Ten Times Safer

A review of Families for Safe Streets’ AV framework

Before we begin with today’s discussion of safety and driving automation, let me note that I’m about to participate in a busy few weeks of real-time conversations on the same subject.

On 16 July I'm joining the Parking Reform Network to discuss what cities should want from automated vehicles. On 21 July I'll be at the 2026 Toronto Robotics Conference, on a panel asking whether robotaxis really are safer than humans. And on 23 July I will host Aurora's Chief Safety Officer, Nat Beuse, on the next Changing Lanes Live, for a discussion of freight automation and safety.

I hope to see readers at all of these events! Please follow the links to register.

---

How safe is safe enough? If we’re going to regulate driving automation, we must have an answer to this question.

Let’s put it simply. Choose a metric for road safety: candidates might be ‘collisions with another vehicle’, ‘collisions with a pedestrian or cyclist’, ‘collision with anything at all’, ‘incident causing death’, ‘incident causing serious injury’, or ‘incident of any sort that required a police report’. For a given period, an automated-driving system (ADS) will be involved with a certain number of such collisions or incidents.

The question is: what is the target number, such that, if an ADS falls below that target, we can consider it safe to deploy; and if it falls above, we do not?

A lot is at stake. If we pick a target that’s too high, the ADS will cause incidents that wouldn’t have happened otherwise. But if we pick one that’s too low, human drivers will cause incidents that an ADS would have avoided.

In June 2026, Families for Safe Streets (FSS) offered their own answer to the question. FSS is a national advocacy organization founded in 2014 by people whose loved ones were killed or seriously injured in traffic incidents. FSS’s answer was released as Safety First, Always: An FSS Framework for Autonomous Vehicles. At its centre sits a proposed certification standard the paper calls the Gain and Guard Rule: before full-scale commercial deployment, automated vehicles must be at least ten times safer than human drivers on average across everywhere they operate, and never worse than human drivers in any single operating environment.

In the spirit of disclosure: I contributed time and expertise to this framework as an outside contributor. Consequently, my name appears in the acknowledgements, and the FSS website hosts my explicit endorsement. As you read the following, please be aware that this is a review of work that I had a hand in, and that I want to succeed. Against this, the framework itself notes that acknowledgement as a contributor “recognizes contribution, but not necessarily endorsement of every statement or position”.

In that spirit, I will reveal my cards. I regard Safety First, Always as a serious effort to give regulators a public, measurable standard, and the Gain and Guard Rule is the kind of bar we need.

Having said that, I have two reservations.

Firstly, the framework’s moral core, the Guard prong, has a measurement problem the framework doesn’t solve… but fortunately, in my view the framework already contains the seed of a solution. Secondly, its liability proposal correctly borrows from the aviation sector, but doesn’t borrow enough.

Neither concern displaces my enthusiasm for what FSS has done here. I offer both reservations, and the first one especially, to help make the framework’s strongest idea enforceable.

A High Bar, but Not Too High

The rule’s plain-language version is that wherever it operates, an ADS must be at least ten times safer than human drivers on average wherever it operates (i.e., its operational design domains), and never worse than human drivers in any single area.

An operational design domain (ODD) is the set of conditions a system was built and is authorized to handle. It can consist of a defined geography, certain road types, certain weather, or certain hours. The easiest possible ODD might be “on a pre-mapped highway, during the day, with no clouds”. The hardest one would be “everywhere”.^¹

The Gain prong demands a tenfold reduction in fatality, injury, and crash rates (as an exposure-weighted average) across all a system’s authorized ODDs. The Guard prong forbids performance within any single ODD that is worse than human driving.

The point of the Gain prong is to demand order-of-magnitude improvement overall, while the point of the Guard prong is to prevent ‘gaming’ of that demand. In the latter’s absence, an unscrupulous firm might point to their strong performance on average while concealing dangerous performance in particular conditions, or neighbourhoods.

To see why this matters, consider the benchmark it replaces.

The dominant standard in automated vehicle (AV) governance, embedded in UNECE working documents and Britain’s Automated Vehicles Act 2024, and echoed in the academic and industry benchmark models cited in American AV safety cases, is that an ADS should drive as safely as a “competent and careful” human. That sounds reasonable until you remember what human driving produces: in 2023, that was more than 40,000 deaths and roughly 2.4 million injuries on American roads. As Prof. Bryant Walker Smith, my guest on a recent episode of Changing Lanes Live, puts it: I am concerned about automated driving, but I’m terrified of human driving.

The first question to ask about this is whether asking for 10x improvement over a human standard is reasonable. Perhaps that’s expecting too much? To judge by the performance of the industry leader, it is by no means expecting too much: at time of writing, Waymo’s safety data hub reports, across more than 220 million driverless miles, 94% fewer serious-injury crashes and 82% fewer injury-causing crashes than human benchmarks in the same cities. A peer-reviewed study with the reinsurer Swiss Re found comparable reductions in bodily-injury liability claims. And Waymo is performing so well in conditions that, far from being cherry-picked, are among the most difficult: dense, high-interaction city streets, full of pedestrians, cyclists, and unpredictable human drivers.

It’s worth reflecting on the fact that Swiss Re was Waymo’s partner in this exercise. It’s a reinsurer, a firm whose whole business is pricing risk with its own capital. As such, it has ‘skin in the game’ when it assesses those safety numbers. Put more formally, its assent is a costly signal that the claims are trustworthy. That’s why I’m more sanguine about these figures than other researchers, or Safety First, Always seems to be, with its calls for independent verification. Let’s set the disagreement aside, and stipulate for now that Waymo’s safety record is true.

If so, it means that FSS has set its floor at a level that at least one company in the sector has already reached. If Waymo’s numbers are real, the Gain prong costs Waymo nothing except the freedom to backslide, and it requires Waymo’s competitors to clear the same bar. If they can’t, that means the standard is working as intended. When FSS asked me to comment on the framework, this is one point that I made: regulators will know they have the right bar if they can offer one which some systems clear, but others can’t.

The strongest objection to the ten-fold threshold is that it asks too much. An academic framing of this claim comes from RAND; in 2017, researchers at that firm modelled deployment policies and found that waiting for nearly perfect AVs costs lives. Putting vehicles on the road when they are merely somewhat better than humans saves more people over thirty years than holding out for 75% or 90% improvements. This is a formal phrasing of the plain-language argument I often hear from intelligent laypeople: once driving automation is even a hair better on average than a human driver, the smart play is to move immediately to full deployment, because otherwise you are losing lives on net.

Safety First, Always has an answer to this, which is a staged certification pathway. As per this proposal, systems that don’t yet reach the 10x level may still operate in public, but must do so through supervised stages, with example thresholds of 2X and 4X as permissible for pilot projects. The full Gain requirement is reserved for full-scale commercial deployment. There are still opportunities for lives to be saved on net, just in bounded circumstances, and AV firms are still able to practice in real environments, to improve and gain the opportunity to reach the 10X level.

This is also Safety First, Always’s reply to the worry that a floor that only the incumbent clears is a moat, using early gains in safety to lock in a de facto monopoly. The 10x floor governs full commercial scale, while the supervised 2X and 4X stages keep a path open for challengers, and competition.

The Guard Prong’s Problem

The Guard prong is the framework’s moral core. It exists so that a company cannot buy a glowing citywide average with excellent freeway performance, while at the same time offering something worse than the status quo to some subset: a particular district, or time of day, or group of people (say, people in wheelchairs). That concern is valid, and I have written, on several occasions, about it; this behaviour is one that even Waymo has seemed to engage in.

Safety First, Always seeks to solve the problem, while adding a requirement I haven’t seen stated so directly elsewhere: demonstrated detection parity across skin tones, ages, body types, and mobility devices, treated as a condition of certification rather than an aspiration, and grounded in documented disparities in pedestrian-detection research.

I acknowledge that this is an important bar we must insist be cleared. That’s why I am surprised that, in this context, the framework does not make the obvious move of saying that AVs must, as I once argued in Asterisk, use multiple sensor types rather than cameras only. That idea is gestured at here, but only as a fail-safe design principle (to prevent one sensor malfunctioning from leaving the vehicle ‘blind’) rather than a way to ensure all vulnerable road users are protected. I would have placed the multi-sensor rule in the vulnerable-road-user argument, and not merely the redundancy one.

Quibbles aside, my concern is that the Guard prong is easier to state than to implement.

That’s because fatal crashes are rare events. Yes, 40,000 Americans die on the roads (on average) each year, but that number must be put in the context of just how much Americans drive: American roads produce roughly one death per hundred million vehicle-miles. This means that, to be confident that an ADS is safer than average requires it to have been tested for many hundreds of millions of miles, into the billions.

The Gain prong survives this because it aggregates; it takes exposure-weighted averages across all ODDs, measured on the more frequent currencies of injuries and crashes as well as deaths. Waymo’s record to date excels on this requirement. The Guard prong, by design, disaggregates, looking into smaller and finer individual operating domains. Waymo’s record is no answer here. As an aggregate, exposure-weighted claim on the frequent currencies of injuries and crashes, the data does not offer a per-ODD fatality claim.

The problem, as I see it is that the smaller the dataset, the more chance plays into the matter: given a small enough set, one cannot confidently distinguish a genuinely worse-than-human ADS from one that was merely unlucky. That means that the Guard rule could take us into a bad equilibrium, where one incident in a small domain disqualifies the entire ADS everywhere. The equal-but-opposite failure would be to dismiss any such incident in a narrow ODD as noise rather than signal. Preventing these bad equilibria depends on defining the ODDs just right. The framework calls for regulators to shoulder this responsibility, and I don’t envy them the job.

Fortunately, the task need not be improvised fifty times over. Defining ODDs is exactly the kind of scarce technical work the framework’s own proposed interstate compacts exist to pool: the first product of such a compact should be a shared, pre-registered ODD taxonomy, with agreed minimum sample sizes before any single domain’s record is treated as signal rather than noise. Standardize the denominator once, centrally, and the Guard prong stops depending on each jurisdiction guessing right on its own.

Conversely, the regulator tasked with implementing Safety First, Always is gifted with a strong enforcement framework, the ‘Lawful AV’: a tiered system of regulatory triggers, review, then suspension, then revocation, for persistent unlawful behaviour, even when no crash results (think passing stopped school buses or blocking crosswalks). Safety First, Always takes the view that safety should not just be measured in death or injuries, but in behaviours that tend to promote these things. That’s table stakes in aviation: airlines can face mandatory reporting, review, and suspension or revocation of license to operate for regulatory violations, even those where there’s no incident. The framework argues that AVs should be regulated the same way.

I’m all for this, because this rule is empirical: it counts observable events against defined thresholds, rather than estimating rare-event rates. I think that this is the repair the Guard prong needs. As written, the Guard prong asks whether an ADS is worse than a human at causing death within a single ODD, which our data is insufficiently detailed to answer. Worse, the question gets harder as AVs get better: the safer the vehicles, the rarer the fatalities, and the larger the sample you would need to prove anything at all. The way out is to put the Guard prong on the same footing as the Lawful AV rule, i.e., to judge each domain on the metrics of injuries, crashes, insurance claims, and unlawful-but-harmless behaviours.

One might object that the Guard prong is left un-operational on purpose. FSS is a coalition of the bereaved, and no one can expect it to offer a document that translates ‘never worse’ into an acceptable per-neighbourhood death rate. If that is their view, I am entirely sympathetic. But a regulator is entitled to reply that a target no one can measure is a target that protects no one. Giving the prong something it can count is what will give the moral argument teeth.

If We’re Going to Copy the Aviation Sector, Let’s Go All the Way

Safety First, Always also looks to aviation regulation to help solve the most vexed problem in the AV space, namely liability.

FSS members know all too well that today’s road-incident victims routinely spend years in fault litigation before receiving compensation. That’s bad enough, but the advent of vehicle automation is poised to make it worse by multiplying the defendants, from manufacturer only to a host of suppliers (sensors and mapping most obviously, but also fleet operators, chips, wireless Internet, and on and on.) The paper’s answer is a two-tier structure with an honourable lineage running through the Montreal Convention and Wansley’s The End of Accidents: automatic strict liability up to a defined threshold, no proof of fault required, with presumed but rebuttable company liability above it.

This is the right position, one that I have advocated for myself. As Safety First, Always puts it, people harmed by AVs should not face higher barriers to compensation than airline passengers, where liability is predictable and capped. This approach is preferable to endless litigation, which is bad for victims, and to ‘jury roulette’, which is bad for firms. There is even a plausible legislative bargain to get there (though the framework doesn’t spell it out): strict AV firm liability, traded against some form of certainty on damages that can be claimed.

FSS proposes a pooled industry-compensation fund, financed by the full range of AV companies that would pay victims immediately while the companies sort out cost allocation afterward. While Safety First, Always argues this is aviation-inspired, I think they are mischaracterizing it: in that sector, liability is carrier-by-carrier, backed by mandatory insurance, rather than mutualized across the industry. There’s good reason for this: unless contributions are sharply risk-rated, the safest operator ends up subsidizing the crashes of the worst one. In the AV industry today, there is quite a spread between the most- and least-safe operators (I’ll forbear from naming names); a market-share-financed pool is an invitation to moral hazard.²^[2] As such, the proposal sets itself up to receive the stiffest opposition from the safest operators, which would be a perverse outcome.

Although it doesn’t say it, I suppose that the framework is drawing upon a different industry when thinking about risk, namely nuclear. The Price-Anderson Act has run the American nuclear industry on this model for seventy years: a mandatory, industry-wide pool that pays victims first and allocates fault later. That regime was put in place because no single operator could carry the tail risks of a high-consequence, immature technology alone. Unfortunately, nuclear operators are judged against a risk-rated formula, into a small, homogeneous, heavily-inspected industry. The AV field is none of those things.

There is also the question of feasibility, and of venue. A statutory compensation fund requires legislation, and the paper concedes liability rules “may ultimately need to be federally established,” which is awkward at a time that, as I pointed out in Reason, Congress is failing to agree on AV oversight, and the regulator is withdrawing voluntary safety oversight programs. The nearer-term market is the states, which are already writing AV law. To its credit, the framework knows it: everything in it is framed as a floor adoptable at any level, with interstate compacts proposed to pool scarce technical capacity.

How safe is safe enough? Safety First, Always offers an answer: ten times safer everywhere you operate, never worse anywhere. That is a concrete standard, one with real moral weight, as it’s offered by the people who have already suffered from the frailty of human driving. The real test of the framework is whether a single jurisdiction adopts it whole: Gain, Guard, and Lawful AV together. In that regard, I note that Transport Canada issues non-binding safety guidance and sets vehicle standards, while provinces control who may operate on their roads. Ontario might adopt the Gain and Guard Rule and the Lawful AV framework without waiting for Ottawa, and I would like to see it do so.

Respect to Abby ShalekBriski for comments on an earlier draft, and to the FSS team for letting me review the framework before publication.

1. “Everywhere” is equivalent to the SAE ‘Level Five’ category. Having an ODD of anything less than that, but not requiring human input within that ODD, is ‘Level Four’.

2. The framework suggests a fix, namely that contributions should reflect claims history and risk so that dangerous companies pay disproportionately, but that’s too slight an assertion to get credit, especially when a better alternative is at hand.