The U.S. government has issued its first rules for automated vehicles. They include a 15-point set of “safety assessment” guidelines for self-driving systems. These cover issues such as cybersecurity, black-box recordings to aid crash investigations, and potential ethical conundrums on the road.

The new policy will play a central role in shaping how autonomous vehicles proceed toward commercial use. Many automotive and technology companies are testing self-driving vehicles, and ride-hailing company Uber even lets customers in Pittsburgh order rides in prototypes (see “My Self-Driving Uber Needed Human Help”). But the cars in testing still need close human supervision.

Until now, the rules regarding self-driving vehicles have been hazy. Some states have created exemptions to encourage testing, while others have signaled that they might restrict autonomous vehicles. The new federal policy says that states will remain responsible for enforcing laws and regulations regarding human control of a vehicle.

The safety assessment announced by the U.S. Department of Transportation today asks makers of self-driving vehicles to explain how they are designed and how they operate. They will need to say how how a system has been tested, what fail-safes are in place, and how customers’ privacy is protected.

The Department of Transportation is trying to balance safety concerns about automated vehicles with a desire to encourage what promises to be a massive global industry.

Automated cars still struggle to cope with certain everyday situations, including poor weather conditions and complex traffic scenarios. In the case of partially automated systems, where a human and car share driving duties, it remains unclear how to ensure that drivers remain sufficiently engaged to safely take over when needed.

A driver died in a Tesla vehicle earlier this year when its automated highway driving system Autopilot did not detect a semi-trailer across the road ahead. The National Highway Traffic Safety Administration and National Transportation Safety Board are both investigating the crash. Tesla recently announced plans to improve the reliability of the long-range radar system on its cars.

U.S. Secretary of Transportation Anthony Foxx said today that the new policies would also apply to cars already on the road. On a conference call announcing the rules, he said that NHTSA would act to bring manufacturers in line if necessary. “We will not hesitate to use our recall authority when we have identified a defect that presents an unreasonable risk to safety,” Foxx said.

Foxx’s department is also considering creating new regulatory mechanisms that might help make self-driving vehicles safer. These could include forcing manufacturers to act to fix safety risks immediately, presumably via some form of software update. The department could also require that manufacturers collect certain kinds of data, or share information with each other to improve performance and safety.

“This is an emerging technology, and we expect that there will be an evolution in how we approach what we do,” Foxx said today on a conference call announcing the policy.

John Maddox, assistant director of the University of Michigan’s Mobility Transformation Center, says issuing guidance rather than specific rules is a good approach, because the design and capabilities of automated vehicles are still changing rapidly. “There’s still a lot of innovation to come, especially in how you validate the technology,” he says.