California’s new autonomous vehicle regulations create the state’s first pathway for testing and deploying heavy-duty AVs while imposing a more rigorous permitting, safety-case, reporting, and enforcement framework for all AV manufacturers.
Finalized by the California Department of Motor Vehicles (the DMV) on April 28, 2026, the regulations (the Regulations) introduce significant new safety and oversight requirements, and expand California’s AV framework to include heavy-duty vehicles over 10,000 pounds, which had previously been excluded. The Regulations do not alter the California Public Utilities Commission requirements that separately apply to AV companies operating robotaxis in the state.
For AV trucking companies, the rules are a milestone, opening access to one of the country’s largest markets, although heavy-duty passenger transport AVs remain generally prohibited in the state. For the broader AV industry, the rules provide greater clarity, especially relating to substantial new compliance requirements.
The Regulations are unlikely to be the last word. The California Teamsters have vowed legal action, and leading state and federal policymakers have promised to overturn or otherwise negate the new rules. Unless and until that happens, however, the Regulations will shape testing and deployment in one of the most important domestic AV markets and may influence AV regulatory frameworks across the country.
What Do the Regulations Change?
Testing and Deployment Permitting
The Regulations retain the DMV’s basic requirement that companies must secure a permit before deploying an AV on public roads. There are separate permits for testing, both with and without a driver, and for commercial deployment. Each permit carries a minimum mileage requirement, which varies for low-speed, light-, and heavy-duty AVs. Manufacturers must provide the DMV with evidence of their ability to respond to judgments for damages, whether through insurance, self-insurance, or a surety bond.
Significantly, manufacturers must now submit an extensive “safety case” to obtain a permit. A safety case is a document that explains the operation of the AV and/or its automated driving system (ADS) and is backed by evidence addressing, at a minimum, 14 key safety areas identified by the DMV. The DMV will substantively evaluate the safety cases, and may enlist third-party technical assistance to do so.
The fact that safety case submission is required rather than voluntary is also a significant development. For nearly a decade, the National Highway Traffic Safety Administration (NHTSA) has encouraged manufacturers to submit Voluntary Safety Self-Assessments (VSSAs). But, as the name suggests, VSSAs are voluntary and do not formally support any permit or regulatory submission. NHTSA does not approve or comment on VSSAs, and manufacturers have tended to submit high-level narrative descriptions of their products. Commenters previously objected to the breadth of this requirement, noting that it goes further than industry-standard definitions of the term, such as the one included in UL 4600; the DMV rejected these concerns. Commenters also raised confidentiality concerns about the use of third parties; the DMV indicated these would be addressed by contractual confidentiality terms.
The Regulations give the DMV substantial discretion over whether to grant a permit. They state that the DMV “shall approve” a testing application if it is “sufficient and all requirements have been met,” but leave it to the DMV to determine what is sufficient. Cal. Code. Regs. tit. 13 § 227.30(a). In order to grant a deployment permit, the DMV must provide public notice and find that the manufacturer “has conducted testing necessary to satisfy the department that operation of the subject [ADS] does not pose an unreasonable risk of accident, death, injury, or exacerbating injury.” Id. at § 228.08(a)(15). “Unreasonable risk” is not defined.
The DMV also has discretion to revoke permits. It may do so upon finding, among other things, that testing or deployment “poses an unreasonable risk of accident, death, injury, or exacerbating injury” or an “imminent hazard.” Id. at §§ 227.48(a)(3), 227.48(c), 228.24(a)(7), and 228.24(b)(9).
The Regulations also create minimum mileage requirements for testing and deployment, and require manufacturers to proceed in a specific sequence: testing must occur first with a test driver in the vehicle, then through driverless testing, and then through commercial deployment. In total, before driverless commercial deployment, a light-duty AV must accumulate at least 100,000 miles, and a heavy-duty AV must accumulate at least 1,000,000 miles, including 200,000 miles in California.
The Regulations also require manufacturers to obtain a permit modification whenever they make any one of seven specified changes, ranging from altering the automation level to changing the days of operation. This requirement is substantial because permit modifications trigger additional mileage, safety-case, and documentation requirements; manufacturers may therefore need to account for regulatory lead time when making operational or technical changes.
Design Requirements
The Regulations also require AVs to adhere to certain design requirements to obtain permits. These design requirements include a two-way voice communication device for emergency response and a “visual indicator” that the ADS is engaged. Such requirements potentially encroach on areas regulated by – and therefore potentially preempted by – NHTSA.
Rules of the Road
The Regulations expand on existing “rules of the road” for AVs by creating a process for local officials to impose emergency bans on AVs in certain zones through “emergency geofencing messages” to manufacturers designating “avoidance areas.” Upon receiving such a message, a manufacturer must direct its AV fleet to leave and avoid the area within two minutes.
The Regulations also expand on the First Responder Interaction Plan rules with which manufacturers are becoming familiar. Plans must include information instructing first responders on how to interact with the vehicle in emergency and traffic enforcement situations, including how to remove the vehicle from the road. Manufacturers must also support first responder training.
Oversight, Enforcement, and Liability
The Regulations establish several oversight, reporting, liability, and enforcement provisions that will impact manufacturers during deployment and following incidents.
Beginning July 1, 2026, law enforcement officers may issue a “notice of autonomous vehicle noncompliance” upon observing an alleged traffic violation. Manufacturers must respond within 72 hours of receipt. The Regulations also allow the DMV to issue “Preliminary Information Notices” to manufacturers, requiring them to submit information regarding traffic violations, unpermitted operations, risky vehicle behavior, or other issues.
The Regulations establish increased data reporting requirements for manufacturers. Depending on the permit type and whether the vehicle requires a driver, manufacturers must report system failures related to dynamic driving task performance, vehicle immobilizations, collisions, vehicle miles traveled, and noncompliance with the Vehicle Code or traffic law. These reporting obligations overlap with existing obligations under NHTSA’s Third Standing General Order (SGO) as well as other state and local reporting obligations. (Additionally, NHTSA requirements still apply to vehicles equipped with ADS, including compliance with all applicable Federal Motor Vehicle Safety Standards and defect reporting, e.g., for defects related to ADS safety.)
Manufacturers seeking to test or deploy AVs in California should begin assessing whether their existing safety documentation, incident reporting systems, first-responder materials, and operational change-management processes are sufficient to satisfy the new framework. If you have any questions concerning the material discussed in this blog post, please contact the members of our Connected and Autonomous Vehicles or Product Safety, Investigations, and Recalls practice groups.