The Regulatory Gap Between Testing Permits and Deployment Permits

A company can hold a testing permit for years, generate enormous amounts of public-road data, publish disengagement figures every reporting cycle, and never once file for the permit that would let it carry a paying passenger without a safety driver in the seat. That gap between testing authority and deployment authority is not a formality. It rarely is. It's where most AV programs spend the bulk of their public life.

Testing permits authorize exactly what the name suggests: operating on public roads to gather data, typically with a trained safety driver present and ready to take over. They do not, by themselves, authorize a commercial service carrying members of the public without that safety driver. A deployment permit, sometimes called a driverless permit depending on the jurisdiction, is the separate authorization required for that step, and it is consistently harder to get and slower to move through than the testing permit that preceded it.

California illustrates how granular this can get in practice. Its framework actually runs three tiers rather than two: a standard testing permit that requires a safety driver behind the wheel, a separate driverless testing permit that removes the safety driver but still doesn't allow carrying paying passengers, and a deployment permit, issued jointly with the state's public utilities regulator, that's required before a service can charge fares. A company can hold the middle tier, testing without anyone in the driver's seat, for a long stretch without ever reaching the third, and from the outside that middle stage can look a great deal like a finished commercial service even though no fare has changed hands yet.

The two-tier structure exists for a reason that has nothing to do with red tape for its own sake. Watching a system perform under a safety driver's oversight for an extended stretch gives a regulator a track record to evaluate before deciding whether that same system should be trusted to drive without anyone able to intervene. Skipping straight to deployment authority without that track record would mean approving driverless operation on faith rather than evidence, which is exactly the sequencing regulators in this space have generally tried to avoid.

Some companies never make that jump at all, at least not in a given jurisdiction. Operating under testing authority indefinitely, without ever seeking deployment authority, is a legitimate strategic choice rather than a failure to clear a hurdle. A program might be perfectly happy running years of testing miles in one state while pursuing deployment somewhere else entirely, or not pursuing it anywhere, depending on what the data collection is actually for.

That gap also doesn't close once for good. A deployment permit granted in one state or city doesn't carry over to a new one; a company that has already cleared deployment authority in a given market still has to run essentially the same evidentiary process again somewhere else, for the same reasons a state-by-state safety case doesn't transfer either. Crossing the testing-to-deployment gap is therefore not a single achievement a company reaches once, but a threshold it has to clear again, market by market, every time it expands.

The public-facing numbers most people associate with AV safety, the disengagement counts regulators require companies to report, come almost entirely from this testing phase rather than from deployed commercial service; this site's disengagement reports cover what those figures do and don't tell you. Which companies have actually crossed into deployment, and where, is tracked separately on the deployment tracker.