30,000 devices covered by NHTSA's preliminary investigation into comma.ai's driver-assistance units

30,000 devices covered by NHTSA's preliminary investigation into comma.ai's driver-assistance units

NHTSA has opened a preliminary investigation into comma.ai's aftermarket driver-assistance devices following five crashes with three deaths — including a fatal crash in which the car was reportedly running a third-party variant of the company's open-source software. It is the first federal scrutiny of the company's devices since 2016, and it raises an unresolved question: who answers for failures when the software is open source and can be modified by anyone?

What NHTSA is investigating

The National Highway Traffic Safety Administration's Office of Defects Investigation (ODI) opened Preliminary Evaluation PE26007 on September 21, 2026, according to Electrek, which has reviewed the investigation document (Electrek). The probe covers comma's three most recent hardware generations — comma three, comma 3X and comma four — as well as openpilot, the open-source software that runs on them. NHTSA estimates roughly 30,000 devices are affected; comma itself says more than 30,000 cars use the equipment. The company also states the devices have logged 402 million miles and claims to rank second only to Tesla in hands-free miles driven — all figures that come from the company itself (Reuters).

The background is five reported crashes in which cars equipped with comma hardware struck slow-moving or stationary vehicles in their own lane, plus one crash involving a vehicle that was merging into the lane. Four of the five crashes produced 11 injuries; two crashes resulted in three deaths, according to NHTSA as cited by Business Insider (Business Insider via Yahoo). The magazine Guessing Headlights reports the same scope of the investigation (via Yahoo).

NHTSA stresses that all of this is preliminary. "ODI has confirmed that the systems were powered on or engaged in multiple crashes," the agency writes, adding: "Preliminary data reviewed by ODI suggests the comma system may not have adequately detected or responded to the in-lane vehicles" (Business Insider via Yahoo). The agency has not found a defect, and the investigation could end without one.

The crashes the investigation rests on

The most concretely documented accident took place in September 2025, when a 2020 Honda Accord with openpilot "verified engaged," according to crash reports, ran into a stationary car on a Missouri highway at 82 mph (132 km/h). One person was seriously injured and taken to hospital. Honda, citing the police report and a lawsuit, claims the driver fell asleep with cruise control set at 80 mph — an account that for now rests on those sources and has not been independently confirmed (Electrek).

The fatal crash occurred in Louisiana in February 2026. In its report to NHTSA, comma writes that the device "appears to have been running 3rd party non-comma software" — that is, a fork of openpilot. Ars Technica identifies it as FrogPilot, one of several community-developed variants of the main software (Ars Technica). The sources are not fully aligned on the software status in this particular crash: Business Insider does not mention which software was in use, and describes the crash as a collision with an unoccupied police car. What remains is that at least two of the five crashes involved forks of the main build, according to Ars Technica.

The fifth crash stands out for another reason: here, a car with comma equipment struck a vehicle that was merging into the lane — not a stationary or slow-moving vehicle already in the lane (Ars Technica).

The fork problem: who is accountable for open source?

What makes the investigation unusual is not just the hardware but the software's openness. openpilot is open source, and anyone can create their own variant. When an accident happens on such a variant, by definition it was not comma's code driving the car. NHTSA has, however, set up an accountability mechanism: the agency says that if a modified version of openpilot is involved in a crash, it will evaluate it and consider the components the variant shares with the official openpilot build (Electrek).

In practice, this means comma cannot distance itself from third-party variants merely by pointing out that the code was changed — as long as parts of the codebase are shared, the shared parts are also subject to scrutiny. At the same time, the case shows that a traditional defect-liability system, built around one manufacturer and one software version, comes under pressure when the product is a platform that enthusiasts freely build upon.

The reporting obligation being contested

NHTSA learned of the crashes through a mix of crash reports filed under the agency's Standing General Order — a set of orders requiring manufacturers of driver-assistance systems to report serious crashes — as well as a consumer complaint and its own outreach to police (Electrek).

But comma's reports contain a recurring reservation. Each opens with the same wording: the company provides the information "without agreeing with NHTSA's interpretations or conceding that comma is obligated to respond to the General Order." Asked whether the vehicles were operating within the system's approved usage scope (operational design domain), the company answers "Unknown." Electrek also points out that one of the five crash reports (ID 30351-1807) does not appear in NHTSA's public Standing General Order dataset, meaning the details of that case cannot be verified in publicly available data.

The company's side

Comma.ai has not publicly commented on the investigation; neither Reuters nor Business Insider managed to reach the company (Reuters). On its website, the company writes that the system requires "the driver to be alert, pay attention, and be ready to take over at all times." The company describes the devices as enabling hands-free driving, with the ability to "accelerate, brake automatically for other vehicles, and steer to follow the road/lane."

The investigation is the first federal action against comma's devices since 2016, when NHTSA took action against the company's first device, the comma one. It also comes amid a period of active NHTSA attention to several driver-assistance systems on the market.

What happens next

A preliminary evaluation is the first and most informal step in NHTSA's defect investigations. The agency says the investigation will gather data to verify system status in each individual incident, and evaluate system performance as well as the safety mechanisms intended to ensure safe operation of vehicles equipped with comma devices (Yahoo).

From here, two paths are possible: the investigation can be closed with no defect found, or it can escalate to a more comprehensive engineering analysis — a step that historically has been the precursor to recalls. For now, the crucial question is unanswered: NHTSA has not concluded that comma's system caused the crashes, and no defect finding exists. The agency is formally investigating whether the systems detected what they should — and because comma's own reports explicitly contest that the company is obligated to answer the General Order, it remains open who will ultimately have to answer for the answers.