to publish a structured assessment addressing system safety, operational design domain, object and event detection and response, fallback, validation methods, human-machine interface, vehicle cybersecurity, crashworthiness, post-crash ADS behavior, data recording, consumer education and training, and federal/state/local laws. The VSSA is voluntary and does not confer regulatory approval, but its content and consistency are routinely cited by NHTSA, plaintiffs, and state regulators as evidence of the developer's safety case maturity.

NHTSA Standing General Order 2021-01, issued in June 2021 and amended in subsequent quarters, requires manufacturers and operators of ADS- and Level 2 ADAS-equipped vehicles to report crashes meeting defined thresholds within prescribed windows — generally one calendar day for incidents involving a vulnerable road user, an air-bag deployment, a hospital-treated injury, a fatality, or a tow-away, and ten calendar days for other reportable crashes. The Order codifies an expectation that the operator can produce, on a regulator's timetable, a structured incident record tied to the vehicle's actuation history. The proposed AV STEP framework, published for comment in January 2024, would extend the voluntary architecture by offering a national review-and-reporting program for ADS-equipped vehicles in exchange for elevated transparency obligations.

State frameworks operate alongside the federal regime. Florida HB 7027, enacted in 2019 and codified in Florida Statutes Chapter 316, authorizes the operation of fully autonomous vehicles on Florida roadways without a human operator subject to insurance, registration, and minimal-risk-condition requirements. Comparable enabling statutes exist in Arizona, Nevada, California (under DMV Article 3.7), Texas, and Michigan. Each state regime presupposes that the operator can demonstrate, when challenged, both how a specific actuation decision was made and how it was bounded by the operator's stated policy.

Architectural Requirement

The defining architectural requirement of an ADS-DV operating under the combined federal and state regime is that every actuation be issued from a substrate that records, at the moment of issuance, what the actuation was, what alternatives were available, what authority admitted it, and what verification followed it. The VSSA, the Standing General Order, the AV STEP framework, and state-level minimal-risk-condition obligations all presuppose this property; none of them prescribe it as an architectural requirement, which is why operators that treat compliance as documentation produced after the fact accumulate ongoing engineering cost and unbounded discovery exposure.

The architecture must also support graduated response. An ADS encountering a perception ambiguity, a localization disagreement, or a planner uncertainty cannot reduce its options to "execute the planned trajectory" or "halt." It must be able to continue under elevated monitoring, defer the maneuver until conditions clarify, refuse the maneuver and request a fallback, or execute a partial actuation that preserves controllability while reducing exposure. This graduation is what the SAE J3016 minimal risk condition, the FMVSS 208 occupant-protection logic for ADS-DV vehicles, and the state-level MRC obligations all presuppose; an architecture that collapses to two states cannot satisfy any of them.

Post-actuation verification is the third structural requirement. Standing General Order 2021-01 reporting is impossible to satisfy on a one-day window if the operator cannot, immediately after a reportable event, reconstruct the actuation chain that led to it; AV STEP transparency is impossible to sustain if the actuation chain is reconstructed by a forensics team weeks after the incident. The architecture must produce, as a byproduct of every actuation rather than as a separate logging path, a verifiable record that the intended bound was respected and that the observed outcome matches the predicted envelope.

Why Procedural Compliance Fails

The dominant procedural pattern in ADS development is the safety case document layered over a conventional autonomy stack: a perception module, a planner, a controller, and a logging system, with a separate compliance team producing a VSSA, an MRC policy, and an incident-response playbook. This pattern superficially satisfies NHTSA's voluntary expectations because the artifacts exist, but it fails the architectural requirement because the artifacts and the actuation substrate are not the same object. When an SGO 2021-01 report must be filed within twenty-four hours of a vulnerable-road-user incident, the compliance team cannot produce a structural answer; it can produce a log dump and an engineer's narrative reconstruction.

The procedural pattern also fails under FMVSS exemption review. A Part 555 petition must articulate why the requested exemption is consistent with the public interest and the objectives of the Safety Act, which in practice requires the petitioner to demonstrate that its actuation policy is bounded in a way the absent FMVSS would otherwise have bounded it. Operators whose actuation discipline lives in a separate document from their actuation substrate find it difficult to make this demonstration without extensive forensic work, and the work must be repeated for each renewal because the substrate continues to evolve while the document stands still.

Bolt-on compliance collapses fastest under litigation. Plaintiffs' counsel in post-incident litigation are now sophisticated about the gap between the published VSSA and the actual actuation substrate, and discovery routinely targets the actuation logs, the planner cost functions, and the override histories rather than the published safety case. An operator whose actuation substrate cannot, on its own, produce a coherent account of why a specific maneuver was selected, what alternatives were considered, and what bound was respected will find that the safety case it published two years earlier is treated as marketing material rather than as evidence.

What the AQ Primitive Provides

Governed actuation in the Adaptive Query architecture comprises three primitives that directly address the architectural requirement. Graduated actuation modes treat the response to operational uncertainty as a structural choice among continue, defer, refuse, and partial, rather than as an ad hoc planner heuristic. Each mode is admissible under declared authority — the operator's policy, the operational design domain, the state-level MRC obligation — and the choice among them is recorded at the moment of issuance with reference to the conditions that admitted it.

Harm minimization is the second primitive. Where an actuation must proceed under residual uncertainty, harm minimization expresses the policy that bounds the planner's selection among admissible trajectories: minimize predicted exposure to vulnerable road users, preserve controllability margins, prefer trajectories whose envelope is verifiable post hoc, and refuse trajectories whose envelope cannot be verified. The policy is encoded against the actuation substrate rather than carried in a document, which means it can be inspected by NHTSA under an AV STEP review, by a state regulator under an enabling statute, or by a court under discovery without trusting the operator's narrative reconstruction.

Post-actuation verification is the third primitive. Every actuation produces, as a structural byproduct rather than as a parallel log, a verifiable record that the intended bound was respected and that the observed outcome matches the predicted envelope. Where the observed outcome diverges from the envelope, the divergence is surfaced to the operator's safety-case discipline rather than absorbed into the planner's next iteration. This is the property that lets the operator answer SGO 2021-01 reporting on the regulator's timetable rather than its own.

Compliance Mapping

Graduated actuation modes map directly to the SAE J3016 minimal risk condition, to the FMVSS 208 occupant-protection logic for ADS-DV vehicles as revised by the March 2022 Final Rule, to the VSSA expectation of articulated fallback strategies, and to state-level MRC obligations under Florida Statutes Chapter 316 and comparable enabling statutes. Each of these regimes presupposes that the ADS can elect among bounded responses to operational uncertainty; the AQ primitive expresses that election structurally rather than as a planner heuristic, which permits the same substrate to satisfy concurrent obligations across the federal and state regimes.

Harm minimization maps to the VSSA's twelve-element framework — particularly the elements addressing system safety, operational design domain, object and event detection and response, and fallback — and to the public-interest test that an FMVSS exemption petition under 49 CFR Part 555 must satisfy. The structural encoding of the policy lets the operator produce, on demand, the bound that the FMVSS would otherwise have produced, which is the substantive question a Part 555 reviewer asks even when the procedural question is whether the petition meets formal requirements.

Post-actuation verification maps to Standing General Order 2021-01 reporting, to the AV STEP transparency expectation articulated in NHTSA's January 2024 notice, and to the discovery posture an operator faces in post-incident litigation. By making verification a structural byproduct of actuation, the primitive aligns the operator's substrate with the reporting obligations its regulators and counterparties already impose, and it does so on the regulator's timetable rather than the operator's forensics team's.

Adoption Pathway

Adoption of governed actuation in an ADS-DV program proceeds in three stages. The first stage is policy declaration: the operator articulates its graduated-actuation policy, its harm-minimization bounds, and its post-actuation verification expectations against the AQ primitives rather than in a separate document. This stage is intentionally explicit about the authorities that admit each mode — the operator's safety policy, the ODD specification, the state-level MRC obligation, the FMVSS or its exemption — and the output is a substrate whose authority structure matches the regulatory frame the operator is already obligated to.

The second stage is substrate integration: the planner, the controller, and the logging path are routed through the governed-actuation primitives rather than alongside them. At this stage the actuation log is the structural record rather than a parallel artifact, and the VSSA, the SGO 2021-01 incident response, and any AV STEP submission draw from the substrate directly rather than from a forensics reconstruction. Operators that complete this stage typically find that the marginal cost of each new ODD expansion drops sharply, because the compliance work is now an extension of the substrate rather than a parallel program.

The third stage is regulatory engagement: the operator engages NHTSA under the AV STEP framework, files Part 555 exemption petitions where required, and participates in state-level approval pathways under Florida HB 7027 and comparable enabling statutes, all from the same substrate. The trajectory of NHTSA policy — toward AV STEP, toward expanded SGO reporting, toward FMVSS reform for ADS-DV vehicles — is toward exactly the kind of structural answerability that governed actuation provides, and operators that begin the substrate work early will be operating at lower marginal cost than peers still maintaining bolt-on compliance when the next rulemaking lands.