NHTSA Isn't Asking Whether the Cybercab Drives Safely. It's Asking Who Decided It Was Legal.

On 3 September 2026, Tesla began charging fares for Cybercab rides in Austin. Within hours, the National Highway Traffic Safety Administration opened Audit Query AQ26002, covering roughly 1,000 vehicles.

Most of the coverage that followed asked whether a two-seat vehicle with no steering wheel, no pedals and no mirrors is safe to carry paying passengers. That is a reasonable question and it is not the one in the file. AQ26002 is a compliance audit. It does not evaluate how the Cybercab drives. It examines the process and technical data Tesla relied on when it certified the vehicle as legal — and specifically, the extent to which that certification rested on Tesla's determination that certain federal safety standards simply do not apply.

The question is not whether the vehicle is safe. It is whether the call was Tesla's to make.

Nobody approved this car, and that is the normal process

The single most common misconception about American vehicle regulation is that a federal agency signs off on a car before it goes on sale. None does. Federal Motor Vehicle Safety Standards operate on self-certification: the manufacturer determines that its vehicle complies with every applicable standard, affixes a certification label saying so, and sells it. NHTSA's role is to audit, investigate and enforce afterwards.

This is a genuine design choice, not an oversight, and it is the opposite of the pre-market approval model used for, say, medical devices, where a product cannot lawfully reach the market until a regulator has authorised it. Self-certification trades ex-ante scrutiny for speed and volume, on the theory that a manufacturer facing recall liability, civil penalties and litigation has adequate incentive to get it right, and that a regulator cannot possibly pre-clear every model year of every vehicle sold in the United States.

So the fact that no agency blessed the Cybercab before it took its first paying passenger is not a loophole Tesla found. It is how every car on an American road got there. What makes this case different is what Tesla self-certified.

'Does not apply' is a different claim from 'complies'

A conventional certification says: this standard applies to this vehicle, and this vehicle meets it. Tesla's position on a significant set of FMVSS provisions is reported to be structurally different — that the standards do not apply at all.

The reasoning is not frivolous. Large parts of the FMVSS rulebook are drafted around equipment that presupposes a human driver. Requirements governing rearview mirror fields of view, steering-column behaviour in a frontal crash, driver-side airbag placement, or the location and illumination of driver controls are written in terms of components. Delete the component and there is nothing for the requirement to attach to. You cannot meaningfully comply with a specification for how a steering wheel absorbs energy in a collision if the vehicle has no steering wheel. On that reading, declaring the standard inapplicable is not evasion; it is the only coherent thing to say.

The regulatory anxiety is the mirror image of that argument, and it is worth stating as precisely. If a standard lapses whenever the equipment it references is removed, then a manufacturer can retire a safety requirement by retiring the part it hangs on — and an applicability determination made unilaterally starts to function as an exemption the manufacturer granted itself. The protections in those standards were written for occupants, not for steering wheels. Whether the occupant protection survives the deletion of the hardware is exactly what an audit of the certification record would need to establish.

NHTSA has said AQ26002 will consider the extent to which Tesla's certification depended on determinations of inapplicability. That is a narrow and precise scope, and it maps directly onto the tension above.

The route Tesla did not take

There is an established alternative. Under the exemption process commonly known as Part 555, a manufacturer petitions NHTSA for a temporary exemption from specified standards, makes its case on the record, and receives — or does not receive — a grant covering a defined number of vehicles. It is slow, discretionary, public, and it produces a document that says an agency agreed.

Tesla did not file one. According to reporting on the deployment, it certified the Cybercab directly under the existing standards instead.

The contrast with Zoox is the sharpest available measure of what that decision was worth, and it is a comparison the coverage has generally noted in passing without doing the arithmetic. Per reporting on its regulatory history, Amazon's Zoox unit spent roughly four years in federal process, recalled its entire 105-vehicle fleet along the way, petitioned under Part 555 for exemption from eight separate standards, and obtained commercial clearance on 30 July 2026 — about five weeks before Tesla launched.

That asymmetry is the practical argument for self-certification and against it, simultaneously. It is why the route is attractive, and it is why it is the pressure point.

What an audit query can and cannot do

An audit query is an information-gathering instrument opened by NHTSA's Office of Defects Investigation. Several things follow from that, and they cut in both directions.

• It establishes no violation. Opening an audit is not a finding, and the agency has not concluded that the Cybercab is unsafe or unlawfully deployed.
• It orders nothing. The opening documents require no recall and no suspension of service. Cybercabs are still carrying fares in Austin.
• It can close with no action at all. Many do.
• If it does not, the exposure is real. A determination that a vehicle does not comply with an applicable standard triggers notification and remedy obligations — which, for vehicles already built and in service, means a recall and a fix, on a fleet that has been carrying passengers throughout.

The last point is what makes an applicability determination a structurally riskier position than an exemption grant. A Part 555 exemption is a decision the agency made and is bound by. An inapplicability determination is a decision the manufacturer made, and it remains open to revision for as long as the agency chooses to revisit it. The speed advantage is front-loaded; the uncertainty is not.

Tesla's case, at its strongest

Set aside for a moment the question of who benefits from the reading. The serious version of Tesla's position is that Congress built self-certification deliberately, and building it deliberately means manufacturers were intended to make applicability calls — including hard ones — without asking first. A regime that required a petition every time a vehicle departed from the assumptions of a standard drafted in a previous era would be a pre-market approval regime wearing a different name, and Congress did not enact one.

There is a rulemaking argument alongside it: if the FMVSS no longer fit vehicles without human controls, the correct remedy is to update the standards, not to route every such vehicle through a discretionary exemption queue whose throughput is set by agency staffing. Zoox's four years is evidence for that proposition, not against it.

Both points are substantial. Neither resolves the audit, because the audit is not asking whether self-certification is a good system. It is asking whether this particular set of determinations was correct under the system as it stands.

What this does not establish

Nothing in AQ26002 says the Cybercab is dangerous. The audit does not assess driving performance, has produced no finding, and has ordered no remedy. Any reader taking the existence of a federal audit as evidence of a safety defect has drawn a conclusion the document does not support.

Tesla's certification record is not public, so the specific standards it treated as inapplicable, and its reasoning on each, are known here only through NHTSA's characterisation of what it intends to examine and through press reporting. The description of which FMVSS provisions presuppose driver-facing equipment is a general feature of the rulebook, offered to explain the shape of the argument — it is not a claim about which provisions Tesla actually cited.

The Zoox figures — four years, 105 vehicles, eight standards, 30 July 2026 — come from reporting on that company's regulatory history rather than from a primary agency document reviewed for this piece. The comparison is offered as a measure of process cost, not as a judgment that Zoox's route was the correct one or that Tesla's was not.

This audit was opened on 3 September 2026 and remains open. Anything in it can change.