The EU's General Safety Regulation and Autonomous Vehicles

The European Union does not regulate autonomous vehicles through a single AV law. It regulates them, in part, through vehicle safety engineering rules that happen to have been updated to account for automated driving systems. The General Safety Regulation sets mandatory safety-technology requirements that apply across every EU member state, and its scope now explicitly reaches automated and autonomous systems rather than treating them as an edge case the rulebook forgot to mention.

The vehicle-engineering side of this doesn't originate purely within the EU either. A meaningful share of the underlying technical requirements for automated driving systems come from international vehicle regulations developed through the UN's World Forum for Harmonization of Vehicle Regulations, which EU type-approval then incorporates rather than duplicates. That's a second layer of the same upstream-versus-downstream logic: an international technical standard feeds into EU-wide type-approval, which in turn sets the engineering floor a member state's own traffic law then has to work with. Folding an international standard into EU law this way also means a change agreed at the UN level can ripple into every member state's type-approval requirement at once, without the EU needing to renegotiate its own separate technical annex from first principles each time the underlying international rule is revised.

That distinction matters more than it sounds. Type-approval harmonization at the EU level governs what the vehicle itself must be engineered to do, uniformly, regardless of which member state it's sold or operated in. It does not replace or override a member state's own traffic law, the rules governing who is allowed to operate a vehicle, where, and under what liability terms. The two systems run in parallel.

Type-approval works upstream of where a vehicle ever actually gets driven. It governs the engineering baseline a manufacturer has to clear before a vehicle can legally be sold or registered anywhere in the bloc, regardless of which country eventually buys it. Member-state traffic law works downstream of that baseline: once the vehicle exists and meets it, the separate question of who may operate it, on which roads, under whose liability regime, gets answered locally. A vehicle can clear EU type-approval and still not be legally driverless-capable on the road in a given member state until that state's own traffic law says so.

The same regulation also does double duty as a baseline for the sensing and recording technology automated systems eventually build on. It mandates that newly type-approved vehicles carry certain safety technologies as standard, event data recorders and driver-monitoring functions among them, regardless of whether that particular vehicle ever runs an automated driving system. A vehicle already required to log detailed event data and monitor the state of whoever is in the driver's seat is a vehicle whose baseline instrumentation happens to overlap heavily with what an automated system would need anyway, even though the regulation wasn't written with autonomy as its primary justification. None of that instrumentation mandate is framed as an autonomous-vehicle rule in its own right, which is rather the point: it arrives as ordinary vehicle-safety regulation and only turns out, incidentally, to double as part of the technical groundwork automated systems need.

That is precisely why a country like Germany could go on to pass its own national statute authorizing Level 4 operation in defined use cases. Germany wasn't working around EU rules or waiting for Brussels to legislate liability on its behalf. It was operating in the lane the EU framework leaves open, member-state traffic law, while the General Safety Regulation handled the vehicle-engineering lane separately. Germany's Autonomous Driving Act and the EU's safety regulation aren't competing frameworks. They're different levers entirely, and confusing them is a common source of overstated claims about what "the EU has approved" versus what an individual member state has actually authorized.