Checklist · Technology

Deploying an Automated System and Investigating an Automated-Vehicle Crash: A Practical Checklist

49 U.S.C. § 30115

Type
Checklist
Jurisdiction
National
Date
2024-08-27
Topic
Technology

A step-by-step checklist for two tasks. Parts I through IV cover deploying an automated system: authorization, the safety case, operations, and data governance. Part V is the first seventy-two hours after a crash. Part VI covers discovery and experts. Part VII evaluates liability theories and defenses. Part VIII covers manufacturer defect and recall obligations. Part IX covers drones, delivery robots, and industrial robotics. Part X is the document assembly list.

Deploying an Automated System and Investigating an Automated-Vehicle Crash: A Practical Checklist

Technology > Autonomous Vehicles and Robotics | Published 27 August 2024 - Updated 6 August 2026 | UpLaw - uplaw.us

⚠️ If a crash has occurred, go directly to Part V. Perception, planning, and driver-monitoring logs are not retained indefinitely, and a generic "preserve the black box" letter will be answered narrowly.

PART I — AUTHORIZATION AND SCOPE

☐ Determine the level of automation the system actually implements, and document the basis. ☐ Define the operational design domain in writing — geography, road type, weather, lighting, speed range, and time of day. ☐ Map the domain to legal boundaries, state by state and locality by locality. ⚠️ A domain that crosses a state line into an unauthorized jurisdiction is a compliance failure, not an engineering one. ☐ Confirm state authorization for testing and for deployment separately; they are frequently distinct. ☐ Confirm whether a human safety operator is required. ☐ Confirm whether local regulation is preempted, and identify what local authority survives — curb use, staging, and pickup zones. ☐ Confirm vehicle registration, titling, and inspection requirements for the configuration. ☐ File any required safety plan, evidence of financial responsibility, and registration. ☐ Confirm federal compliance — certification under 49 U.S.C. § 30115 against standards at 49 C.F.R. Part 571, and prohibitions at 49 U.S.C. § 30112. ☐ If the configuration cannot meet a standard, evaluate exemption under 49 U.S.C. § 30113 and 49 C.F.R. Part 555. ⚠️ Numerically capped and time-limited — plan the timeline accordingly. ☐ Confirm importation compliance where applicable — 49 C.F.R. Part 591. ☐ For commercial operation, confirm 49 U.S.C. § 31136 requirements and testing obligations at 49 C.F.R. Part 382. ☐ Confirm event data recorder compliance — 49 C.F.R. Part 563. ☐ Consider participating in rulemaking, and note the petition right at 49 U.S.C. § 30162.

PART II — THE SAFETY CASE

☐ Document the hazard analysis — identified hazards, severity, exposure, and controls. ☐ Document the validation methodology — simulation, closed course, and on-road, with coverage rationale. ☐ Document residual risk and why it is acceptable. ☐ Document the fallback behavior and the minimal risk condition. ☐ Document domain exit detection — how the system knows it has left its domain. ☐ Document driver monitoring where a human fallback exists, including what it measures and how it escalates. ☐ For Level 3, document the takeover request timing and the human factors basis for it. ⚠️ This will be the litigated question. ☐ Document perception performance across conditions, including pedestrian appearance, mobility devices, and low light. Performance variation is a safety issue before it is a fairness issue. ☐ Document the update governance process — how safety-relevant fixes are identified, prioritized, validated, and deployed. ☐ Document cybersecurity as a safety function, not as a separate track. ☐ ⚠️ Assume every item above will be produced in litigation. Write it accordingly — accurately, without overclaiming.

PART III — OPERATIONS

☐ Publish and train a law enforcement and emergency responder interaction protocol, and brief local agencies before launch. ☐ Build crash reporting into dispatch operations, with each state's deadline hard-coded. ⚠️ Deployment statute deadlines are sometimes shorter than the general accident reporting statute. ☐ Establish an incident classification process distinguishing a reportable crash, a near miss, and a disengagement. ☐ Establish remote assistance protocols, including what an operator may and may not do. ☐ Establish maintenance and calibration schedules, with records at the vehicle level. ☐ ⚠️ Establish post-repair calibration verification. A replaced windshield with an uncalibrated camera is a real and recurring failure mode. ☐ Establish a domain change control process — expanding the domain is a safety decision requiring the same rigor as the original validation. ☐ Establish an update deployment process, including staged rollout and rollback capability. ☐ Review marketing against actual capability before every campaign. ⚠️ The name of the feature is a liability decision. ☐ Train customer-facing staff on what the system does and does not do, and audit what they actually say. ☐ Verify insurance responds to the deployment model at mandated minimums and above. See Insurance Coverage Disputes.

PART IV — DATA GOVERNANCE

☐ Inventory every data type generated — event data recorder, perception, planning, control, sensor recordings, driver monitoring, localization, and remote assistance. ☐ Set retention periods deliberately and document the rationale. ☐ ⚠️ Build an automatic litigation hold trigger on any reportable incident, suspending deletion across every system including vendors. ☐ Identify third-party holders — mapping vendors, perception suppliers, and cloud providers — and confirm contractual preservation obligations. ☐ Ensure logs are interpretable — data produced without documentation is data withheld, and a court will see it that way. ☐ Classify personal data — location history, cabin video, and occupant information are personal data under state privacy statutes. See Data Privacy and Security. ☐ Establish a law enforcement access policy and publish it. ☐ Treat a security incident as both a safety event and a breach, with two notification tracks. See Cybersecurity Incidents and Breach Response. ☐ Maintain fleet-wide incident aggregation, which is both a safety tool and a discovery target. ☐ Maintain early warning reporting — 49 C.F.R. Part 579.

PART V — THE FIRST SEVENTY-TWO HOURS AFTER A CRASH

☐ Send a preservation letter within days, not weeks. ☐ Name the specific log types, not "the black box": ☐ Event data recorder output — 49 C.F.R. Part 563 ☐ Perception logs — detections, classifications, and track history, frame by frame ☐ Planning and control logs — trajectory selected, alternatives evaluated, commands issued ☐ Sensor recordings — camera, radar, lidar, all modalities and angles ☐ Disengagement and takeover records, with timestamps ☐ Driver monitoring data — gaze, hands, and full alert history for the trip ☐ Software version history, including any update before or after the event ☐ Map and localization data ☐ Remote assistance communications and operator logs ☐ Maintenance and calibration records for the vehicle ☐ Simulation and validation records for this scenario ☐ Fleet-wide incident data for the same failure mode ☐ Direct the letter to the manufacturer, the fleet operator, the remote assistance center, and every third-party vendor. ☐ Request native format with interpretation documentation. ☐ Preserve the vehicle itself before repair, and photograph sensor locations, damage, and operator branding. ☐ Obtain the police report and any crash report filed under the state deployment statute. ☐ Determine the level and whether the system was engaged at the time. ☐ Determine whether the vehicle was inside its operational design domain. ☐ Identify every potential defendant — manufacturer, software developer, sensor and map vendors, fleet operator, remote supervisor, maintenance provider, and any human occupant. ☐ Identify witnesses and any third-party video — traffic cameras, business cameras, and other vehicles' recordings, which have their own short retention. ☐ Check recall history and early warning reports for the platform. ☐ Check state incident reports for similar events, which are public in some states. ☐ ⚠️ Do not assume the human occupant was at fault, and do not assume they were not. The data will say. ☐ See Handling a Motor Vehicle Collision Claim From Scene to Settlement and Preserving Evidence and Pursuing a Product Liability Claim.

PART VI — DISCOVERY AND EXPERTS

☐ Negotiate a protective order early, anticipating trade secret claims over the perception and planning stack. ☐ Establish a source code review protocol, borrowing from patent practice — secure room, logged access, and printout limits. ☐ Request fleet-wide data on the same failure mode. ⚠️ The highest-value and most-resisted request. ☐ Request the safety case documentation — hazard analysis, validation methodology, and residual risk acceptance. ☐ Request domain definition documents and any change history. ☐ Request simulation records for the scenario, and the right to re-run it. ☐ Address whether training data is discoverable. It is arguably the design; it is also proprietary and enormous. Unresolved — brief it early. ☐ Request marketing and training materials where a Level 2 misrepresentation theory exists. ☐ Request early warning reports — 49 C.F.R. Part 579 — and defect determinations under 49 U.S.C. § 30118. ☐ Request records produced to regulators, including under 49 U.S.C. § 30166. ☐ Challenge privilege claims over internal safety analyses, which are frequently overbroad. ☐ Insist on interpretation documentation for every produced log.

Experts to retain

☐ Perception and sensor specialist — detection, classification, and sensor performance ☐ Control systems or software safety engineer — planning behavior and fallback logic ☐ Human factors expert — essential in Level 2 and Level 3 handoff cases ☐ Accident reconstructionist — still necessary, now working from far better data ☐ Regulatory expert on the vehicle safety framework, where compliance is contested ☐ Economist or damages expert as in any injury case ☐ ⚠️ Prepare for a reliability challenge to methodology. Many of these cases will be decided at that stage. See Expert Witnesses and Scientific Evidence, Challenging an Expert Under Daubert and Rule 702, and The Witness Who Decides the Case.

PART VII — THEORIES AND DEFENSES

Plaintiff theories to evaluate

☐ Design defect — perception, planning, or fallback behavior ☐ Operational design domain too broad, or domain exit undetected. ⚠️ Powerful and underused: this is a design case that does not require redesigning the algorithm. ☐ Manufacturing defect — a component failure ☐ Failure to warn — limits, domain, and the human's obligations ☐ Marketing and misrepresentation — 15 U.S.C. § 45, 15 U.S.C. § 52, and state consumer statutes ☐ Negligent operation of the fleet, dispatcher, or remote supervisor ☐ Negligent maintenance or calibration ☐ Negligent entrustment where operation outside the domain was permitted ☐ Post-sale duty to warn or update — genuinely novel and worth pleading ☐ Failure to recall — 49 U.S.C. § 30118, 49 U.S.C. § 30120 ☐ Consumer product theories for non-vehicle robotics — 15 U.S.C. § 2051, 15 U.S.C. § 2064, 15 U.S.C. § 2072 ☐ See Product Liability

Defenses to anticipate

☐ Comparative fault of the human occupant — substantial at Level 2 ☐ Comparative fault of other road users ☐ Misuse — operating outside the domain, defeating driver monitoring, aftermarket modification ☐ Failure to install an available update ☐ Preemption — analyze under 49 U.S.C. § 30103, Geier v. American Honda Motor Co., and Williamson v. Mazda Motor of America, Inc.; note that the absence of an applicable standard does not preempt — Freightliner Corp. v. Myrick, Sprietsma v. Mercury Marine ☐ State of the art ☐ Unavoidability — a real defense when the data supports it ☐ ⚠️ Do not expect the medical device preemption analogy to hold — Riegel v. Medtronic, Inc. and Medtronic, Inc. v. Lohr turn on premarket approval, and vehicles are self-certified.

PART VIII — MANUFACTURER DEFECT AND RECALL OBLIGATIONS

☐ Establish a defect evaluation process with defined triggers — field reports, fleet incident patterns, and internal testing findings. ☐ Evaluate against 49 U.S.C. § 30118 whether a defect related to motor vehicle safety exists. ☐ Report within the statutory period — 49 C.F.R. Part 573. ☐ Follow notification procedures — 49 U.S.C. § 30119. ☐ Provide the remedy — 49 U.S.C. § 30120, which may now be a software update. ☐ Address pre-sale defects — 49 U.S.C. § 30116. ☐ Maintain early warning reporting — 49 C.F.R. Part 579. ☐ Document the decision either way. ⚠️ A documented decision not to recall, with reasoning, is defensible. An undocumented one is not. ☐ Note penalty exposure — 49 U.S.C. § 30165, and criminal exposure at 49 U.S.C. § 30170. ☐ Track over-the-air remedies as recalls where they address a safety defect; the delivery method does not change the obligation. ☐ Coordinate the recall communication with marketing, so the two do not contradict each other. ☐ See Managing a Product Recall and The Product Liability Claim Toolkit.

PART IX — NON-ROAD SYSTEMS

Drones

☐ Confirm remote pilot certification and operating limits — 14 C.F.R. Part 107. ☐ Obtain waivers for operations outside the standard rules. ☐ Confirm remote identification compliance. ☐ Recognize federal preemption over flight — 49 U.S.C. § 40103 — while state and local authority persists over landowner privacy, trespass, and takeoff and landing sites. ☐ Address privacy claims through intrusion and state statutes, not aviation law. ☐ See Commercial Drone Operations Under Part 107, How Drones Are Regulated in the United States, and The Aviation and Drone Law Toolkit.

Personal delivery devices

☐ Confirm state statute and local ordinance authorization — local authority is frequently preserved here. ☐ Confirm speed, weight, supervision, and insurance conditions. ☐ ⚠️ Address accessibility — a device blocking a curb ramp is an access barrier and is increasingly regulated. ☐ Address sidewalk camera data collection under state privacy law. ☐ Identify the operator as the primary defendant in a claim.

Industrial and collaborative robotics

☐ Identify the integrator, who frequently selected the operating mode and configured safety functions. ⚠️ Often the correct defendant. ☐ Obtain the risk assessment documentation — the central discovery target. ☐ Obtain the machine configuration and any changes to force limits or sensing zones. ☐ Obtain training records and task instructions. ☐ Evaluate guarding, force limits, presence sensing, and warnings as separate theories. ☐ Check consensus standards for collaborative operation as the benchmark. ☐ Remember workers' compensation exclusivity against the employer.

PART X — DOCUMENTS TO ASSEMBLE

Deployment file

☐ Operational design domain definition and change history ☐ State authorizations, registrations, and safety plan filings ☐ Federal certification records and any exemption grant ☐ Safety case: hazard analysis, validation methodology, residual risk ☐ Update governance procedure and deployment records ☐ Law enforcement interaction protocol and training records ☐ Crash reporting procedure with jurisdiction-specific deadlines ☐ Data retention schedule and litigation hold procedure ☐ Insurance policies and evidence of financial responsibility ☐ Marketing materials, with approval records

Crash file

☐ Preservation letter and proof of delivery to every recipient ☐ Police report and state deployment statute crash report ☐ Every log type listed in Part V, in native format with documentation ☐ Photographs of the vehicle, sensors, damage, and scene ☐ Vehicle maintenance and calibration history ☐ Software version at the time and update history ☐ Recall history and early warning reports for the platform ☐ Similar-incident reports from state databases ☐ Third-party video with its own preservation record ☐ Witness statements ☐ Expert reports and the underlying data each relied on

Quick reference

☐ Crash occurred → preservation letter in days, naming the specific logs ☐ Level 2 case → driver monitoring data and marketing materials ☐ Level 4 case → perception and planning logs, plus the domain definition ☐ Domain too broad → a design case that does not require redesigning the algorithm ☐ Industrial robot → find the integrator ☐ Deploying → state authorization first, then the safety case, then operations ☐ Defect identified → document the decision either way

PART XI — COMMON MISTAKES

☐ Sending a generic "preserve the black box" letter. ⚠️ It will be answered narrowly and truthfully, and the perception logs will age out. ☐ Waiting for a lawsuit before preserving. Retention periods run from the event, not from the complaint. ☐ Assuming the feature name describes the capability. Read the manual and the software version. ☐ Treating a Level 2 case as a pure design case. The manufacturer's answer is that the human was the driver, and the strongest theories are warning and misrepresentation. ☐ Overlooking driver monitoring data, which frequently decides Level 2 and Level 3 cases in either direction. ☐ Failing to request interpretation documentation, and receiving logs nobody can read. ☐ Skipping the operational design domain analysis. ⚠️ It is frequently the strongest theory and the easiest to prove. ☐ Retaining only a reconstructionist, when the case turns on perception performance. ☐ Assuming federal compliance bars the claim. 49 U.S.C. § 30103 preserves common law liability. ☐ Assuming the medical device preemption cases control. They do not — self-certification is a different regime. ☐ Ignoring third-party video, which has the shortest retention of anything in the case. ☐ On the deployment side, expanding the domain without the validation rigor of the original. ☐ On the deployment side, letting marketing outrun the safety case. The two documents will be read side by side. ☐ On the deployment side, assuming a standard insurance form responds. It probably does not. ☐ In industrial robotics, suing only the manufacturer when the integrator configured the safety functions.

PART XII — TIMELINE REFERENCE

Item Timing Consequence of missing it
Preservation letter ⚠️ Days Perception and third-party video age out permanently
State deployment crash report Statute-specified, sometimes 24–72 hours Regulatory violation and enforcement exposure
General accident report State-specified Separate obligation from the deployment report
Vehicle preservation before repair Immediate Physical evidence and calibration state destroyed
Third-party video request Days Shortest retention in the case
Defect report to the regulator 49 C.F.R. Part 573 period from determination Civil penalties under 49 U.S.C. § 30165
Early warning report Quarterly cycle 49 C.F.R. Part 579 violation
Exemption petition Months of lead time Deployment delayed; cap may be exhausted
Insurance notice Per policy Coverage prejudice
Statute of limitations State-specified Claim barred

Related Documents