Waymo found the defect, filed the recall, and shipped the fix. The regulator's job was to receive the paperwork.

Read the Waymo recall the way it was written to be read and it is a reassuring little story. A self-driving company noticed its cars were doing something wrong near freeway construction zones, told the regulators, pulled its robotaxis off the highway, and is shipping a software fix. No crashes. No injuries. The system worked. That is the version in most of the headlines, and every fact in it is true.

I want to point at the structure underneath those facts, because it is the actual news and almost nobody is saying it plainly. In this entire sequence — detect the problem, define it as a defect, decide the remedy, restrict the fleet, validate the fix, declare it solved — there is exactly one party. Waymo found the defect. Waymo filed the recall. Waymo restricted its own cars. Waymo is writing the fix and Waymo will decide when it worked. The federal regulator's role in this story is to receive the paperwork.

That is not a safety story. It is a sovereignty story, and the recall is the moment it became visible.

What actually happened

The specifics matter, so here they are. Waymo filed a voluntary software recall covering 3,871 vehicles that run its fifth-generation driving system. The trigger was a pattern: under certain conditions the cars could enter, and keep driving at speed through, freeway construction zones — because the software was either failing to recognize the closure or weighting the avoidance of other hazards over the closure in front of it. Thirteen known incidents, six around Phoenix in April and seven in the San Francisco Bay Area in May. Nobody was hurt. Waymo says it restricted freeway operations while it makes improvements, notified state and federal regulators, and chose to file the recall with the National Highway Traffic Safety Administration.

Note the verbs the company reaches for: 'voluntarily restricted,' 'proactively notified,' 'decided to file.' Every one of them is an act of choosing. That is not an accident of phrasing. It is the most accurate description of where the power sits, and Waymo is telling you, in its own press language, exactly who is in charge.

This is also the fourth such recall in about two years. A 2025 recall followed more than a dozen incidents of the cars hitting stationary barriers; another followed robotaxis in Austin failing to stop properly for school buses. A pattern of four is not, by itself, an indictment — it might mean the company is finding and disclosing things diligently. But four iterations of the same loop is enough to see the loop's shape. And the shape is what I want to talk about.

The word doing the heavy lifting is 'voluntary'

A recall, as a legal instrument, was built for a different world. The framework comes from 1966, designed for physical defects in physical cars — a faulty ignition switch, a brake line that corrodes — where the remedy was to notify owners and bring the vehicles into dealerships to have a part replaced. The regulator could, in principle, inspect the part. It could take a defective car apart on a bench. The defect was a thing in the world, and the world is something a regulator can examine.

Almost none of that maps onto what just happened. The defect here is not a part; it is a judgment the software made about how to weigh one risk against another. The owner who gets 'notified' is Waymo. The fix is not a component swapped at a dealership; it is a model update Waymo writes, tests against its own simulations, and pushes to the fleet over the air, possibly before most of us read the recall notice. There is no part to inspect. There is no bench. The only place the defect and its remedy fully exist is inside Waymo's own systems, visible to Waymo's own engineers.

A regulator that can only receive voluntary disclosures isn't a regulator. It's a mailbox with a logo. — Hannah Okonkwo

So 'voluntary' is not a modest, public-spirited adjective here. It is the whole architecture. The company discloses because it chooses to, defines the problem because only it can see the data, and certifies the cure because only it holds the evidence. NHTSA is not in a position to independently know whether 3,871 cars drive into construction zones, or whether they've stopped, except by what Waymo measures and reports. A regulator that can only receive voluntary disclosures is not regulating. It is keeping records of decisions made somewhere else.

The information asymmetry is the power

Strip the institutions back to who knows what, because that is always where power actually lives. Waymo's cars generate a continuous, total record of their own behavior across every mile driven. Waymo can see the thirteen incidents, the conditions that produced them, the near-misses that didn't make the count, and the precise change in the model that does or doesn't fix them. The regulator can see what Waymo sends. The riders can see nothing. The public can see a press statement and a number.

When one party holds the only complete dataset, every other party's role collapses into trusting that party's summary of it. That is true of the regulator. It is true of the journalist. It is true of you in the back seat. The recall didn't create that asymmetry — it revealed it, by showing us the one moment when the company's private knowledge has to surface into a public form, and showing us how little of it actually has to surface. A filing. A vehicle count. A sentence about construction zones. The dataset that would let anyone check the company stays inside the company.

And here is the move that should bother you most, because it is the quietest: the definition of 'fixed' belongs to the same party that holds the data. A software recall closes when Waymo decides the update works, judged against Waymo's own simulations and Waymo's own fleet telemetry. There is no outside referee with the access to say otherwise. 'Fixed' is not a public fact in this system. It is a corporate conclusion the rest of us are invited to accept.

Let me concede the strongest version of the other side

I'll argue against myself now, because the counter-case is real and I have been on its side before. I was, for a while, fairly relaxed about exactly this arrangement — my old view was that a company with this much liability exposure and this much to lose from a fatal mistake has every incentive to be careful, and that careful is what matters. So I owe the argument a fair hearing.

It goes like this. Waymo's safety record is, by the available evidence, genuinely good — these incidents produced no injuries, and across millions of miles the system may well be safer than the distracted, tired, occasionally drunk human drivers it replaces. The disclosure was responsible; the company didn't hide the pattern, it surfaced it. And the over-the-air fix is not a weakness of this model but its great strength: a software recall can repair an entire fleet in days, where the 1966 version left dangerous cars on the road for months while owners ignored the postcard. By every outcome measure, this went well. Why am I complaining about a process that produced a good result?

Because a good result produced by an unaccountable process is still an unaccountable process — it just hasn't cost us anything yet. Every one of those points is about Waymo's behavior, and I'm not disputing Waymo's behavior. I'm disputing the structure that makes Waymo's behavior the only safeguard. 'They're careful because it's in their interest' is an argument that works right up until the day a company's interest and the public's interest point in different directions — a bad quarter, a race to expand, a fix that's expensive to get fully right and cheap to declare done. The whole point of external accountability is that it doesn't depend on the watched party's mood. We are being asked to accept good intentions as a substitute for that, and good intentions are not a structure.

This is the template, not the exception

Zoom out, because robotaxis are just the first autonomous system to hit public roads at scale, and the precedent being set is general. The pattern — the operator holds the only data, defines the defect, ships the fix, and certifies its own cure, while the regulator maintains a filing cabinet — is the pattern we will inherit for every autonomous system that follows. Delivery robots. Long-haul trucks. The drones. Eventually the larger and more abstract autonomous systems we are busy building in software, the ones with no vehicle to recall at all. We are writing the governance template for machine autonomy right now, in these unglamorous NHTSA filings, and the template currently reads: the company that builds it is the company that judges it.

Distinguish, as always, the performance of accountability from the thing itself. The recall filing, the proactive notification, the careful press statement — these are the performance, and Waymo performs it well. They look like oversight. They are shaped like oversight. But oversight is a structural property: it requires a party with the power and the access to say 'no, that is not fixed, and here is our independent evidence.' No such party exists in this story. What we have is a company doing its own homework, grading it, and mailing the grade to an office that cannot re-mark it. That the grade has so far been honest is to Waymo's credit. It is not the same thing as the office being able to check.

Who decides when it's fixed

I am not arguing that Waymo is dangerous, or that nobody should ride a robotaxi, or that the 1966 recall was some lost golden age of accountability — it wasn't. I'm arguing that we have quietly answered an enormous question without noticing we were answering it. The question is: when an autonomous system makes a mistake, who has the authority and the access to decide whether it's been corrected? Right now the honest answer is the company that built it, using data only it can see, on a timeline only it sets, with a regulator whose strongest available verb is 'received.'

Fixing that is not mysterious, and it is worth naming so the gap is concrete: regulators with real-time access to fleet safety data, not quarterly summaries; independent authority to define and verify a remedy; the technical capacity to audit a model's behavior rather than read a company's description of it. None of that exists yet, and building it is genuinely hard, and the companies have no commercial reason to want it. So the vacuum gets filled by the only party standing in it. That is how power works when nobody is contesting it — not seized, just assumed, one voluntary filing at a time.

The cars are probably safe. That is not the part I'd lose sleep over. The part worth your attention is that we let the safest-sounding word in the whole affair — 'voluntary' — stand in for an accountability we never actually built, and we called the result a system working. It is a system working. The question that should keep regulators up at night is whose system, and on whose terms, and the recall just told you the answer in plain language. Everyone read it as good news. It is also a transfer of authority, and those rarely announce themselves as anything else.