When a car drives itself and crashes, who is to blame? For a century, American law has answered that question by looking at the driver, and a vast system of insurance, claims adjusting, and litigation has been built around that answer. Automated driving puts software in the driver's seat. Does liability move with it, to the companies that build the cars and write the code?
In this TalksOnLaw interview, Joel Cohen sits down with James Anderson, director of the RAND Institute for Civil Justice and lead author of RAND's guide for policymakers on autonomous vehicle technology. They discuss how driverless cars could shift the risks of the road: what "autonomous" actually means, the theory and the practice of tort liability, the future of auto insurance, the new danger of hacking, and the roles of federal and state regulators.
Levels Zero to Five, and the Trouble with Three
Anderson starts with the taxonomy created by SAE International, formerly the Society of Automotive Engineers, which runs from Level 0 to Level 5. Level 0 can still include momentary interventions such as automatic emergency braking. Level 1 performs a single task, such as adaptive cruise control or lane keeping assist. Level 2 does both at once, but the human must pay attention at all times. Level 3, "conditional automation," lets the driver disengage but requires them to take over on short notice, and the definition does not say how short. At Level 4, the human can rely on the vehicle completely, but only within its "operational design domain." Most observers would call Tesla's system Level 2. Tesla has said it can reach Level 3 or 4 with its existing sensors, but many people are skeptical. Anderson is wary of Level 3 in particular. Research shows that humans are terrible at monitoring something that is dull nearly all the time and occasionally requires a split-second, life-or-death intervention. Before Waymo spun out of Google, he notes, even trained engineers who were specifically warned not to came to rely on the cars completely. Progress need not be sequential, he adds. Developers could skip Level 3 and go straight to Level 4.
Why Liability Should Shift, in Theory
In theory, Anderson says, liability should move away from the individual driver and toward the vehicle manufacturer or software developer. It hardly makes sense to blame a driver who is not driving. Cohen offers the analogy of a taxi passenger, who is not sued when the cab hits someone. Anderson explains that each of the three classical justifications for tort law, namely deterrence, corrective justice or civil recourse, and compensation for the injured, points the same way. Economic analysis suggests placing liability on the "cheapest cost avoider," the party best positioned to make safety improvements efficiently. Some scholars argued as far back as the late 1960s and early 1970s that manufacturers should bear more crash liability so they would design safer cars. He also cautions that assigning a cause to any crash is partly arbitrary. Cohen's hypothetical of a car running over a yard gnome shows the point. Road design, a speed limiter, thicker bumpers, or better window visibility could each have prevented it, yet the law conventionally blames a single driver.
Why It May Not, in Practice
Practical obstacles may slow the shift, Anderson warns, or prevent it altogether. After law school, he had a minor fender bender and called his insurer ready to depose witnesses and subpoena traffic-light timing. The adjuster politely offered to write him a check for the $200 in damage. That is how most crashes are resolved: administratively, actuarially, and with rough justice. When insurers disagree, they use inter-company arbitration instead of going to court. Automakers and AI companies have none of that infrastructure. They have no adjusters and rarely appear in ordinary crash claims. The existing system works well enough, Anderson argues, that it is one of the real-world reasons liability may not move to manufacturers quickly.
Splitting the Bill: Automakers, Coders, and Owners
Responsibility could be split between an automaker and a separate software developer. Policymakers could also leave it with the human. Ship captains, Anderson notes, are traditionally strictly liable for their vessels even when they do nothing wrong, and the law could treat car owners the same way. Cohen objects that a buyer cannot evaluate one company's driving AI against another's. Anderson agrees that the consumer is probably not the cheapest cost avoider. An automaker is better placed to judge software and to protect itself by contract, for example by requiring the software supplier to indemnify it. Software also creates new questions about the owner's role. If an owner blocks an emergency software update that would have prevented a crash, who is liable? Ultimately, Anderson says, the answer will come down to whether each party behaved reasonably. That will produce a lot of litigation in the short run. As the case law settles, the parties can allocate risk among themselves through indemnification.
No-Fault, Fleets, and the Price of Sensors
No-fault insurance was popular in the 1970s on the promise of fewer lawsuits and lower costs, but Anderson notes that it did not reduce costs and in many states raised them. He is skeptical that no-fault makes people drive more carelessly, since drivers still want to stay alive. His bigger concern is that a no-fault system would discard one of automation's main benefits. If premiums do not depend on at-fault crashes, buyers lose the incentive to choose safer automated cars. He also expects many automated vehicles to be operated by fleets, such as an autonomous Uber, rather than owned by individuals. That would move the risk into commercial insurance and among more sophisticated parties. Anderson does not expect automation to cut claim costs automatically. Automatic emergency braking has reduced crashes, but bumpers full of expensive sensors have raised the cost of repairs. Automated vehicles may also have to share the road with unpredictable human drivers for a long time. Automation is easiest on a closed "dedicated guideway," like the driverless train he rode at the Pittsburgh airport. Anderson recalls that Google's test cars once met a woman on a road chasing a goose in circles, a scenario a robust system must be able to handle.
Hacking and Correlated Risk
Anderson does not dismiss the risk of hacking. If a hacker could control vehicles remotely, every car might be made to turn 15 degrees to the left at once, or 4,000-pound vehicles carrying fuel or batteries could be turned into weapons. He considers this very unlikely, and many people are working to make it even less likely, but he cannot say the risk is zero. Hacking also raises a problem of insurability. Auto insurance depends on pooling uncorrelated risks: a crash in Tennessee says nothing about one in Seattle. If both are caused by the same software bug, or by the same skilled adversary or nation-state, losses become correlated. Anderson compares this to the difficulty of insuring property against terrorism after September 11.
Regulators, Courts, and the Rules of the Road
Anderson describes the federal approach as largely hands-off under administrations of both parties, because rapidly changing technology makes it hard to be confident about specific rules. In the meantime, common-law liability does some of the regulatory work. Regulation can work alongside tort law, for example when violating a rule is evidence of negligence. Congress could also preempt state tort claims or cap liability. That would bring clarity, he notes, but it would also freeze the development of state common law, so regulators "better be pretty sure" they have it right. At the state level, without a clear prohibition, testing automated vehicles is not obviously illegal. Driver's license requirements and other statutes will need updating, but many antiquated laws are simply never enforced. Will manual driving someday be banned? Anderson thinks a wholesale ban is unlikely in his lifetime, given Americans' attachment to driving. He considers it more likely that certain roads will be reserved for automated vehicles, in the same way that horses and bicycles are kept off the interstates today.
What to Know Now
Driverless cars have arrived much as Anderson anticipated: as fleets, not as cars people buy. Waymo's fully driverless robotaxis now give about half a million paid rides a week in more than ten U.S. cities, and Tesla has begun some rides in Austin with no one on board to supervise. Early insurance data are encouraging. A Swiss Re study of 25.3 million Waymo miles found 88 percent fewer property damage claims and 92 percent fewer bodily injury claims than for human drivers. His doubts about Level 3 have also held up. Mercedes-Benz's Drive Pilot, the first Level 3 system offered to U.S. consumers, was limited to highways at speeds up to 40 mph, and Mercedes paused it in early 2026, citing limited benefit to customers. Most consumer systems, including Tesla's "Full Self-Driving (Supervised)," remain Level 2.
Liability is shifting slowly and case by case, through the kind of "reasonableness" litigation he expected. In Benavides v. Tesla, a Miami federal jury found Tesla 33 percent responsible for a fatal crash in which a driver using Autopilot looked down for a dropped phone. The jury awarded about $243 million, including $200 million in punitive damages, on design defect and failure-to-warn theories. The trial judge upheld the verdict. Tesla, which maintains that the distracted driver was responsible, has appealed. California's DMV found Tesla's "Autopilot" and "Full Self-Driving" marketing misleading, and Tesla dropped "Autopilot" from its California marketing. Regulators have also made clear that candor matters. After a Cruise robotaxi dragged a pedestrian in San Francisco, California suspended Cruise's permits, and Cruise paid federal penalties for incomplete and false crash reports. GM then shut down the robotaxi business.
Washington is no longer hands-off, although its focus is on enabling deployment. NHTSA has streamlined crash reporting, expanded exemptions for vehicles without steering wheels or pedals, and proposed rewriting several safety standards that assume a human driver. Anderson's preemption trade-off is now the central question in Congress. The SELF DRIVE Act of 2026 would set a national framework and override conflicting state rules. Supporters say a single standard is overdue, and opponents warn against displacing state safety authority too soon. The bill advanced from a House subcommittee on a party-line vote but has not been enacted. In the meantime, the states keep acting. California now lets police cite AV companies for traffic violations, Texas requires a state permit for commercial driverless operation, and Florida treats the automated system as the "operator" and requires $1 million in coverage for robotaxi networks. No mass hack has occurred, but federal rules will bar Chinese- and Russian-linked vehicle software starting with the 2027 model year. Anderson's central point still holds. Theory favors placing liability on the companies that design the driving, but the shift is arriving gradually, through fleets, contracts, and the courts rather than in a single stroke.
