What happened
The United States National Transportation Safety Board reported that in March 2026 it completed investigations into two fatal crashes involving Ford vehicles operating with BlueCruise, its hands-free partial automation system. In both crashes, the vehicles struck stationary vehicles and three people died.
The board reported that the first crash happened near San Antonio, where a Ford Mustang Mach-E travelling at almost 75 miles per hour struck a stationary car, killing its driver. Days later in Philadelphia, another Mustang Mach-E travelling at more than 70 miles per hour struck two stationary vehicles in a work zone, killing two occupants. The board reported that in neither crash was driver applied or system initiated braking or steering recorded before impact.
The board found that overreliance on the automated system contributed to both crashes, although its probable cause findings were different. In San Antonio, the board found the driver’s failure to respond was due to distraction, likely from the in-vehicle navigation system, while the inability of the partial automation system, including automatic emergency braking, to detect and respond to the stationary vehicle was a contributing factor.
In Philadelphia, the board found the driver’s failure to respond was due to impairment from alcohol that may have been worsened by cannabis use, along with distraction likely from cell phone use, stemming from overreliance on and misuse of the system. The board also found contributing factors included travelling 27 miles per hour over the limit in a work zone and what it described as Ford’s inadequate integration of active speed management with the partial automation system.
It was reported that a Ford spokesperson said the company would take the board’s recommendations under serious consideration, and that the investigation found no quality defects or equipment failures in BlueCruise.
What an auditable version would have shown
The board reported that investigators did not have all the data they needed. There are no federal requirements for partial automation systems to record data during crashes, and the board said this can leave manufacturers without the information needed to meet existing crash reporting requirements. It can also leave regulators, investigators, law enforcement and safety groups without important information after a serious crash.
In this entry’s reading, the record should show what the vehicle and the system were doing in the seconds before impact. Whether BlueCruise was engaged, what the driver monitoring system was seeing, and when it last judged the driver to be paying attention. It should also show whether automatic emergency braking was enabled, what speed the cruise control was set to against the speed limit, what the forward sensors detected and how the system responded.
Without that record, investigators are left trying to reconstruct parts of what happened between the driver and the automation after the crash, when those details may matter most.
Where the gap was
In this entry’s reading, there are two separate issues here, what the system allows a driver to change, and what is recorded when something goes wrong.
The board reported that automatic emergency braking can be disengaged while hands-free BlueCruise is being used, and that intelligent adaptive cruise control can be set up to 20 miles per hour above the speed limit. The board did not find that either driver in these crashes changed those settings. In Philadelphia, it found a different problem, Ford’s integration of active speed management with the partial automation system was inadequate and permitted excessive speed, including in a work zone.
A ConstraintGate is designed to test an action against a declared standing rule before it takes effect. In this case, a setting that takes the system outside an agreed safety limit could be refused or require approval rather than simply taking effect.
A ConductRecord keeps the system state, the inputs and the decisions at the time they occur, so investigators can later see what was engaged, what was changed and what the system did.
ConstraintGate and ConductRecord are Headlights designs.
What governance should have looked like
The board reported six recommendations after the investigations. These included federal guidelines and performance standards, requirements for crash data recording and automatic crash notification, and changes to Ford’s driver monitoring and BlueCruise.
The board’s chair said the investigations showed an urgent need for stronger safety standards and better oversight, and that a hands off approach cannot be taken to hands-free driving technology.
Where a system is doing some of the driving while the person remains responsible, best practice would be to be much clearer about what the driver can change and what the system will allow.
Some settings should have limits, particularly where speed or another safety control is involved. Driver monitoring also needs to know more than whether someone’s face is pointed towards the road, because looking in the right direction and actually paying attention are not necessarily the same thing.
And when there is a serious crash, there should be a record. Whether BlueCruise was engaged. What the set speed was. What the driver monitoring system saw. Whether automatic emergency braking was available. What the vehicle detected before impact, and what the system did.
Those are fairly basic questions after a fatal crash. Investigators should not have to piece together the answers from whatever data happens to be available.
Failure Pattern: a partial automation system permitted drivers to disengage its automatic emergency braking and to configure its intelligent adaptive cruise control up to 20 miles per hour above the speed limit, its driver monitoring did not distinguish attention to the road from attention to an object blocking the view of it, and no federal requirement obliged the system to record relevant crash data.
Governance Principle: a system that keeps a person responsible for a task it is performing should enforce a defined safety envelope rather than allow safety critical limits to be configured away, and should record what it and the driver were doing in the moments before a crash so the sequence can be reconstructed from evidence.
The reference implementation of ConstraintGate and ConductRecord is open source. It lives at github.com/saffronandindia/headlights-oss, Apache 2.0 licensed and free to install. The repository is public now.
Sources
- NTSB finds automation overreliance contributed to two fatal Ford BlueCruise crashes (National Transportation Safety Board, 31 March 2026)
- Investigation HWY24FH006, San Antonio, Texas, with the published probable cause (National Transportation Safety Board)
- Investigation HWY24FH008, Philadelphia, Pennsylvania, with the published probable cause (National Transportation Safety Board)
- Highway investigation report HIR-26-02 (National Transportation Safety Board)
- Trade report carrying the manufacturer’s response and the recommendation count (Autobody News, 31 March 2026)