NHTSA opens a federal investigation into comma.ai's aftermarket driving-assist devices after five crashes killed three people

The National Highway Traffic Safety Administration opened a federal defect investigation into comma.ai's driving-assist hardware on Sept. 21, after five (5) crashes -- two of them fatal, killing three people -- involving the company's aftermarket devices. NHTSA's own opening filing, Investigation PE26007, says the crashes shared a pattern: vehicles equipped with comma devices reportedly struck stopped or slowly moving vehicles within the same travel lane, and the agency has confirmed the systems were powered on or engaged in multiple of them.

comma.ai, founded by hacker George Hotz in 2015, sells aftermarket devices -- the comma three, comma 3X and comma four -- that bolt onto a car's existing systems and use their own cameras alongside stock sensors to provide “sustained automated control of speed and vehicle heading,” in NHTSA's description, similar in function to Tesla's Autopilot or GM's Super Cruise. The company advertises hands-free driving “for the car you already have” and says a consumer can “get set up in your car in 15 minutes” -- while also stating that its software, openpilot, “requires the driver to be alert, pay attention, and be ready to take over at all times.” One fatal crash, in February 2026 in Ascension Parish, Louisiana, involved a 2022 Toyota RAV4 running FrogPilot, a third-party modified fork of openpilot, which struck a stopped police vehicle with its emergency lights on in the left lane of Interstate 10; two rear-seat passengers died.

Behind those three headline numbers sits a single recurring pattern NHTSA says it found across the crashes it reviewed.

“Preliminary data reviewed by ODI suggests that the comma system may not have adequately detected or responded to the in-lane vehicles.” — NHTSA Office of Defects Investigation, PE26007 Opening Resume

That sentence is the core of what NHTSA is actually alleging at this stage: not a finding of fault, but a preliminary read that the failure mode -- missing a vehicle already stopped or moving slowly in the same lane -- shows up across multiple of the five crashes. The agency has not concluded the devices are defective; a Preliminary Evaluation is the opening stage of a process that can end with no action taken at all.

Federal scrutiny of hands-off driving software is not new -- NHTSA has run a multi-year investigation into Tesla's Autopilot dating to 2021, which found the system's driver-engagement design left a “critical safety gap,” led to a recall of more than two million vehicles in December 2023, and remains open today as regulators examine whether that recall actually fixed the problem. The comma.ai probe is a different category of product, though: Tesla's Autopilot ships from the factory, under Tesla's own name and warranty, and Tesla controls every software update. comma.ai's devices are third-party hardware a driver buys and wires in themselves, running software the driver can further modify -- which is exactly the FrogPilot complication that makes this investigation's liability questions harder than Tesla's ever were.

comma.ai could not be reached for comment by reporters, and Hotz -- who stepped back from day-to-day operations in 2022 -- did not respond to requests either. The company's own website language already warns that openpilot “requires the driver to be alert, pay attention, and be ready to take over at all times,” which is likely to be central to how comma.ai frames responsibility for crashes NHTSA is now examining -- especially the one crash confirmed to involve a modified third-party fork rather than comma's own shipped code.

A Preliminary Evaluation is the earliest of NHTSA's formal investigation stages: the agency drafts an information-request letter to the manufacturer, reviews what comes back against the crash data it already has, and most PEs resolve one way or the other within about four months. If that review finds enough to support an unreasonable safety risk, the case upgrades to a full Engineering Analysis -- testing, surveys, deeper data requests -- which is the stage that can end in a recall request. Closing with no action at all is also a normal outcome; opening a PE is closer to asking a formal question than reaching a conclusion.

The investigation is also the first real federal test of a device category that sits outside how NHTSA normally regulates driving automation: hardware a consumer buys and installs themselves, rather than a system an automaker ships, tests, and stands behind under its own name. Whatever NHTSA concludes about comma.ai's specific failure mode, the harder question the case raises is who is responsible when the safety-critical software running in a customer's lane-keeping camera was never reviewed by the company that built the car.