Uber says 2,000 robotaxis are coming to Europe. No European permission lets even one of them pick you up.

The reported version is that Europe is getting two thousand robotaxis. Uber and the Chinese autonomous-driving company Pony.ai said on Thursday they would deploy more than 2,000 driverless cars across five European cities, and the coverage rounded that into the obvious headline: the robotaxis are coming, the Chinese ones, at scale, to a continent that has mostly watched the technology from the far side of the Atlantic. Read the announcement against what actually licenses a car to carry a paying passenger on a European street, and a narrower, more precise thing is true. What the two companies published is a commercial plan. What exists today is one paid driverless service, in one city, under one country's permission. The distance between those two facts is not a detail. It is the entire regulatory story, and almost none of it runs through Brussels.

So the useful question is not "are the robotaxis coming" — the plan is real, the money is real, and Pony.ai already runs fully driverless fleets in China's four largest cities. The useful question is the boring one a lawyer asks: what does a company actually need in hand before a car with no driver can pick up a stranger in Munich or Madrid, who issues each of those permissions, and which of them exists yet. The answer is that a robotaxi needs three separate documents, from three different authorities, and only the first of them is in any sense European. The second is being written city by city. The third has not been written at all.

Three documents, not one

It helps to separate what the single word "approval" is hiding, because in a driverless deployment it is doing the work of three distinct legal acts, and people who follow this story keep collapsing them into one.

• Type-approval — the certificate that says this model of vehicle may lawfully exist on the road at all: that its brakes, its software, its sensors and its automated driving system meet a defined safety standard. This is the part Europe has actually legislated, and even here only partly.
• An operating permit — the separate permission to run a specific service, with no human in the driver's seat, on specific streets, carrying paying passengers. This is granted nationally and often municipally, case by case, and it is what turns an approved vehicle into a business.
• A security and data review — the question of what a sensor-laden, always-connected car built by a company subject to a foreign government records as it drives, where that data goes, and who, in an emergency or a dispute, can reach into the fleet and change what it does. At European level, for connected vehicles, this document essentially does not yet exist.

Collapse those three and "Europe approved 2,000 robotaxis" sounds like a single decision taken somewhere central. Keep them apart and you can see that the announcement clears the first hurdle in principle, faces the second five separate times, and does not touch the third at all — which is precisely the order of importance running backwards.

What the European text actually gives them

Europe did write rules for the car itself, and they matter. The parent statute is the General Safety Regulation, and under it the Commission adopted, back in 2022, the first binding technical framework anywhere for the type-approval of fully automated vehicles — cars designed to drive with no one at the wheel. It sets out how such a vehicle's automated driving system must be assessed before it can be placed on the market: the testing procedure, the cybersecurity requirements, the event-data-recording duties, the monitoring and incident-reporting a manufacturer has to maintain once the cars are running. It was, genuinely, ahead of the rest of the world in existing at all.

Read the operative limit, though, and you find the word that constrains the whole thing: series. The 2022 framework opens the door to approval in limited series — small, defined fleets — not to the unlimited, whole-market type-approval that lets a carmaker stamp out an ordinary hatchback by the million and sell it in every member state on one certificate. Full, EU-wide, unlimited type-approval for driverless vehicles is still being drafted; the Commission has signalled a broader framework and a set of "regulatory sandboxes" and automated-driving corridors opening through 2026, and the trade press describes a unified system arriving "by 2026" the way it has described one arriving by every recent year. In force, for a limited fleet, under conditions; not the finished, harmonised regime the phrase "European approval" implies. A company can build a compliant car under it. What the car may then do is somebody else's decision.

The permit is national, and "five cities" means five processes

That somebody is each member state, and often each city inside it. This is the part the headline flattens completely. There is no European licence to run a driverless taxi service. The permission to operate a fleet with no safety driver, on public roads, for hire, is granted under national law — and the national laws are not the same law. Germany passed its own autonomous-driving statute and stood up an approval process for driverless operation ahead of most of the continent, with its own conditions and its own supervising-authority requirements. Croatia issued the permission that put Pony.ai's cars on the streets of Zagreb this spring, in a service run with the local operator Verne and billed, accurately, as Europe's first commercial robotaxi service. Those are two different legal orders, two different regulators, two different sets of conditions attached to the same underlying car.

So "more than 2,000 robotaxis across five European cities" is, in regulatory terms, not one approval but up to five, sought from up to five authorities, under up to five national frameworks, each free to attach its own conditions — a remote-supervision requirement here, an insurance floor there, a geofenced operating area, a data-localisation clause, a cap on fleet size until a safety record accumulates. The companies named exactly one of the five cities, Zagreb, because it is the one where the permission already exists. The other four they declined to name, and said the rollout would be "revealed in phases." That phrasing is not coyness. It is an accurate description of a process in which each city is its own negotiation, on its own timetable, and none of the four is finished. The structure that Uber's autonomous-mobility chief described as "moving from individual launches to repeatable commercial scale" is the honest one; the thing that is not yet repeatable is the permission underneath it.

The safety sheet is European. The permission to carry you is national. The review that asks what the car records is nobody's. — On the three documents a driverless fleet actually needs

The document that isn't there

Now the third document, the one that is missing, and the reason its absence is the real news. A modern robotaxi is not only a vehicle; it is a permanently connected sensor platform, mapping the street in high resolution, logging where it goes and when, and reachable over the air by whoever operates its software stack. Pony.ai is a Chinese company. Under China's National Intelligence Law, Chinese firms can be compelled to assist and cooperate with state intelligence work, and to keep that cooperation secret. That is not an allegation about Pony.ai's conduct; it is a fact about the legal environment its parent operates in, and it is exactly the fact that European connected-vehicle rules have not yet been written to address.

The gap is not hypothetical, and Europe already has the cautionary examples in hand. A Norwegian public-transport operator disclosed this year that Chinese-made electric buses in its fleet could be remotely disabled by the manufacturer over the mobile network — a capability nobody had reviewed before the buses were bought. Poland moved to keep Chinese-made vehicles away from certain military sites. Several member states long ago walled Chinese suppliers out of their 5G networks on the same reasoning. And across the Atlantic, the United States has already finalised a rule under its ICTS authority that effectively bars Chinese-developed connected-vehicle software and hardware from American roads on national-security grounds. Europe has the analysis — the Commission has run a cybersecurity risk assessment of connected cars, and the EU Data Act singles vehicles out as a category — but it does not yet have the binding instrument. Brussels is seeking a power comparable to the American one, the authority to require member states to restrict high-risk vendors in the connected-vehicle supply chain. Seeking is not the same as having. As the law stands, no European authority conducts a mandatory security review of a foreign-built robotaxi before it is allowed to log a city's streets, and no single office decides who may read what it records.

The Brussels Effect, running backwards

There is a pattern to how European technology rules normally travel, and this deployment inverts it. The usual sequence is that Brussels writes a binding term first — a data-protection standard, a content-labelling duty, a gatekeeper obligation — and because no company builds a separate product for one market, that European term quietly becomes the global default. The rule leads; the market follows. On robotaxis the sequence is reversed. The market is arriving first, city by city, under permissions granted in national capitals, while the two rules that would matter most — a harmonised deployment regime and a connected-vehicle security review — are still drafts and ambitions. Europe wrote the safety sheet for the vehicle and left the terms on which a foreign-built driverless fleet actually meets Europeans to be set in city halls, one negotiation at a time, or not set at all.

That is a strange place for Europe to be, because it is the opposite of where it is comfortable. The bloc's whole regulatory advantage is that it writes the binding term before the technology scales, so that the default is European by the time anyone notices. Here the technology is scaling into the gap ahead of the term. Each city that signs a permit sets a precedent the next city's negotiators will be shown; each fleet that runs without a security review makes the review harder to demand later, because the counterfactual — the disruption of unwinding a working service — grows with every car added. The permissions being granted now are not just permissions. They are the de facto standard, assembled in the absence of the de jure one, and whoever moves first in that vacuum tends to set its shape.

The date that is actually load-bearing

The load-bearing moment, then, is not Thursday's announcement. It is two things still ahead. The first is the day a second national authority — after Croatia — signs a paid, no-safety-driver operating permit for this fleet, because that is when "five cities" starts converting from plan into the repeatable permission the companies say they want, and when the terms attached to that permit reveal how seriously each capital is taking the questions Brussels has not answered. The second is whether the Union stands up its connected-vehicle security power before the fleet reaches a scale that makes the power politically unusable. A rule that arrives after two thousand cars are already logging European streets is a commitment; a rule that arrives before them is a constraint, and the difference between the two is measured in months that are passing now.

None of this means the robotaxis will not come. They probably will; the technology works, the economics in Pony.ai's home cities are said to have reached break-even, and a continent short of drivers and long on congestion has real reasons to want them. It means only that "Europe is getting 2,000 robotaxis" describes an intention, not a permission — that the car is approved in principle, licensed in one city, and vetted for what it records nowhere. The announcement was the easy document. The two that decide who controls a fleet of foreign-built, always-connected cars on European roads, and who gets to read what they see, are the ones still unwritten, and they are the ones worth watching for.