From testing to traffic: Legal frameworks shaping the future of autonomous mobility

March 3, 2026

Sinje Maier, Counsel, CMS Germany

Phillip Bubinger, M.C.B.L. (Mannheim/Adelaide), Counsel, CMS Germany

Autonomous mobility is shifting rapidly from testing to real road traffic. Cars and trucks and their systems no longer simply assist drivers. They take over steering, braking, navigating, and even make split-second decisions. As vehicles become more autonomous, the legal system must also evolve. Questions of safety, liability, cyber-security, data protection and procedural questions regarding the burden of proof suddenly become more complex with one question always in focus: Who is liable in case of an accident involving an automated driving system?

The European Union constantly updates and adapts its legal framework for autonomous mobility. This article explains the key rules and shows how law, technology, and real-world mobility are intertwined.

Five levels of automation – and why they matter legally

To understand the legal framework that regulates autonomous driving in Europe, one must start with the five levels or categories of driving automation.

The five levels have been developed by the Society of Automotive Engineers International (SAE International), a non-profit organization for technology and science dedicated to advancing mobility and technology. One of its missions is to develop standards that can be used in the automotive industry. The five levels of driving automation are based on the functionality of the driving automation system feature:

In “Level or Category 1 – Driver Assistance”, the driving automation system assists with either steering (lateral motion) or acceleration/braking (longitudinal motion) while the driver performs the rest of the driving task.

In “Level or Category 2 – Partial Driving Automation”, the system can control both steering and acceleration/braking simultaneously, but the driver must continuously monitor the environment. 

In “Level or Category 3 – Conditional Driving Automation”, the system handles all driving tasks in specific conditions (i.e. on the highway with clear line markings), but the driver must be ready to take over the driving on the system’s request at any time.

In “Level or Category 4 – High Driving Automation”, the system can perform all driving tasks in specific conditions without human intervention. An intervention of the driver is not even expected in this category, and he or she becomes a passenger.

In “Level or Category 5 – Full Driving Automation”, the system can perform all driving tasks anywhere and anytime, without human intervention.

Typical driver assistance systems currently available on the market are classified as Level 1 and Level 2, with the first vehicles now reaching Level 3 automation. These include, for example, lane-keeping assistance, lane-departure warning systems, adaptive cruise control (ACC), automatic emergency braking, traffic jam assistants, parking assistance systems, and traffic sign recognition. While these features support the driver in steering or speed control, they do not replace the driver’s continuous responsibility for monitoring the environment and performing the overall driving task. As long as such systems merely assist rather than replace the driver, liability remains closely tied to the human being “in charge”.

However, as automation progresses beyond these assistance functions into Level 3 and above, the human’s role begins to fade, and the system increasingly assumes the driving task on its own. This shift of control triggers new and complex questions of liability in case of accidents, as well as issues of product liability and software safety.

The legal framework for autonomous mobility

The regulatory framework for automated driving in Europe is governed by a multilayered system of rules developed by both the European Union and the United Nations. At the foundation lies a legal framework defining the requirements applicable to vehicles and their systems.

The United Nations has established a working group to develop vehicle regulations covering areas such as vehicle safety, cybersecurity, software updates, and automated driving functions. These regulations are intended to serve as international technical standards for the automotive industry. The legal basis for these regulations is the UN 1958 Agreement, an international treaty that sets up a system for developing uniform technical vehicle regulations and for the mutual recognition of type approvals. This agreement was introduced by the United Nations Economic Commission for Europe (UNECE), and the European Union became a contracting party in March 1958.

Building on these international standards, the EU has implemented several key regulations. The most important are Regulation (EU) 2018/858,¹ which governs type-approval and market surveillance of motor vehicles and their parts, and Regulation (EU) 2019/2144,² which introduces mandatory advanced safety and driver-assistance systems (Level 1 and 2) for vehicles in the EU, including the requirement for an event data recorder (Black Box).

Beyond vehicle-specific rules, the EU has also addressed the increasing role of software and artificial intelligence in automated driving. Regulation (EU) 2024/1689³ establishes harmonized rules on artificial intelligence, classifying AI systems according to risk level and imposing stricter safety requirements as automation assumes greater control over the vehicle. Since vehicles – including their autonomous systems and software – are considered products under Directive (EU) 2024/2853 on liability for defective products, manufacturers can be held liable for damage caused by an automated driving system regardless of fault.

To further address the intersection of AI and liability, the European Commission proposed an Artificial Intelligence Liability Directive in September 2022. This directive aimed to establish uniform rules for non-contractual civil liability for damage involving AI systems, introducing a rebuttable presumption of causality between AI system failure and breaches of duty of care under EU or national law. It also sought to empower courts to order disclosure of evidence regarding high-risk AI systems, helping victims identify potential liable parties and prove claims. However, at the beginning of 2025, the European Commission withdrew the proposal, stating that an agreement on the directive could not be foreseen.

Who is liable?

In general, drivers remain liable whenever they are in control of the vehicle or fail to comply with operational rules, such as supervising the system or operating within the manufacturer-defined Operational Design Domain (ODD). Driver liability also arises if the system issues a warning to take over and the driver does not respond appropriately.

By contrast, manufacturers are liable for defects in the automated driving system, including design flaws, software errors, faulty updates, or insufficient instructions. As vehicles assume more control and the human role becomes primarily supervisory, manufacturer liability increasingly dominates, reflecting their responsibility for the safe functioning of the system. In fully autonomous vehicles, the manufacturer assumes almost full liability, as the vehicle operates independently.

Autonomous vehicles highlight the challenges of human-machine interaction and the allocation of liability, making it increasingly important to define the division of responsibility between drivers and manufacturers as automation advances.

The German legal framework for autonomous driving, for example – comprising amendments to the Road Traffic Act (StVG) and the Ordinance on Autonomous Motor Vehicles (AKF-VO) – illustrates how liability is allocated across automation levels. At SAE Level 3, the person in the driver’s seat remains the legal “driver”: they may divert attention while the automated function is active but must promptly resume control upon a takeover request or when circumstances clearly require manual intervention. Liability typically includes the vehicle owner’s no-fault liability under section 7 StVG and the driver’s potential fault-based liability under section 18 StVG (with an exculpation defence), alongside general tort principles. At SAE Level 4 (autonomous driving under German law), vehicles operate within an approved operational design domain without a human driver; instead, a “technical supervisor” is appointed to monitor operation and is legally obliged to respond to system notifications and take appropriate action, including initiating a minimal-risk condition or deactivating the vehicle when required by system warnings or detected irregularities.

At the EU level, the recast Directive on Liability for Defective Products (Directive (EU) 2024/2853)⁴ provides the primary legal basis for manufacturer liability, imposing no-fault liability where a defect causes damage. The Directive introduces tools such as rebuttable presumptions and evidence disclosure duties to facilitate proof of defect and causation and the allocation of responsibility. Importantly, it now expressly treats software as a “product”, with the consequence that autonomous driving systems, regardless of their SAE level, are explicitly covered. The redefinition of the term “defect” in the new Product Liability Directive is likely to be particularly significant for autonomous driving. Under the revised definition, a product may be defective even after it has been placed on the market or put into service by the end user, if the manufacturer retains control over the product—for example, via software updates or upgrades. 

Summary

Autonomous vehicles promise safer mobility. The journey to fully autonomous mobility is not only technological – it is also legal. To move from testing to real traffic, a clear legal framework is essential – one that sets high standards to ensure safety, strengthens trust in both the technology and the law and supports progress without holding it back.

And Europe is working on exactly that: Strong rules on AI safety, product liability that includes software, new mechanisms to ensure victims can prove their claim, and cyber security and data protection obligations. Their requirements are closely linked to the level of the automated driving system, ensuring higher safety standards for higher levels of autonomy.

1. https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32018R0858 ↩︎
2. https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32019R2144 ↩︎
3. https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=OJ:L_202401689 ↩︎
4. https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=OJ:L_202402853 ↩︎

Phillip Bubinger is a Counsel in the Commercial Practice group in the Cologne Office of CMS Hasche Sigle. Phillip advises companies on all legal issues relating to their operational business, including production, procurement and distribution. He has a special expertise in the automotive (OEMs, Tier 1 and Tier 2 suppliers) and Industry 4.0 sectors, advising suppliers and customers of automation solutions in the industry and logistics. Further, Phillip assists his clients both in the contractual implementation of projects and, in case of conflict, in the out-of-court and in-court settlement of disputes.

T: +49 221 7716 133

E: phillip.bubinger@cms-hs.com

Sinje Maier is a Counsel in the Commercial Practice group in the Frankfurt Office of CMS Hasche Sigle. Sinje advises mainly medium-sized companies in the mechanical engineering and plant construction sector and in the supply and trade industry branch on all aspects of civil and commercial law, with a focus on operational issues in purchasing and procurement, production and distribution in addition to reviewing and drafting corresponding contracts. Sinje is an expert in product compliance, with particular knowledge of product liability and product safety law. She advises clients on identifying and complying with German and European requirements for launching products in the European market. She also advises and represents companies in asserting and defending warranty and product liability claims, and in product recalls and notifications to the relevant authorities. Her practice covers litigation before state courts and arbitration.

T: +49 69 71701 125

E: sinje.maier@cms-hs.com