US regulators are examining five crashes involving vehicles using Comma.ai’s openpilot technology, including incidents with three fatalities. The unusual question is who counts as the manufacturer when aftermarket driving software can be modified and redistributed by anyone.
The NHTSA investigation into Comma.ai raises a harder regulatory question than another dispute over whether a Level 2 system performed as advertised.
The agency’s Office of Defects Investigation opened preliminary evaluation PE26007 on September 21 after identifying five crashes in which vehicles using Comma.ai technology met slow or stopped traffic in the same lane. Preliminary information cited by NHTSA links the incidents to three deaths and 11 injuries. The investigation covers the comma three, 3X and four devices, openpilot itself and its forks.
NHTSA is examining whether the system adequately detects and responds to those obstacles. It is also looking at modified or forked versions of openpilot, and at which software components those versions share with Comma.ai’s own release. At least two of the five crashes involved forks, including a fatal crash on a vehicle running the popular FrogPilot fork.
That second question matters commercially.
Who is the manufacturer of a fork?
NHTSA’s power to force a recall applies to the “manufacturer” of a motor vehicle or of motor-vehicle equipment. For an OEM driver-assistance system, the answer is simple. The automaker builds the car, approves the software release and pushes updates over the air, so a defect has an obvious owner.
Open-source aftermarket autonomy breaks that chain. The automaker supplies the car and its sensors. Comma.ai sells the hardware device and publishes openpilot. Third parties can take the code, change how it drives or how it monitors the driver, and distribute the result to thousands of users, often for free. The driver is responsible for supervising the vehicle throughout.
If a crash involves a fork, the regulator has three candidates for responsibility. The fork’s author may be an anonymous volunteer who sells nothing and has no ability to run a recall. The driver chose to install modified software. Comma.ai made the hardware and the code the fork was built on.
Our view is that NHTSA will treat Comma.ai as the manufacturer of the equipment as sold, meaning its device and its official software, and will hold it responsible for what that device can be made to run. The agency cannot practically police anonymous fork authors. It can require the company selling the hardware to control what runs on it. Every open-source autonomy developer should expect the same logic: whoever sells the box owns the provenance problem.
The precedents point to pressure, not a ban
Comma has faced NHTSA before. On October 27, 2016 the agency sent a special order demanding safety information about the planned Comma One aftermarket kit. The company cancelled the product the next day rather than answer, and released openpilot as open-source software on November 30. That episode showed NHTSA can stop an aftermarket autonomy product through information demands alone, before any formal defect finding.
Tesla’s Autopilot investigation shows the path of a full defect case. NHTSA opened a preliminary evaluation in August 2021 into crashes with stationary emergency vehicles, upgraded it to an engineering analysis in June 2022 and reached a recall covering about 2.03 million vehicles in December 2023. The recall was carried out through an over-the-air software update that strengthened driver-monitoring alerts. From opening to recall took a little more than two years.
Together these suggest the likely path for Comma. NHTSA will probably upgrade PE26007 to an engineering analysis within about a year, since three deaths and a common crash pattern make it hard to close quickly. It is more likely to end in a remedy delivered as software, with stronger obstacle response and stricter driver monitoring, than in a ban on the product. The difference from Tesla is that Comma’s remedy will also have to reach, or block, the forks.
What provenance controls would look like
The investigation points towards controls that aftermarket autonomy may increasingly need: cryptographically signed software builds, tamper-evident logs, documented fork lineage and clear limits on changes to driver monitoring.
In practice, the most likely step is for Comma to require signed software before its hardware can control steering and braking, with forks either certified by Comma or limited to non-driving features. That would let the company run a recall that actually reaches every vehicle, and let investigators know which code was driving when a crash occurred. It would also give NHTSA what it lacked in 2016: one company able to answer an information order for every version of the software on the road.
Comma.ai says its installed base covers more than 30,000 vehicles and over 400 million miles, with the $999 comma four supporting hundreds of vehicle models. The product is marketed as “hands-off, eyes-on”, with camera-based driver monitoring and the expectation that the driver can intervene. At that scale, one fork can spread a change in driving behaviour across thousands of cars without any type-approval process, and a regulator cannot tell a code defect from a user modification without a provenance record.
The trade-off
Provenance controls would reduce some of the freedom that makes open-source autonomy attractive. Hobbyist developers who tune openpilot’s driving behaviour would lose the ability to run their changes on the road without the company’s approval. Some users would leave, and the fork community that has driven much of openpilot’s vehicle support would shrink.
In return, the accident record would become interpretable, and the business would have a defensible regulatory position. Comma’s best commercial response is to adopt signed builds and fork certification before NHTSA requires them. Doing so would help set the standard for the whole aftermarket, rather than having one imposed through a recall order.