You will be provided with a research report. The body of the report will contain some citations to references.

Citations in the main text may appear in the following forms:
1. A segment of text + space + number, for example: "Li Qiang constructed a socioeconomic status index (SES) based on income, education, and occupation, dividing society into 7 levels 15"
2. A segment of text + [number], for example: "Li Qiang constructed a socioeconomic status index (SES) based on income, education, and occupation, dividing society into 7 levels[15]"
3. A segment of text + [number†(some line numbers, etc.)], for example: "Li Qiang constructed a socioeconomic status index (SES) based on income, education, and occupation, dividing society into 7 levels[15†L10][5L23][7†summary]"
4. [Citation Source](Citation Link), for example: "According to [ChinaFile: A Guide to Social Class in Modern China](https://www.chinafile.com/reporting-opinion/media/guide-social-class-modern-china)'s classification, Chinese society can be divided into nine strata"

Please identify **all** instances where references are cited in the main text, and extract (fact, ref_idx, url) triplets. When extracting, pay attention to the following:
1. Since these facts will need to be verified later, you may need to look for some context before and after the citation to ensure that the fact is complete and understandable, rather than just a simple phrase or short expression.
2. If a fact cites multiple references, then it should correspond to two triplets: (fact, ref_idx_1, url_1) and (fact, ref_idx_2, url_2).
3. For the third form of citation (i.e., where the citation source and link appear directly in the text), the ref_idx should be uniformly set to 0.
4. If the main text does not specify the exact location of the citation (for example, only the reference list is listed at the end of the article, without specifying the citation point in the text), please return an empty list.

You should return a JSON list format, where each item in the list is a triplet, for example:
[
    {
        "fact": "Text segment from the original document. Note that Chinese quotation marks should use full-width marks. And add a single backslash before the English quotation mark to make it a readable for python json module.",
        "ref_idx": "The index of the cited reference in the reference list for this text segment.",
        "url": "The URL of the cited reference for this text segment (extracted from the reference list at the end of the research report or from the parentheses at the citation point)."
    }
]

Here is the main text of the research report:
## Executive Summary

Liability in ADAS accidents should be allocated by functional boundaries—who controls the dynamic driving task, the operational design domain, and the fallback—rather than by product names [5] [3] [16].

U.S. tort law permits shared fault where driver inattention coexists with design, warning, or marketing evidence [6] [13].

EU, UK, and German statutes supply separate mechanisms: product liability for software and updates, insurance channels for automated vehicles, and driver-duty rules for conditional automation [1] [9] [14].

Regulators should require clear HMI status, takeover timing, operational-domain enforcement, and accessible event data [17] [5] [15].

## Technical fault lines: what the system actually takes over

The liability-relevant technical categories are not brand names but the allocation of the dynamic driving task, the fallback, and the operational design domain. Level 2 is defined as sustained automated control of motion—both steering and acceleration or braking—but with limited object-and-event-detection-and-response capability, so the human must notice and react to at least some external events [5]. U.S. regulatory guidance states the same point in consumer-facing terms: at Level 2, the system can perform steering and acceleration or braking, but the driver remains responsible for driving and must remain fully engaged and attentive [3] [4]. Level 3 is different: the automated driving system performs the whole dynamic driving task, but not the fallback; a human fallback-ready user is required if something goes wrong, and the system may or may not notify the human that fallback intervention is required [5]. Level 4 systems are defined as performing the entire dynamic driving task and the entire fallback within a defined operational design domain, including a minimal-risk maneuver if the human does not take over [5].

The Level 3 boundary is where shared responsibility becomes most legally unstable. The J3016 user-guide analysis states that driver monitoring is designated “useful,” not required, for Levels 2 and 3, and that Levels 2 and 3 present significant safety issues if implemented as defined without effective driver monitoring [5]. It also notes that Level 2 systems do not enforce operational-design-domain restrictions, creating a risk of misuse or abuse [5]. At Level 3, the system is responsible for observing the external world, events, and other road users, but the human remains responsible for noticing “evident” or “kinesthetically apparent” vehicle failures and for immediately taking over even if the system does not issue an explicit request [5]. The same analysis adds that a Level 3 feature can only be engaged within its operational design domain, and that any automation capability for which a driver can be blamed for operation outside the domain is, by definition, Level 1 or Level 2 [5]. This creates a clean doctrinal rule for many Level 2 misuse cases: if the system can be used outside its domain, the human is still the supervising driver, but the manufacturer may be exposed if the system permits or encourages that misuse.

Takeover timing is another weak point. The J3016 user-guide analysis says that a Level 3 system sometimes, but not always, notifies the human that fallback intervention is required, and the time given to resume manual driving is unspecified [5]. It also says that the warning length for Level 3 is “at least several seconds,” but nowhere requires a fixed minimum such as ten seconds [5]. The standard is not a safety specification; it describes categories rather than prescribing engineering requirements, and it does not require safety analysis for Level 3 fallback behavior [5]. That distinction matters for liability: an “SAE Level 3” label is not a safety warranty, and a manufacturer’s level claim does not by itself establish that the system is defect-free or that the human should bear the entire risk.

Mercedes-Benz DRIVE PILOT provides a concrete Level 3 architecture. Mercedes-Benz reports that its system received the first internationally valid UN-R157 system approval from Germany’s Federal Motor Transport Authority in December 2021, with Germany’s 2017 Road Traffic Act amendment providing the national legal basis [2]. The company describes its initial German operational design domain as suitable motorway sections with high traffic density, up to the legally permitted 60 km/h, on 13,191 kilometres of autobahn [2]. The system relies on additional sensors, including LiDAR, a rear-window camera, microphones for detecting emergency-vehicle signals, a wetness sensor, high-precision positioning, HD map data, and redundant steering, braking, and electrical systems so that the vehicle remains maneuverable after a single failure and can ensure a safe handover [2]. In the United States, Mercedes-Benz reports Nevada compliance confirmation in January 2023 and California certification in June 2023, with a 40 mph ceiling and first deliveries in late 2023 [7] [8]. The U.S. description adds that if the driver fails to resume control after increasingly urgent prompting and expiration of the takeover time, the system brakes to a controlled standstill, activates hazard lights, triggers the emergency-call system, and unlocks doors for first responders [7] [8].

That fallback design shades toward Level 4 behavior while being sold as Level 3. The J3016 analysis warns that human-factors problems with Level 3 push makers to offer vehicles that guarantee fallback if the driver does not respond, which technically resembles Level 4 capability [5]. For liability allocation, the consequence is important: inside the certified operational design domain, with the system active and the fallback architecture functioning, the manufacturer’s certified system carries much of the dynamic driving task; outside the domain, on ignored takeover requests, or where the human fails to remain perception-ready, the driver’s supervisory duty reattaches [5] [14]. Technical approval and legal permission are separate gates: UN-R157 approval is a technical certification route, while the Road Traffic Act amendment is the national legal permission for Level 3 use [2].

## U.S. tort allocation: the Benavides trial as a Level 2 boundary case

The most developed U.S. case in the available evidence is Benavides Leon v. Tesla in the Southern District of Florida [6]. A trade-press account reports that the crash occurred on 25 April 2019 in Key Largo: George McGee was driving a 2019 Model S at approximately 62 mph through an intersection while bending down to retrieve a dropped phone, Autopilot was engaged, and the vehicle struck an SUV parked on the shoulder beside which Naibel Benavides Leon and Dillon Angulo were standing [6]. Benavides was killed, Angulo was severely injured, and McGee previously settled with the plaintiffs [6]. In August 2025, a federal jury found Tesla 33% responsible, awarded $19.5 million to the estate and $23.1 million to Angulo, and imposed $200 million in punitive damages, for a total of $243 million [6]. The account describes the decision as the first federal jury verdict involving a fatal accident tied to Tesla’s Autopilot system [6]. U.S. District Judge Beth Bloom later rejected Tesla’s post-trial motion, saying the trial evidence “more than supports” the verdict, while noting that Tesla was expected to appeal [6].

The fault split is analytically central because the jury assigned the primary fault to the human driver [6] [12]. CBT News reports the implied 67% share fell on the driver, and the Washington Legal Foundation amicus brief states the jury assigned the driver 67% [6] [12]. That allocation reflects U.S. comparative-fault logic: driver inattention inside a Level 2 “you-monitor” system does not necessarily eliminate manufacturer exposure, but it remains a major causal factor [3] [5]. The plaintiffs’ trial and post-trial brief frames the case as one in which Tesla’s design, driver-monitoring system, and marketing created an independent causal contribution [13]. The brief records the district court’s admission of NHTSA Office of Defects Investigation evidence of other Tesla frontal-plane crashes on a notice standard, reasoning that Tesla and NHTSA had identified a common defect in substantially similar accidents [13]. The brief also records Tesla’s trial admission, as characterized by the plaintiffs, that “the prominence and scope of the system’s controls maybe insufficient to prevent driver misuse,” and NHTSA’s finding that Tesla’s weak driving-engagement system was not appropriate for Autopilot’s permissive operating capabilities, creating a safety gap between driver expectations and system capabilities [13].

The plaintiffs’ brief supplies several evidence themes that matter for liability [13]. The owner’s manual specified forward-collision warning detection up to 525 feet [13], and the brief says an ordinary consumer would expect that performance below 90 mph [13]. Tesla’s public representations included a claimed 40% collision reduction when Autopilot was used [13], while expert testimony adjusted that figure to 10% after accounting for highway mileage [13]. Musk’s 2016 statements said the Model S could drive autonomously with greater safety than a person [13], and the “paint it black” video was accompanied by the assertion that the person in the driver’s seat was present only for legal reasons and that the car was driving itself [13]. The brief also described driver behavior: McGee expected the car to perform like his Jeep and other cars [13], testified he became too comfortable and trusted the technology too much [13], and NHTSA-reviewed crash videos showed the struck object in view for more than ten seconds in most studied crashes [13], while experts testified drivers fail to glance up for even a half second [13]. On technical design, the brief says Tesla used torque-based driver monitoring despite knowing Autopilot could be misused [13], that steering-wheel torque is a poor proxy for awareness [13], and that the system can produce false positives by treating an inattentive driver as attentive [13]. It further says McGee had 23 strike-outs in three months, but the penalty was minor because he could pull over, park, and restart driving [13]. Experts opined that geofencing Autopilot to its operational design domain would have prevented the crash because the system would not have engaged on the road [13], and the brief contrasts Cadillac’s Super Cruise, which it describes as geofenced to pre-mapped approved roads [13]. The brief also reports Tesla stipulated that five driver-monitoring improvements were available in 2019 [13], and that the driver-monitoring defect was admitted to exist across all makes and model years [13]. These statements are from the plaintiffs’ brief [13] and must be treated as one side’s characterisation of the trial record, not as neutral findings, but they show the evidentiary theory that supported the 33% manufacturer share [6].

The defence-side position is also on the record [6] [12]. Tesla argued that McGee alone was at fault, that the Model S was not defective, that the verdict defied common sense, and that punitive damages were unwarranted under Florida law [6]. The Washington Legal Foundation, in a July 2026 amicus brief to the Eleventh Circuit, argues that punitive damages are unavailable as a matter of law because the jury assigned primary fault to the driver, that Tesla adhered to industry standards and worked to mitigate safety risks, and that the award exceeds Florida’s statutory cap and constitutional due-process limits [12]. The live doctrinal question is therefore not whether the driver was negligent—the jury found he was—but whether a manufacturer’s post-market conduct, marketing, driver-monitoring design, and response to known misuse can independently justify punitive exposure even when the human driver bears most crash fault [6] [12] [13].

NHTSA’s own framing reinforces the U.S. driver-responsibility baseline [3]. It says that even the highest level of driving automation available to consumers requires full engagement and undivided attention [3], that it does not use “self-driving” for higher levels of automation because the term is falsely associated with how drivers must interact with current vehicles [3], and that drivers will continue to share driving responsibilities for the foreseeable future [3]. On liability, NHTSA says only that questions about liability and insurance are among many issues policymakers are working to address before automated driving systems reach maturity [3]. That leaves allocation to tort law, state law, and juries [3]. The Benavides verdict suggests that U.S. juries may treat Level 2 misuse as shared fault when the system’s design, warnings, and marketing make misuse foreseeable [6] [13].

Empirical caution also matters [16]. IIHS reports that many crash-avoidance features are effective, including front crash prevention, lane departure prevention, blind-spot detection, and rear crash prevention [16], but it also reports that IIHS did not find any crash-reduction advantage for vehicles equipped with partial driving automation compared with vehicles from the same automakers that had only crash-avoidance technologies [16]. It notes that crash-avoidance technologies cannot be effective unless used [16], that drivers may disable systems they find annoying or untrustworthy [16], and that lane systems and pedestrian detection can be limited by poor markings, snow, low light, inclement weather, and speed ranges [16]. These findings do not establish that ADAS is unsafe, but they weaken a simple “technology reduces crashes, therefore manufacturer is exonerated” argument [16]. They support a more nuanced allocation: system effectiveness depends on activation, human response, environmental conditions, and design choices [16].

## EU product liability: software, updates, and presumptions

Directive (EU) 2024/2853 on liability for defective products is the most important future EU allocation instrument for ADAS and automated driving software. It applies to products placed on the market or put into service after 8 December 2026, so it does not govern older vehicles such as the 2019 Tesla in Benavides or the earliest DRIVE PILOT vehicles [1] [6]. The directive expressly defines “product” to include software and items integrated into or interconnected with another movable, and defines “related service” as a digital service integrated into or interconnected with a product such that its absence would prevent the product from performing one or more functions [1]. That language brings ADAS software stacks and connected driving functions into the product-liability framework.

The directive’s defect standard is safety-based: a product is defective where it does not provide the safety that a person is entitled to expect or that is required under Union or national law [1]. For ADAS, the relevant factors include reasonably foreseeable use, the effect of interconnected products, and the moment the product left the manufacturer’s control [1]. Manufacturer’s control is defined to include authorisation or consent to integration, interconnection, or supply of components, including software updates or upgrades, and the ability to supply updates themselves or via a third party [1]. That is decisive for over-the-air architecture: the manufacturer does not necessarily leave the liability chain at sale if it retains control over updates and connected functions. The final manufacturer is liable for damage caused by a defective component integrated within its control, and a component manufacturer can also be liable where the component caused the final product to be defective [1]. A person who substantially modifies a product outside the manufacturer’s control and then makes it available on the market or puts it into service is treated as a manufacturer [1].

The directive also addresses evidence asymmetry. It creates a presumption of defectiveness where the claimant demonstrates that the damage was caused by an obvious malfunction of the product during reasonably foreseeable use or under ordinary circumstances [1]. It presumes causation where the product is defective and the damage is of a kind typically consistent with that defect [1]. These presumptions do not prove an ADAS defect, but they give claimants a route to challenge black-box opacity when telemetry, event data, and software logs are controlled by the manufacturer. The directive further provides that lack of software updates or upgrades necessary to maintain safety prevents an exemption from liability [1]. That makes safety-critical update behavior a liability-relevant design and service obligation.

The allocation of fault between product defect and human conduct is nuanced. Under Article 13, Member States must ensure that an economic operator’s liability is not reduced or disallowed where damage is caused both by product defectiveness and by an act or omission of a third party, without prejudice to national contribution or recourse law [1]. But liability may be reduced or disallowed where the damage is caused both by the defective product and by the fault of the injured person or someone for whom the injured person is responsible [1]. In an ADAS crash, this means a manufacturer may not escape liability merely because a driver’s act contributed, if the driver is a third party rather than the injured claimant; but a claimant’s own fault can reduce recovery. The directive also preserves rights under national special liability systems that existed on 30 July 1985, so it does not replace motor-insurance or driver-liability regimes as the only route to compensation [1]. It further provides that liability under the directive may not be limited or excluded by contract or national law in relation to the injured person, and that economic operators who compensate can pursue recourse against other liable operators under national law [1].

The EU and UNECE type-approval layer supplies a technical safety case but not a civil-liability rule. Mercedes-Benz reports that DRIVE PILOT was certified against UN-R157 and that the KBA approval was a legal-technical prerequisite for offering the system where national law allows [2]. The JRC commentary on the EU ADS type-approval regulation states that the document supports interpretation but does not introduce new legal requirements, and that the regulation itself is binding [17]. It describes the manufacturer’s declaration that the ADS is free from unreasonable risks for occupants and other road users, the need for HMI mechanisms to inform operators and occupants about ADS status and their responsibilities, and continuous manufacturer responsibility for safety and compliance throughout the ADS lifetime [17]. It also states that in-service reporting is intended to confirm safety performance and identify improvements, not to attribute blame or liability [17]. That distinction is important: type-approval data can become evidence, but approval is not a safe harbour that automatically allocates fault to the driver.

## German law: the L3 driver duty and the L4 oversight split

Germany’s Road Traffic Act separates the Level 3 driver context from the Level 4 autonomous-driving context. Section 1b, as amended by the Fifth Act Amending the Road Traffic Act effective 1 July 2026, states that during vehicle operation using automated driving functions under Section 1a, the driver may divert attention from traffic and vehicle control but must remain perception-ready enough to comply with the takeover duty [14]. The driver must immediately resume control if the automated system requests it, or if the driver recognises or, because of obvious circumstances, must recognise that the conditions for proper use of the automated driving functions are no longer met [14]. This is the core Level 3 allocation rule: the system may drive, but the human remains a fallback user with an immediate takeover obligation.

The German Act on Autonomous Driving translation covers a different regime: motor vehicles with autonomous driving functions in determined operational areas. It defines such a vehicle as one that can autonomously perform the driving task in a determined operational area without the involvement of a driver, and defines “technical oversight” as the natural person who can deactivate the vehicle during operation and decide whether to permit certain driving manoeuvres [15]. It defines “minimal risk condition” as the condition in which the vehicle, on its own initiative or on the initiative of technical oversight, brings itself to a standstill at the safest possible position and activates hazard lights [15]. The technical requirements include autonomous compliance with traffic rules, an accident-prevention system that prioritises protection of human life, autonomous entry into minimal risk condition when continuing would infringe road traffic law, recognition of system limits, deactivation by technical oversight or occupants, and stable radiocommunications with fallback to minimal risk condition if communications are interrupted or illegally accessed [15].

The data-recording rules in the L4 limb are also liability-relevant. The keeper of a motor vehicle with autonomous driving functions must store data including vehicle identification number, position data, activation and deactivation times of autonomous functions, permitted alternative manoeuvres, system-monitoring data including software status, environmental and weather conditions, connectivity parameters, safety-system names and status and the entity that triggered a safety system, acceleration, speed, lighting status, voltage supply, and external commands or information sent to the vehicle [15]. Data must be stored for interventions by technical oversight, conflict scenarios including accidents and near-misses, unexpected lane changes or swerve-to-avoid manoeuvres, and operational disruptions [15]. Third parties may obtain stored data if required to assert, satisfy, or reject legal claims connected with an incident involving the vehicle, and must erase the data once no longer required for legal claims, at the latest upon limitation of the claims [15]. This creates a statutory evidentiary channel for L4 incidents, though the question here concerns ADAS and shared human-machine driving, where the L3 driver-duty rule in Section 1b is more directly relevant [14] [15].

## UK law: an insurer-first channel with a user-fault exception

The UK Automated and Electric Vehicles Act 2018 is the clearest existing statutory allocation rule in the evidence pool for automated vehicles. Section 2 provides that where an accident is caused by an automated vehicle when driving itself on a road or other public place in Great Britain, the vehicle is insured, and an insured person or any other person suffers damage, the insurer is liable for that damage [9]. If the vehicle is uninsured but exempt from the ordinary insurance duty because it is a public-body or Crown vehicle, the owner is liable [9]. “Damage” includes death or personal injury and property damage, with exclusions for the automated vehicle itself, goods carried for hire or reward, and property in the custody or control of the insured person or person in charge [9]. Property damage is capped by reference to the Road Traffic Act 1988 limit, and liability under the section cannot be limited or excluded by policy terms except as provided by Section 4 [9]. Importantly, Section 2(7) states that imposing liability on the insurer or vehicle owner does not affect any other person’s liability in respect of the accident [9]. The statute is therefore a payment mechanism, not a substantive cap on all liability.

Section 3 imports contributory negligence. Where an insurer or vehicle owner is liable under Section 2 and the accident or damage was to any extent caused by the injured party, the amount is subject to whatever reduction the Law Reform (Contributory Negligence) Act 1945 would apply to a claim against a person other than the insurer or owner [10]. Section 3(2) is the sharpest boundary: the insurer or owner is not liable under Section 2 to the person in charge of the vehicle where the accident the vehicle caused was wholly due to that person’s negligence in allowing the vehicle to begin driving itself when it was not appropriate to do so [10]. The statute thus treats the human decision to activate or permit automation as itself a fault locus, but only removes the strict channel when that human fault is the sole cause.

Section 4 supplies the software limb. An insurance policy may exclude or limit the insurer’s Section 2 liability for damage suffered by an insured person arising from an accident occurring as a direct result of software alterations made by, or with the knowledge of, the insured person that are prohibited under the policy, or failure to install safety-critical software updates that the insured person knows or ought reasonably to know are safety-critical [11]. Where an insurer pays a third-party claim and the accident directly resulted from such prohibited alterations or failure to install safety-critical updates, the amount paid is recoverable from the insured person to the extent provided by the policy [11]. Software updates are “safety-critical” if it would be unsafe to use the vehicle without them [11]. The UK regime therefore uses insurance law to enforce update behavior and to channel first-instance compensation while preserving recourse and other liability routes [9] [11].

The AEVA text available in the evidence is marked as up to date with changes known to be in force on or before 13 September 2026, but also shows amendment markers not yet applied to the text, including changes from 2024 and 2025 legislation [9] [10] [11]. That matters for current-law analysis: the statutory architecture is stable in its core allocation logic, but the precise text may be in flux.

## Boundary-drawing factors: naming, HMI, warnings, and data

The boundary between driver fault and manufacturer responsibility is drawn through naming, human-machine interface design, warning adequacy, operational-domain enforcement, and event data, each of which appears in technical standards, regulator guidance, litigation records, and statutory data rules [3] [4] [5] [13] [15] [17].

Naming is a liability-relevant representation, not merely marketing, because regulator and litigation records tie names to driver expectations [3] [13]. NHTSA says it follows industry standards in not using “self-driving” for higher levels of automation because the term is falsely associated with how drivers must interact with current vehicles [3]. The J3016 user-guide analysis says that “Level 2+” and similar fractional terms are prohibited by J3016 and may be marketing puffery or descriptions of features that do not fit the standard [5]. IIHS states that at no point can a Level 2 system, also known as partial driving automation, ever replace the driver, and that the driver must continue to monitor the driving environment and remain actively engaged [16]. Yet the Benavides trial record, as described in the plaintiffs’ brief, contains statements by Tesla executives and marketing materials that the brief characterises as overstating capability, including a 40% collision-reduction claim, Musk statements that the car was driving itself, and consumer-expectation evidence about forward-collision warning range [13]. The analytical point is that courts and regulators should treat level labels and brand names as evidence of foreseeable user expectations, not as dispositive legal categories [3] [5] [16] [13].

Warning design also matters: NHTSA distinguishes systems that only warn, such as forward-collision warning and lane-departure warning, from systems that act, such as automatic emergency braking, lane centering, and lane keeping [4].

For Level 3 systems, HMI design is central to the boundary between human and machine responsibility, and JRC type-approval guidance says the applicant should describe mechanisms that inform the operator and occupants about ADS status and their responsibilities [17]. Mercedes-Benz describes DRIVE PILOT as allowing the driver to focus on certain secondary activities while the system is active, with controls on the steering wheel and applications enabled on the central display [2] [7]. The JRC commentary says the applicant should describe mechanisms to inform the operator and occupants about ADS status and their responsibilities in an understandable and unambiguous way, and at minimum the HMI should inform the operator that the ADS is functioning properly, currently engaged, currently unavailable, experiencing a malfunction, or requesting intervention [17]. That supports a regulatory recommendation: the HMI should not merely indicate that automation is available; it should state whose responsibility is active, what the system can and cannot do, and what the human must do on takeover [17] [5].

Event data is the evidentiary bridge between technical design and legal fault, because presumptions, recording rules, and litigation records all turn on it [1] [15] [13]. The EU Product Liability Directive’s presumptions can reduce the claimant’s burden where an obvious malfunction caused damage and where the damage is typically consistent with the defect [1]. Germany’s L4 data rules require extensive recording and allow third-party access for legal claims [15]. The JRC commentary says in-service reporting is for safety confirmation and improvement, not blame [17], although the same data can still be relevant to civil claims [15] [13]. The Benavides record shows the practical importance of telemetry and post-market data: the plaintiffs’ brief describes vehicle logs, strike-out events, NHTSA crash-video analysis, Tesla’s own safety goals documents, and internal data limitations [13]. A claimant without access to such data faces a severe asymmetry [13]. The policy conclusion is that standardized, retained, and legally accessible event data should be part of any liability regime [1] [15].

## Comparative allocation map

| Context | Technical responsibility | Human fault trigger | Manufacturer or insurer route | Evidentiary mechanism |
| --- | --- | --- | --- | --- |
| Level 2 ADAS | Driver remains responsible for monitoring and intervention even when system controls steering and speed [3] [5] | Driver misuse, inattention, operation outside ODD, ignored warnings [4] [5] [16] | U.S. product-liability and comparative-fault litigation; Benavides jury assigned 33% to Tesla and 67% to driver [6] | Marketing, HMI, DMS design, ODD geofencing, crash data [13] [16] |
| Level 3 conditional automation | System performs whole DDT within ODD, but human fallback required [5] | Failure to take over when requested or when proper-use conditions fail [14] | German §1b driver duty; UK AEVA if automated vehicle is driving itself [14] [9] | HMI status, in-service reporting, and analogous data-recording rules [17] [15] |
| Level 4 autonomous operation | System performs DDT and fallback within ODD [5] | No driver in vehicle; technical oversight may deactivate or approve manoeuvres [15] | German Act on Autonomous Driving L4 regime; UK AEVA channel for automated vehicle driving itself [15] [9] | Mandatory data storage and third-party access for legal claims [15] |
| EU product liability after 8 December 2026 [1] | Software and related services are products; manufacturer control includes updates [1] | Injured person’s own fault may reduce; third-party act alone does not reduce operator liability [1] | Manufacturer and component-maker liability, substantial modifiers treated as manufacturers, and recourse among economic operators [1] | Presumptions for obvious malfunction and typical damage [1] |

## Where the frameworks conflict or leave gaps

The frameworks do not produce a single global rule. The U.S. Benavides record shows a comparative-fault split in which driver inattention remains dominant, but manufacturer design and marketing can still carry substantial liability [6] [13]. The EU Product Liability Directive, for products in scope, would not allow an economic operator’s liability to be reduced merely because a third party’s act or omission contributed, though the injured person’s fault can reduce recovery [1]. That is materially different from the Benavides allocation, which was governed by Florida tort law and a jury’s fault assessment, not by the post-2026 EU directive [6] [1].

The UK AEVA creates a different logic: the insurer pays first when an automated vehicle causes an accident while driving itself, but the person in charge can be denied the strict channel if the accident was wholly due to their negligence in allowing the vehicle to begin driving itself when inappropriate [9] [10]. The “wholly” threshold is important: partial user negligence reduces recovery under contributory negligence, but only sole user negligence removes the insurer’s Section 2 liability to the person in charge [10]. The software-update carve-out further shifts loss to users who make prohibited alterations or fail to install safety-critical updates [11]. This is an insurance-channel allocation rule, not a general product-defect test.

German law is closer to a duty-based allocation for Level 3: the driver may divert attention but must remain perception-ready and take over immediately on request or when conditions fail [14]. The L4 Act translation, however, shows a different architecture: no driver, technical oversight, minimal-risk condition, and data recording [15]. The evidence does not establish how German courts have allocated fault in Level 3 accidents under the amended §1b, nor does it provide the full text of UN-R157 or a complete set of German case law. The analysis therefore cannot claim a settled German judicial allocation rule.

The empirical evidence is also incomplete. IIHS reports mixed findings for partial automation and no crash-reduction advantage over crash-avoidance technologies in its studies [16]. NHTSA’s consumer guidance says higher-level systems are not widely available to consumers, while Mercedes-Benz reports Level 3 certifications and model-year availability in Nevada and California [3] [7] [8]. These are not necessarily irreconcilable—“widely available” is not “available at all”—but the tension shows that legal analysis must distinguish historical conditions, current limited deployment, and projected future systems. The available evidence does not establish a comprehensive real-world effectiveness baseline for ADAS crashes, and it does not establish the terms of any manufacturer indemnification programme.

## Proposed regulatory guidelines and recommendations

A workable liability regime should start from function, not labels. Regulators should require that marketing, owner manuals, HMI displays, and dealer communications state the actual dynamic-driving-task delegation: whether the system is Level 2, Level 3, or higher; whether the driver must monitor the road; whether hands-on or eyes-on is required; what the operational design domain is; and what happens on takeover failure [3] [5] [16] [17]. Misleading names should be treated as evidence of foreseeable misuse, not protected commercial speech, because the Benavides record shows how capability claims can shape driver expectations [13].

For Level 2 systems, regulators should require effective driver monitoring or equivalent operational restrictions. The J3016 analysis says driver monitoring is only “useful,” not required, at Levels 2 and 3, and that Levels 2 and 3 can be unsafe if implemented as defined without effective monitoring [5]. IIHS notes that drivers may disable systems and that partial automation has not shown a crash-reduction advantage over crash-avoidance features in its studies [16]. The Benavides plaintiffs’ brief describes torque-based monitoring as a weak proxy for attention and points to geofencing and stronger monitoring as feasible alternatives [13]. A regulatory rule should therefore prohibit “eyes-off” or “hands-off” claims for Level 2 unless the system enforces engagement and restricts use to its domain. If a system can be engaged outside its operational design domain, it should not be marketed as Level 3, and manufacturer exposure should remain for foreseeable misuse [5].

For Level 3 systems, the law should specify minimum takeover timing and fallback obligations. The J3016 user-guide analysis says Level 3 warning length is “at least several seconds” but not fixed, and that the system sometimes does not notify the driver of non-ADS failures [5]. A safer rule would require a minimum takeover window, explicit HMI communication of remaining time, and a certified minimal-risk maneuver if the human does not respond, as in the Mercedes fallback description [7] [8] [17]. If a Level 3 product performs a full minimal-risk maneuver without requiring human takeover, regulators should treat it functionally as Level 4 within its domain and allocate responsibility accordingly [5] [7].

Data access should be mandatory and standardized. The EU Product Liability Directive’s presumptions help, but only if claimants can reach the evidence [1]. Germany’s L4 data rules show that detailed recording and third-party access for legal claims are feasible [15]. The JRC commentary says in-service reporting is for safety improvement, not blame [17], but that does not mean the same data cannot be used in civil litigation. Regulators should require event data recorders and automated-driving system data storage to record activation, deactivation, HMI warnings, takeover requests, driver response, system status, object detection, braking and steering commands, software version, update history, and environmental conditions, with privacy-protective access rules for accident investigation and litigation.

Software updates should be treated as part of the product, not optional maintenance. The EU directive already ties manufacturer control to the ability to supply updates and makes lack of safety-critical updates relevant to liability [1]. The UK AEVA allows insurance policy exclusions or recoveries for failure to install safety-critical updates and prohibited software alterations [11]. Regulators should require OEMs to label updates as safety-critical, provide clear installation prompts, log update refusal, and explain the consequences of non-installation. At the same time, the rule should not punish users for update failures caused by OEM server outages, incompatible hardware, or unclear communication.

Compensation should be front-loaded through insurance. The UK model is instructive: an insurer-first channel removes the injured party’s need to prove whether the cause was human or machine at the first stage, while preserving contributory negligence, user-fault exceptions, and recourse [9] [10] [11]. The EU directive preserves national special liability systems and allows recourse among economic operators [1]. A general rule should therefore separate compensation from fault: insurers or owners pay first for automated-vehicle accidents, then allocate ultimate responsibility through subrogation, product-liability claims, and data-driven fault analysis.

Type approval should be treated as a market-entry condition, not a liability shield. The JRC commentary states that type-approval acceptance implies residual risk is acceptable for entry into service, but also that compliance extends throughout the ADS lifetime and remains the manufacturer’s responsibility [17]. It notes that accident data can be biased, that validation cannot guarantee fidelity over unlimited parameter spaces, and that national authorities should provide additional ODD traffic data [17]. Regulators should require post-market reporting, safety-critical occurrence notification, annual performance reports, and corrective-action transparency, while making clear that approval does not automatically defeat a defect or negligence claim [17] [2].

## Concluding judgment

The defensible allocation principle is functional: responsibility follows the party who controls the driving task, the fallback, and the decision to engage automation, subject to evidence of design defect, warning adequacy, marketing-induced expectation, and update behavior. In Level 2 accidents, the driver remains the primary responsible actor, but the manufacturer can still share liability where the system permits misuse, relies on weak monitoring, fails to geofence its domain, or creates unrealistic expectations [3] [5] [13] [16]. Benavides illustrates this: the jury assigned most fault to the driver, but the manufacturer still bore a substantial share, and the punitive-damages question remains live on appeal [6] [12]. In Level 3 accidents, the boundary is narrower and more statutory: the system may perform the driving task inside its domain, but the human must remain perception-ready and take over when requested or when proper-use conditions fail [5] [14]. The UK and German regimes show two complementary approaches: the UK channels first-instance compensation through insurance while preserving user-fault and update-based recourse [9] [10] [11], and Germany imposes a driver-duty rule for Level 3 and a technical-oversight and data rule for Level 4 [14] [15]. The EU Product Liability Directive, once applicable to products placed on the market after 8 December 2026, will make software, updates, and digital services central to manufacturer liability and will ease claimant proof through presumptions [1].

The strongest regulatory conclusion is that liability should not be left to post-crash litigation alone. The evidence supports a pre-emptive framework: unambiguous naming, enforceable operational-domain limits, required driver monitoring or equivalent restrictions for Level 2, fixed takeover timing and fallback standards for Level 3, mandatory event-data recording and claimant access, safety-critical update obligations, and first-instance insurance channels with recourse. The main uncertainties are empirical and legal: the available evidence does not establish a final appellate outcome in Benavides, does not provide comprehensive real-world ADAS effectiveness data, does not reproduce the full UNECE R157 text, and does not record the terms of any manufacturer indemnification commitment [6] [12] [16] [2]. A consequential judgment could change if higher courts clarify punitive-damages limits, if post-2026 EU product-liability litigation tests the presumptions, or if standardized event-data rules make allocation far more evidence-driven.

## References

[1] Consolidated TEXT: 32024L2853 — EN — 18.11.2024 — https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02024L2853-20241118
[2] First internationally valid system approval: Conditionally automated driving | Mercedes-Benz Group > Technology > Autonomous Driving > Driving — https://group.mercedes-benz.com/technology/autonomous-driving/driving/system-approval-for-conditionally-automated-driving.html
[3] Automated Vehicle Safety | NHTSA — https://www.nhtsa.gov/technology-innovation/automated-vehicles-safety
[4] Driver Assistance Technologies | NHTSA — https://www.nhtsa.gov/vehicle-safety/driver-assistance-technologies
[5] SAE J3016 User Guide — https://users.ece.cmu.edu/%7Ekoopman/j3016/index.html
[6] Judge rejects Tesla's appeal in $243 million Autopilot fatality case — https://www.cbtnews.com/judge-rejects-teslas-autopilot-fatality-case
[7] Mercedes-Benz world’s first automotive company to certify SAE Level 3 system for U.S. market | Mercedes-Benz Group > Technology > Autonomous Driving > Driving — https://group.mercedes-benz.com/technology/autonomous-driving/driving/drive-pilot-nevada.html
[8] Mercedes-Benz DRIVE PILOT further expands U.S. availability through California certification | Mercedes-Benz Group > Technology > Autonomous Driving > Driving — https://group.mercedes-benz.com/technology/autonomous-driving/driving/drive-pilot-california.html
[9] Automated and Electric Vehicles Act 2018 — https://www.legislation.gov.uk/ukpga/2018/18/section/2
[10] Automated and Electric Vehicles Act 2018 — https://www.legislation.gov.uk/ukpga/2018/18/section/3
[11] Automated and Electric Vehicles Act 2018 — https://www.legislation.gov.uk/ukpga/2018/18/section/4
[12] WLF Asks Eleventh Circuit to Reverse Punitive Damages Award Against Tesla - Washington Legal Foundation — https://www.wlf.org/2026-07-09/communicating/press-releases/wlf-asks-eleventh-circuit-to-reverse-punitive-damages-award-against-tesla
[13] IN THE DISTRICT COURT OF APPEAL — https://storage.courtlistener.com/recap/gov.uscourts.flsd.593426/gov.uscourts.flsd.593426.602.0_1.pdf
[14] § 1b StVG - Rechte und Pflichten des Fahrzeugführers bei... - dejure.org — https://dejure.org/gesetze/StVG/1b.html
[15] https://web.archive.org/web/2id_/https://wiki.unece.org/download/attachments/188285112/EDR-DSSAD-19-06%20German_Act%20on%20Autonomous%20Driving.pdf?api=v2 — https://wiki.unece.org/download/attachments/188285112/EDR-DSSAD-19-06%20German_Act%20on%20Autonomous%20Driving.pdf?api=v2
[16] Advanced driver assistance — https://www.iihs.org/research-areas/advanced-driver-assistance
[17] https://globalautoregs.com/system/resources/items/000/000/046/original/JRC136417_01.pdf — https://globalautoregs.com/system/resources/items/000/000/046/original/JRC136417_01.pdf


Please begin the extraction now. Output only the JSON list directly, without any chitchat or explanations.