September 4, 2026. Tesla launched paid Cybercab rides in Austin, Texas. Hours later, the National Highway Traffic Safety Administration opened Audit AQ25002. The question is not whether the Cybercab is safe. The question is whether Tesla certified a vehicle with no steering wheel as compliant with standards that require a steering wheel, and called the missing parts 'inapplicable.' [[1]]
This is not a bug in the vehicle. It is a vulnerability in the regulatory framework itself. And I have seen this pattern before — in smart contracts, in DAO governance, and now in automotive safety certification.
The Context: Two Paths to the Same Road
The Cybercab is a purpose-built autonomous vehicle. Two seats. No steering wheel. No pedals. No side mirrors. It received an EPA Certificate of Conformity in May 2026, confirming its status as a zero-emission vehicle with a city driving range of 418 miles. [[21]] Production began at Giga Texas in early 2026. Engineering tests on public roads in Austin followed by June. [[1]] On September 3, Tesla registered 45 Cybercabs through the Texas Motor Carrier Credentialing System — bringing its total Texas autonomous fleet to 315 vehicles, compared to Waymo's 736. [[22]]
Texas Senate Bill 2807, effective May 28, 2026, established the state's commercial autonomous vehicle framework. Tesla self-certified its software as SAE Level 4 and registered its vehicles the same day the law took effect. [[22]] The state asked no further questions.
But federal law is a different system entirely.
The Federal Motor Vehicle Safety Standards (FMVSS) require manual controls. Brake pedals. Steering columns. Rearview mirrors. These are not optional features — they are the structural assumptions upon which the entire regulatory architecture was built. Automakers in the United States do not receive pre-approval from NHTSA for new vehicles. They self-certify compliance, then put vehicles on the road. The regulator audits afterward. [[6]]
Tesla told NHTSA it certified the Cybercab as compliant with all applicable FMVSS. The crucial word is 'applicable.' Tesla determined that certain standards simply do not apply to a vehicle that has no driver station. [[4]] No steering column? The steering column protection standard is irrelevant. No brake pedal? The pedal force requirement does not apply.
NHTSA Administrator Jonathan Morrison stated: 'We need to ensure that all of our laws are followed.' [[3]]
Compare this to Zoox. Zoox, also building a purpose-built autonomous vehicle without manual controls, went through the official exemption process. It filed for a temporary Part 555 exemption from eight FMVSS standards. It received final approval in July 2026 — a full two months before Tesla launched its competing service. [[2]] Under that exemption, Zoox can add 2,500 vehicles per year to its commercial fleet for two years. [[8]]
Tesla chose a different path. No exemption petition. No volume cap. No duration limit. Just a self-certification sticker and a legal argument that the regulations do not apply.
The Core: A Systematic Teardown of the Self-Certification Argument
I have spent years auditing systems where the operator claims certain rules do not apply. In blockchain, it is the same pattern: a project declares its token is not a security, its DAO is not a legal entity, its smart contract is not subject to traditional financial regulation. The argument is always technically creative. It is almost always fragile under adversarial scrutiny.
Tesla's self-certification rests on three pillars. Each one is weaker than it appears.
Pillar One: The Inapplicability Determination
Tesla argues that FMVSS standards written for human-driven vehicles are structurally inapplicable to a vehicle with no human driver position. This has surface-level logic. If there is no steering wheel, a standard requiring steering column collapse protection is physically impossible to satisfy. But the same reasoning could be applied to nearly every safety standard on the books. Airbag deployment zones assume a driver in a specific seat. Crash test protocols assume specific occupant positions. Visibility standards assume a human looking through a windshield.
The precedent this sets is profound. If a manufacturer can unilaterally declare standards inapplicable, the entire self-certification framework becomes a self-licensing mechanism. NHTSA's investigation will examine 'the extent to which Tesla's certification depended on determinations that certain FMVSS are inapplicable to the Cybercab.' [[6]] That is the core question. At what point does creative interpretation become regulatory avoidance?
Pillar Two: The Absence of Exemption Limits
The Part 555 exemption process imposes a 2,500-vehicle annual production cap. Congress is debating the SELF DRIVE Act, which would raise this cap to 90,000 units. [[25]] But Tesla's VP of Vehicle Engineering, Lars Moravy, stated that the Cybercab will not be subject to the 2,500-vehicle cap because Tesla is not seeking an exemption. [[25]] The company is certifying full compliance through the standard process.
This is the most aggressive part of the strategy. If Tesla's self-certification holds, it can scale Cybercab production to hundreds of thousands of units without any federal limitation on autonomous vehicle deployment. The entire legislative debate about exemption caps becomes irrelevant. [[25]] The SELF DRIVE Act, which has been moving through Congress for years, would be functionally preempted by Tesla's unilateral action.
Regulatory arbitrage of this scale is not innovation. It is exploitation of a gap between legislative intent and technical implementation. I have seen this exact dynamic play out in DeFi governance, where projects exploit low voter turnout to pass favorable proposals. The mechanism is different. The logic is identical.
Pillar Three: The State-Level Authorization Gap
Texas SB 2807 requires operators to attest to SAE Level 4 capability through the TxMCCS. Tesla filed its self-certification the same day the law took effect. [[22]] The state does not independently verify this attestation. It is a self-reporting system.
The Cybercab's SAE Level 4 designation has not been independently validated. Tesla's automated driving technology has been linked to dozens of accidents and fatalities over the years, as well as past NHTSA investigations. [[3]] The company began operating a self-driving ride service in Austin in June 2025, often with a human safety driver, and has yet to report any revenue from that service. [[3]]
No public information about Tesla's capabilities suggests the company is close to reliably deploying an automated driving system over the wide range of conditions required for a vehicle without conventional controls. [[30]] That assessment comes from Bryant Walker Smith, a University of South Carolina law professor focused on autonomous-driving regulation. It is not skepticism. It is an observation based on the available evidence.
The Contrarian Angle: What Tesla Got Right
The regulatory framework for autonomous vehicles is broken. FMVSS were written for a world where every vehicle has a human driver. That world is changing. The Department of Transportation recently proposed removing manual control requirements for vehicles designed to be autonomously driven. [[2]] The regulators themselves acknowledge the standards are outdated.
Tesla's argument that certain standards are inapplicable is not frivolous. If a vehicle has no steering wheel, a standard requiring steering column protection cannot be applied. The regulatory framework needs to accommodate vehicles that were never designed for human operation. Tesla is forcing this conversation by acting before the regulations catch up.
Zoox's exemption, while legally clean, is slow and capped. Zoox received its Part 555 exemption in July 2026, after years of petitioning. It can deploy 2,500 vehicles per year. Tesla launched with 45 Cybercabs in a single day and can scale without asking permission. [[8]] The regulatory system incentivizes the aggressive path. The company that waits for permission loses the market to the company that asks for forgiveness.
Philip Koopman, Carnegie Mellon engineering professor and autonomous-vehicle safety expert, noted that Tesla has historically tested limits and pushed boundaries on regulations. [[30]] This is accurate. Tesla's entire product strategy — from Autopilot to Full Self-Driving to the Cybertruck — has been defined by shipping first and defending later.
The question is whether this approach scales to a vehicle with no manual controls. A software feature that occasionally fails is a nuisance. A vehicle with no steering wheel that occasionally fails is a fatality.
The Takeaway: Accountability Has No Self-Certification
The Cybercab investigation is not about Tesla. It is about the collapse of the self-certification framework when applied to systems that are fundamentally different from everything that came before.
In blockchain security, I have watched projects self-certify their smart contracts as 'secure' only to be exploited weeks later. The pattern is always the same: the operator declares compliance, the auditor finds gaps, and the market absorbs the loss. Self-certification works when the standards are clear and the consequences of failure are contained. Neither condition holds for a 418-mile-range autonomous vehicle operating on public roads without a steering wheel. [[21]]
NHTSA Administrator Morrison stated that the agency 'fully supports the safe development and deployment of automated vehicles. But as the federal regulator, we need to ensure that all of our laws are followed.' [[3]] The tension in that statement is the entire story. The regulator wants innovation. The regulator also wants compliance. When those two goals conflict, the default answer should be safety.
The Cybercab has no steering wheel. No pedals. No mirrors. And no federal exemption. Tesla certified it anyway.
Trust is the vulnerability they never patched.
Silence in the logs speaks louder than the code.
Precision kills the illusion of complexity.
The Cybercab's self-certification is a clever legal argument. It is not a safety guarantee. The NHTSA investigation will determine whether the argument holds. But the deeper question is whether the regulatory framework can survive a manufacturer that treats compliance as a negotiation rather than a requirement.
Based on my experience auditing systems where the operator claims the rules do not apply, the answer is usually no. The system breaks. The question is only whether it breaks before or after the first preventable accident.
Tesla is betting on after. The regulators are betting on before. The 45 Cybercabs on Austin roads are the collateral.
