NHTSA Investigates comma.ai's openpilot After Three Deaths

The National Highway Traffic Safety Administration's Office of Defects Investigation opened Preliminary Evaluation PE26007 on Sept. 21, 2026, naming comma.ai's comma three, comma 3X and comma four hardware along with the openpilot software that runs on it. The opening resume, signed off by investigator Neil Dold, covers an estimated 30,000 devices and five crashes in which vehicles running openpilot struck stopped or slow-moving vehicles in their own travel lane.

Two of those five crashes were fatal, killing three people combined. The other three injured 11 more, including some described as serious. ODI says it confirmed the comma system was powered on or engaged in multiple of the crashes, and that its early review of the data suggests openpilot "may not have adequately detected or responded to the in-lane vehicles."

The number that isn't the crash count

Five crashes and three deaths are the numbers that will travel with this story, and they are also not the number that decides what happens next. The number that matters is 30,000, the estimated population of comma three, 3X and four devices the investigation covers, set against a software recall mechanism that does not obviously exist for any of them.

A hardware recall is a known problem with a known fix: notify owners, replace or update the device, confirm compliance. comma's product is a $999 camera-and-compute unit that a buyer installs in about 15 minutes, according to the company's own marketing, quoted directly in NHTSA's resume. The driving logic itself, openpilot, is open-source software that anyone can fork, modify and run on the same hardware. If ODI ultimately finds a defect in openpilot's handling of stopped vehicles, the fix has to reach every copy of the code in circulation, not just every device comma shipped.

Where the five reports actually came from

ODI's own failure-report table breaks down who first reported each incident: one crash came through ODI's own monitoring, two arrived via early-warning data comma itself was required to file, and five came from other sources, including police reports and NHTSA's Standing General Order 2021-01 crash-reporting program. The manufacturer column reads zero.

1. ODI's own monitoring1 reports
2. comma.ai directly0 reports
3. Early-warning filings2 reports
4. Police reports, SGO data5 reports

Source: NHTSA ODI PE26007 opening resume, accessed Sept. 24, 2026

A company reporting zero of the crashes involving its own product, out of a total the agency confirms happened, is the kind of gap that shapes how the rest of a preliminary evaluation gets read: not necessarily concealment, but a company treating its own reporting obligation as a floor rather than a practice.

Three crashes, two dates a year apart, no consistent speed

Electrek matched four of NHTSA's five cited case identifiers to public Standing General Order data; the fifth, numbered 30351-1807, does not appear in the released datasets, which means the second fatal crash behind the resume's tally of three deaths cannot be checked against anything outside NHTSA's own count as of this writing.

Date	Vehicle	Speed at impact	Outcome
Feb. 2026, Ascension Parish, La.	2022 Toyota RAV4	Not disclosed	Fatal; struck a stopped first-responder vehicle
Sept. 2025, Missouri	2020 Honda Accord	82 mph	Serious injury; rear-ended a stopped car
July 2026, near Mona, Utah	2021 Toyota Corolla	56 mph	Struck a stopped passenger car

On the Louisiana crash, comma's own filing says the device "appears to have been running 3rd party non-comma software," the company's way of pointing at a fork rather than its own code. On the Missouri crash, Honda separately filed its own report noting the driver had set cruise control to 80 mph and fallen asleep, and that adaptive cruise control was "performed by Honda system," not comma's.

comma's answer to its own liability is "Unknown"

Every comma filing NHTSA cites opens with the same disclaimer: the company provides crash information "without agreeing with NHTSA's interpretations or conceding that comma is obligated to respond to the General Order." Asked whether a crash fell inside its product's operational design domain, comma answers "Unknown," arguing it does not manufacture the vehicle or the stock driver-assistance systems its device augments.

That stance sits awkwardly next to comma's own advertising, which the resume quotes at length: "hands free driving for the car you already have," a system that "[c]an drive for hours without intervention," installed with a "step-by-step guide" in 15 minutes. The same marketing, in the same paragraph NHTSA quotes it from, adds that "openpilot requires the driver to be alert, pay attention, and be ready to take over at all times." A product marketed on how little the driver has to do and defended on how much the driver was still supposed to be doing is not a new contradiction in this industry, but it is an unusually well-documented one here, because NHTSA put both sentences in the same resume.

The fork problem NHTSA is already anticipating

Openpilot's code underpins community forks including sunnypilot and FrogPilot, built on the same driving model and much of the same codebase. NHTSA's resume states directly that "to the extent that modified software based on openpilot (i.e., a 'fork') is involved in a crash or other incident," the agency will evaluate the incident and weigh the components shared between openpilot and the fork. That sentence exists because ODI can already see the defense coming: comma pointing at a fork, a fork's maintainer pointing back at the shared codebase, and 30,000 devices sitting in between with no single party positioned to push a fix to all of them.

This is not comma's first pass through NHTSA. The agency sent founder George Hotz a special order over the comma one in 2016, and rather than answer it, Hotz cancelled the product outright and open-sourced openpilot, then went back to selling the hardware as developer kits, the framing comma's marketing still leans on today. Ten years and three device generations later, that same open-source structure is what makes this investigation harder to close than a conventional defect case: DrivingBench's own test rig runs the same comma four hardware and openpilot stack comma sells retail, evidence that the code sits comfortably outside comma's own walls even in benchmark contexts nobody is claiming caused a crash.

What would change the read

A preliminary evaluation can close quietly, or escalate into an engineering analysis and, eventually, a recall. What that recall would consist of is the open question: an over-the-air patch comma controls, a mandated change to the openpilot repository maintainers cannot be compelled to accept, or something narrower aimed only at comma's own signed builds while forks continue unregulated. Agility Robotics' Digit humanoid faces a related version of this problem at a different scale: safety-critical autonomy sold ahead of the review process that would normally validate it, with the manufacturer setting the terms of what counts as compliance in the meantime. Whichever path ODI picks for comma will be the first real test of whether an open-source driver-assistance stack can be regulated the way a conventional car part can, and comma's own filings, so far, are arguing that it cannot.