Last week the autonomous vehicle industry reached a significant milestone when the National Highway Traffic Safety Administration granted robotics company Nuro three exemptions to deploy its fully autonomous car fleet in the U.S.

While the U.S. Department of Transportation's approval marks a significant regulatory shift toward embracing fully autonomous vehicles, Nuro's R2X fleet is low-speed, small and solely for delivering goods. It's still unclear, therefore, how applicable the Nuro approval will be to fully autonomous, high-speed, passenger vehicles.

"The policy concerns and security concerns NHSTA needs to grapple with is very different than what they have to face when say GM is being faced with its exemption," said vice president of ML Strategies Christian Fjeld, a former Democratic Senate staffer that lead the AV START Act through the U.S. Senate.

"The value that traditional autonomous vehicles could glean is how they are not Nuro, and likely the bar they'll have to clear is likely higher," he said.

While Nuro may not apply to all, the auto industry may finally receive guidance on fully autonomous passenger vehicles—eventually. Last year the NHSTA formally announced it was considering General Motors' application for several federal motor vehicle safety standards exemptions for its passenger vehicles.

But for now, the Nuro approval provides some insights into NHTSA's thinking and potential best practices AV automakers should adopt, said Honigman data security and privacy litigation partner and co-leader Steven Wernikoff.

Indeed, when NHTSA granted Nuro's request for exemptions, it included requirements and governmental oversight the regulator admitted are not typically required for exempted vehicles. But given public interest in the "unique and novel design" of the R2X car, the Department of Transportation determined it was warranted.

The conditions for the exemptions include requiring Nuro to provide cybersecurity incident reports and shut down operations of R2X vehicles until a cyber incident that impacts safety is resolved. Additionally, Nuro must send all incident-related information and data about R2X's operations and its automated driving system to NHSTA.

Wernikoff said the requirements are useful for obtaining approval from NHSTA, even if the autonomous vehicle isn't identical to the R2X.

"Even if it doesn't apply specifically to the design of the vehicle they're planning to put out, it's an extremely useful guidance of what the likely requirements would be for the company to release an autonomous vehicle," he said.

Likewise, such reports help regulators collect ongoing data from the AV industry to better understand the industry and develop rulemaking that is grounded in good data, said Jones Day of counsel Dean Griffith.

"One of the benefits of the exemption world is that it helps the agency to get data for down the road as it looks to regulate or put in place a set of standards for autonomous vehicles," said Griffith.

Although the exemption process is lengthy, Nuro applied for exemptions in 2018, lawyers say it's the fastest route to get fully autonomous vehicles on U.S. roads.

"That [federal rulemaking] is going to take a long time and so it seems more likely that the guidance and progress will come from these case-by-case exemptions," Wernikoff said.