Who is liable when the car steers itself?
The self-driving car is no longer science fiction, it is already rolling on Swiss roads. Since 1 March 2025, Switzerland has had, with the Ordinance on Automated Driving (VAF)[1], a clear legal framework that for the first time expressly permits motorway pilots, driverless vehicles and automated parking. For once, the legislator was even faster than the industry; while the legal framework is in place, there are currently no series-production vehicles with an approved automation system on the market.
Regulation is developing rapidly not only in Switzerland but worldwide. EU directives, EU regulations and UNECE regulations are also binding on Switzerland. These international requirements ensure the technical harmonisation of road vehicles and promote road safety, environmental protection and the free movement of goods.

The following bodies of rules are particularly relevant for automated driving:
- Regulation (EU) 2022/1426[1] (in conjunction with Regulation (EU) 2019/2144[2] and Delegated Regulation (EU) 2022/2236[3]) on the type-approval of the automated driving system (ADS) of fully automated vehicles;
- the UNECE Regulations on cybersecurity (No. 155)[4], software updates (No. 156)[5], automated lane-keeping systems (No. 157)[6] and driver assistance systems (No. 171)[7]; and
- the Vienna Convention of 8 November 1968 on Road Traffic (SR 0.741.10)[8], in particular on the question of whether a driver must be present.
For companies, investors, fleet operators and mobility service providers, this new legal framework opens up considerable opportunities, but also demanding legal questions. We answer five of them below.
When does a car actually drive «by itself»?
Not every vehicle with an assistance system is an automated vehicle. The internationally established SAE J3016 standard distinguishes six levels of automation, from Level 0 to Level 5:

Automated driving only begins at Level 3: vehicles that can take over the driving tasks permanently and comprehensively, at least under certain conditions. Only the highest level, Level 5, is truly «autonomous» in the literal sense; today's systems technically reach a maximum of Level 3.
In Switzerland, three specific use cases have been permitted since March 2025:
1. the motorway pilot: drivers may take their hands off the wheel on motorways, but must be able to intervene again at any time when prompted by the system;
2. automated parking without a driver present in car parks signposted for this purpose; and
3. the operation of driverless vehicles on routes approved by the authorities.
What approvals and technical requirements are needed?
Vehicles with an automation system must meet special requirements going beyond the general requirements in order to be admitted. Under the general requirements set out in Art. 3 VAF, the system must guide the vehicle in the longitudinal and lateral directions, be intuitively deactivatable at any time, have functions for accident avoidance as well as safeguards against unlawful third-party interference, and master all traffic scenarios in accordance with recognised international rules. During operation, the system must take over the operation of the vehicle continuously, comprehensively and reliably, comply with all relevant traffic rules, detect technical malfunctions and indicate the need for human intervention with a sufficient time reserve (Art. 3 paras. 2 and 3 VAF).
The driving-mode memory is central (Art. 7 VAF): automated vehicles must record certain events (such as emergency manoeuvres, collisions or technical malfunctions), together with data elements such as the type of event, time stamp and position. In addition, for the entire supported operating period, manufacturers must hold valid certificates from a national type-approval authority for the management systems for cybersecurity (UN Regulation No. 155), software updates (UN Regulation No. 156) and safety for driverless vehicles under Regulation (EU) 2022/1426 (Art. 8 VAF).
Switzerland's approach to type-approval is noteworthy (Art. 11 et seq. VAF): Switzerland currently refrains from having its own type-approval provisions and instead recognises the requirements of the EU and UNECE. Automated vehicles that are to be admitted here therefore require a foreign type-approval; ASTRA (the Federal Roads Office) merely carries out random conformity checks. Manufacturers and importers of driverless vehicles must report safety-relevant incidents to ASTRA, and ASTRA may declare new provisions applicable to vehicles that have already been admitted, for instance in the event of a hacking attack (Art. 6 VAF). Operation is thus strongly tied to approval and operating conditions: driverless vehicles require cantonally approved routes and must be supervised by operators from a control centre.
What happens to the recorded data?
Automated vehicles must be equipped with a driving-mode memory (colloquially a «black box») that records events such as the start and end of emergency manoeuvres, system failures, collisions, and the activation and deactivation of the automation system. The processing of this data is subject to strict conditions: under Art. 25g para. 3 SVG, the data may be read out and processed by the competent police, judicial and administrative authorities exclusively for the purpose of investigating accidents or assessing traffic-rule violations.
Manufacturers and importers of driverless vehicles and of vehicles with an automated parking system must report safety-relevant incidents to ASTRA and must agree with the vehicle keepers or the operators of approved parking areas on how the necessary information is to be obtained. Operators of car parks offering automated parking must also notify the police in the event of an accident. Data protection and controlled access to this driving data are therefore a central and legally sensitive building block of the new regime, especially for fleet operators and mobility providers that process large volumes of data.
Who is liable when the software steers?
If a person is harmed in an accident, in principle the insurer provides compensation first; only afterwards is it clarified who was actually responsible. The key point: despite technical autonomy, the vehicle keeper remains liable under the causal liability of Art. 58 SVG, a no-fault, risk-based liability. In an accident involving an automated vehicle, three levels of causation ultimately come into consideration:
- the manufacturer (for instance in the case of software or sensor faults under the Product Liability Act);
- the driver (if they were steering themselves at the time of the accident); or
- the keeper (for example in the case of inadequate maintenance).
Legally, this is so intriguing because the allocation of risk shifts noticeably: from the driver to the system function, from the classic driving error to a product, software or maintenance defect, from pure SVG liability towards questions of recourse, product liability and evidence, and from the visible course of the accident towards the evaluation of technical data. Whether the human or the system was in control at the time of the accident can be traced through the driving-mode memory. The evaluation of this data thus becomes decisive for asserting recourse claims. For manufacturers, importers and operators this means a potentially higher liability risk; and for all parties involved, the urgent need to settle the contractual allocation of risk cleanly at an early stage.
What role does cybersecurity play?
A self-driving vehicle is essentially a rolling computer, and thus a potential target for cyberattacks. Cybersecurity is therefore not merely a peripheral technical issue, but a load-bearing element of the approval regime. Manufacturers must hold valid certificates for their cybersecurity management system under UN Regulation No. 155 and for their software-update management system under UN Regulation No. 156, and this for the entire supported operating period of the vehicle. The aim is to prevent external attacks and to avoid failures and malfunctions.
The regulation also takes account of this risk dynamically: ASTRA may even declare new provisions applicable retrospectively to vehicles that have already been approved and put into circulation, for example when certain vehicle types are affected by a hacking attack (Art. 6 VAF). For companies, this means: cybersecurity is not a one-off approval hurdle, but an ongoing legal and organisational obligation throughout the entire life cycle of the vehicle.
Conclusion
Self-driving vehicles will fundamentally change mobility, and in Switzerland they are already a reality. In Zurich's Furttal, the Swiss Transit Lab, the cantons of Zurich and Aargau and the SBB (Swiss Federal Railways) are deploying self-driving vehicles in the «iamo» pilot project (intelligent automated mobility); following approval by ASTRA, they are for the first time travelling in automated mode on public roads, and the public should be able to use the service in the first half of 2026[10]. Level 5 vehicles do not yet exist, but development is advancing quickly, and it is foreseeable that full automation will follow in the not-too-distant future.
Automated mobility is opening a new frontier of opportunity for investors, developers and operators, and with it a set of questions that deserve early attention: approvals and admission, liability and recourse risks, data access and data protection, and the allocation of risk between manufacturers, importers, operators and users. Addressing these questions early is what turns a promising technology into a sound, long-term investment.
This is precisely where TND Universe adds value. With expertise spanning real estate, mobility and energy, and a commitment to sustainable development, transparency and long-term investment integrity, we help clients evaluate, structure and realise automated-mobility opportunities across their full lifecycle, from initial due diligence through to operation and value creation.
Talk to us. Whether you are looking to invest in, develop or operate automated-mobility solutions, our team can help you navigate the risks and unlock the opportunities of this fast-evolving field. Contact us for a non-binding initial conversation.
Sources
[1] AS 2025 50 - Ordinance of 13 December 2024 on Automated Driving (VAF) | Fedlex
[2] Implementing Regulation - 2022/1426 - EN - EUR-Lex
[3] Regulation - 2019/2144 - EN - EUR-Lex
[4] Delegated regulation - 2022/2236 - EN - EUR-Lex
[5] UN Regulation No. 155 — Uniform provisions concerning the approval of vehicles with regard to cyber security and cyber security management system [2025/5]
[6] UN Regulation No. 156 - Software update and software update management system | UNECE
[7] UN Regulation No. 157 - Automated Lane Keeping Systems (ALKS) | UNECE
[8] UN Regulation No. 171 — Uniform provisions concerning the approval of motor vehicles with regard to Driver Control Assistance Systems (DCAS) [2024/2689]
[9] SR 0.741.10 - Convention of 8 November 1968 on Road Traffic (with annexes) | Fedlex
[10] iamo – intelligent automated mobility; Pilot project «iamo» on automated driving in the Furttal | Canton of Zurich
