Skip to content
OnticBeta
Tier 2 — Industry Standardindustry oracle

Automotive — AI Governance Landscape

Publisher

Ontic Labs

Version

v1

Last verified

February 15, 2026

Frameworks

EPA emissions regulationsEU type-approval (WVTA)FMVSSFMVSS (49 CFR 571)IATF 16949NHTSA (49 CFR 573, 576, 577, 579)NHTSA TREAD Act reportingOEM-specific quality requirements (e.g., Toyota SQ manual)REACH/RoHS (if EU supply chain)State lemon lawsTREAD ActUNECE regulations

Industries

automotive

Automotive - Overview

$33.9B market heading to $107B. 46 million cars already run Mobileye. The governance gap is small (+5pp) but the consequences are physical. When an autonomous system makes a decision, regulators will ask for the evidence chain. Ontic provides it.

The $33.9B automotive AI market is heading to $107B. Mobileye alone runs in 46 million vehicles. The governance gap is only 5 percentage points, but the consequences are measured in fatalities. ADAS, autonomous driving stacks, and predictive maintenance systems make decisions with physical outcomes -- and NHTSA, UNECE WP.29, and the EU AI Act all classify these as high-risk. The regulatory frameworks exist but were built for deterministic software, not probabilistic models. When an autonomous system makes a decision that results in injury, the litigation discovery process will subpoena the model's decision chain. The specific input state, model version, and output that produced the action must be reconstructable. In most current architectures, it is not.

This industry includes 2 segments in the Ontic governance matrix, spanning risk categories from Category 4 — Safety-Critical through Category 4 — Safety-Critical. AI adoption index: 7/5.

Automotive - Regulatory Landscape

The automotive sector is subject to 12 regulatory frameworks and standards across its segments:

  • EPA emissions regulations
  • EU type-approval (WVTA)
  • FMVSS
  • FMVSS (49 CFR 571)
  • IATF 16949
  • NHTSA (49 CFR 573, 576, 577, 579)
  • NHTSA TREAD Act reporting
  • OEM-specific quality requirements (e.g., Toyota SQ manual)
  • REACH/RoHS (if EU supply chain)
  • State lemon laws
  • TREAD Act
  • UNECE regulations

The specific frameworks that apply depend on the segment and scale of deployment. Cross-industry frameworks (GDPR, ISO 27001, EU AI Act) may apply in addition to sector-specific regulation.

Automotive - Automotive -- Tier 1 Supplier

Risk Category: Category 4 — Safety-Critical Scale: Mid-Market Applicable Frameworks: IATF 16949, NHTSA TREAD Act reporting, FMVSS (49 CFR 571), REACH/RoHS (if EU supply chain), OEM-specific quality requirements (e.g., Toyota SQ manual)

When NHTSA investigates a recall, the Tier 1's AI-assisted quality decision is part of the evidence chain.

The Governance Challenge

Tier 1 suppliers deploy AI for engineering change request drafting, supplier audit preparation, IATF 16949 compliance narratives, and supply chain risk reporting. OEM-specific quality requirements (Toyota SQ manual, VW Formel Q, etc.) apply to AI-generated quality documentation. NHTSA TREAD Act reporting obligations flow down to suppliers. When an AI-assisted quality decision contributes to a safety recall, the NHTSA investigation examines the entire supply chain — including the Tier 1's AI-generated engineering documentation and quality records.

Regulatory Application

IATF 16949 quality management requirements apply to AI-generated quality documentation. NHTSA TREAD Act reporting obligations flow to suppliers for safety-related defects. FMVSS (49 CFR 571) standards apply to components with AI-assisted design or quality decisions. REACH/RoHS applies to EU supply chain AI outputs. OEM-specific quality requirements add manufacturer-specific standards on top of IATF.

AI Deployment Environments

  • Studio: Engineering change request drafting | Supplier audit preparation
  • Refinery: IATF 16949 compliance narratives | Supply-chain risk reporting
  • Clean Room: Safety recall root-cause narratives | OEM evidence bundles

Typical deployment path: Refinery → Refinery → Clean Room

Evidence

  • Automotive AI market projected from $33.9B (2024) to $107B by early 2030s
  • NHTSA recall investigations examine the full supply chain evidence
  • OEM supplier qualification increasingly includes AI governance
  • IATF 16949 traceability requirements are absolute

Automotive - Automotive -- OEM

Risk Category: Category 4 — Safety-Critical Scale: Enterprise Applicable Frameworks: NHTSA (49 CFR 573, 576, 577, 579), TREAD Act, FMVSS, EPA emissions regulations, State lemon laws, EU type-approval (WVTA), UNECE regulations

When an ADAS decision results in injury, NHTSA will subpoena the model's decision chain. It must be reconstructable.

The Governance Challenge

Automotive OEMs deploy AI across internal safety analysis, warranty issue summarization, recall analysis governance, regulatory submission drafting, ADAS systems, and autonomous driving stacks. NHTSA (49 CFR 573, 576, 577, 579) governs safety reporting and recall obligations. The governance gap in automotive is only 5 points, but the consequences are measured in fatalities. When an ADAS or autonomous system makes a decision that results in injury, the litigation discovery process will subpoena the model's decision chain — the specific input state, model version, and output that produced the action. In most current architectures, it is not fully reconstructable.

Regulatory Application

NHTSA (49 CFR 573, 576, 577, 579) governs safety reporting and recall obligations for AI-assisted vehicles. TREAD Act requires early warning reporting for AI-related safety signals. FMVSS applies to AI-assisted vehicle systems. EPA emissions regulations apply to AI-optimized powertrains. State lemon laws apply to AI-related vehicle defects. EU type-approval (WVTA) requires AI system governance for European markets. UNECE regulations govern autonomous driving AI internationally.

AI Deployment Environments

  • Studio: Internal safety analysis drafts | Warranty issue summarization
  • Refinery: Recall analysis governance | Regulatory submission drafting
  • Clean Room: NHTSA-defensible reporting | Safety-critical system governance | FMEA chain-of-custody

Typical deployment path: Clean Room → clean_room (primary) | refinery for non-safety operations

Evidence

  • Roughly 200 million vehicles globally have shipped with Mobileye EyeQ technology
  • NHTSA Standing General Order requires ADS crash reporting
  • Autonomous vehicle litigation discovery is establishing AI evidence requirements
  • EU AI Act classifies autonomous vehicle AI as high-risk