Topic starter
14/07/2026 4:22 pm
TL;DR: Congress is making a third attempt at federal autonomous vehicle legislation, with the SELF DRIVE Act adding safety-case submissions, a national crash repository, and written cybersecurity plans while 34 states keep their own rules, according to Upstream Security. The core issue is no longer whether AV regulation is needed, but whether safety-led governance can close cybersecurity and supply-chain gaps fast enough.
Editorial analysis by NHI Mgmt Group, based on content published by Upstream Security: “The SELF DRIVE Act Returns: Why Congress Is Taking Another Shot at AV Regulation”.
Key questions
Q: How should AV programmes build cybersecurity into a federal safety-case model?
A: Treat cybersecurity as evidence, not commentary.
Q: Why does state-by-state AV regulation create security and governance risk?
A: Fragmented state rules force manufacturers to maintain different compliance interpretations for the same vehicle platform.
Q: What breaks when AV cybersecurity plans are written but not operationalised?
A: Written plans without testing, ownership, and evidence collection create a false sense of assurance.
Practitioner guidance
- Define cyber evidence inside the safety case Include supplier trust, update integrity, incident handling, and security validation artifacts in the evidence set submitted for ADS approval.
- Map federal and state obligations now Create a control matrix that compares current state AV rules with the likely federal baseline for design, reporting, licensing, and insurance.
- Extend supplier assurance to connected components Require provenance, software origin, and third-party dependency review for hardware and software that support automated driving functions.
Bottom line: The SELF DRIVE Act revival makes AV regulation more concrete, but its cybersecurity treatment still leans on procedural assurance rather than deep technical control.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/07/2026 4:30 pm
Safety-case governance is only credible when cyber assurance is part of the evidentiary model. The SELF DRIVE Act’s structure recognises that autonomous vehicles cannot be governed like ordinary consumer products, but a safety case that underweights cybersecurity is incomplete by design. This is especially true for connected vehicles, where software, connectivity, and supplier trust all shape operational risk. Practitioners should treat cyber evidence as a core component of certification, not a parallel workstream.
A question worth separating out:
Q: When should regulators require supplier provenance evidence for connected vehicles?
A: They should require it whenever third-party hardware, firmware, or software can influence automated driving functions or the integrity of updates. That is when supplier trust becomes a direct safety and security dependency, not a procurement detail.
👉 Read our full editorial: The SELF DRIVE Act returns: federal AV regulation meets cyber gaps