Firms that build or implement AI cannot credibly certify it. We do not sell the driving system, the platform, or the tooling. We assess and we attest. Nothing else. Safety cases are self-certified. The company that builds the driving system writes the argument that the driving system is safe, then files it. Functional-safety assessors review the hardware and the wiring against ISO 26262 and ISO 21448. Nobody independently reviews the AI: the governance behind it, the data it learned from, or whether it behaves differently depending on who is in the road.

That gap is where the liability lives. When a vehicle causes harm, a plaintiff's lawyer, an insurer, a regulator, and a reporter all ask the same question. Who checked the AI? Today the answer is the company itself. The Cruise case showed where that ends: a sensor system that failed to detect a pedestrian under the vehicle, a twenty-foot drag, a report that left the dragging out, a half-million-dollar federal penalty, suspended permits, and leadership gone.

In June 2026, Reuters reported that a major carmaker allegedly showed European regulators exaggerated self-driving safety data to win approval. A European transport safety body's response was blunt: have the data independently verified by a qualified researcher first. The demand for independent verification is now coming from regulators themselves.