Why does state-by-state AV regulation create security and governance risk?

Why fragmented AV rules create compliance drift

State-by-state AV regulation turns one product into many compliance variants. That matters because the vehicle, the software release, the safety case, and the supplier evidence all have to line up with the jurisdiction being sold into. If the rule set changes from state to state, teams end up maintaining multiple interpretations of the same baseline, which is where drift starts.

For manufacturers and integrators, the real problem is not just added paperwork. It is that engineering, legal, compliance, and supplier teams may each optimise for a different reading of the same requirement. That creates a moving target for release approval, control mapping, and reporting, especially when a platform is updated centrally but certified locally.

Fragmentation also makes governance harder to keep consistent across the vehicle lifecycle. A control can be valid at design time, but then be interpreted differently during deployment, over-the-air change control, incident reporting, or supplier oversight. Once the baseline varies by state, proving that one control set still applies everywhere becomes a recurring governance task rather than a one-time assurance decision.

Where inconsistent controls and evidence gaps appear

When compliance obligations are not harmonised, organisations often duplicate the same control in slightly different ways to satisfy multiple jurisdictions. That can weaken security because duplicated evidence does not always mean duplicated assurance. The same test, review, or sign-off may be repackaged for different filings without proving that the underlying control actually behaves consistently in production.

It also increases the chance of gaps between deployment, reporting, and supplier management. If one state requires a different approval path, the operational record may no longer match the engineering record, and supplier attestations may lag behind the version that is actually on the road. In practice, that is how control coverage becomes uneven even when the organisation believes it has met every rule.

Fragmented regimes reward procedural compliance over coherent risk management. Teams spend time translating one safety or security posture into several regulator-specific artifacts, which can hide whether the underlying control objective is truly met. The more the organisation relies on manual reconciliation, the more likely it is that exceptions, waivers, and state-specific interpretations accumulate unnoticed.

Why a baseline only helps when it reduces ambiguity

A national or common baseline can improve security and governance, but only if it is specific enough to collapse rather than multiply interpretation. If the baseline is vague, each state still ends up applying its own judgment, and the organisation simply gains one more layer of mapping work. The useful baseline is the one that makes release criteria, evidence expectations, and supplier responsibilities materially clearer.

For that reason, the best governance outcome is not just fewer rules, but fewer ambiguous rules. Clear control definitions, stable reporting thresholds, and consistent responsibility boundaries reduce the chance that a vehicle programme passes one review while failing another for the same underlying condition. In other words, harmonisation helps only when it narrows the space for local reinterpretation.

Risk and Threat Considerations

Fragmented regulation creates assurance risk because a manufacturer can appear compliant in aggregate while still carrying state-specific gaps in evidence, reporting, or control enforcement. It also creates an attack surface for process failures, where inconsistent interpretation lets unsafe or poorly governed changes slip through one approval path but not another.

Failure mechanism: Different compliance interpretations produce mismatched records between engineering, deployment, and supplier assurance, so the organisation cannot reliably prove that the same control objective was met everywhere it was required.

Impact: The result can be delayed remediation, inconsistent safety posture, regulatory challenge, and weaker accountability when an incident forces the company to reconstruct which rule set governed a specific vehicle, release, or supplier component.

Practitioner Guidance

What to prioritise: Treat the state-by-state matrix as a governance control problem, not just a legal tracking exercise. The first question is whether your release, evidence, and supplier records all map to one authoritative control interpretation, or whether each state has become its own compliance workflow.

What to verify: Confirm that the same vehicle platform, software build, and supplier evidence set can be traced end-to-end without manual retranslation. If the answer depends on tribal knowledge or ad hoc exceptions, the compliance model is already too fragile to scale.

Common mistake: Teams often assume that more documentation equals more assurance. In fragmented regimes, extra documents can mask inconsistency unless they are tied to a single, stable baseline with explicit ownership for interpretation, change approval, and reporting.

Practitioner takeaway: The governance goal is not simply to satisfy more jurisdictions, but to make the control model portable, testable, and auditable enough that local variation does not change the security outcome.

Related resources from NHI Mgmt Group

• Why do non-human identities create more audit risk than human accounts?
• Why do non-human identities create audit risk in modern environments?
• Why do non-human identities create compliance risk even when policies exist?
• Why do collaboration tools create such a large secrets risk?