Integrated safety assessment
Crash performance, driving support, energy hazards, software integrity and rescue considerations are addressed in one assessment structure.
IAF Standards Programme
IAF AUTOSAFE
First Edition - Draft for Technical Review
Vehicle Testing, Assessment and Labelling System
Safety Measured. Scope Defined. Evidence Traceable.
Read the Full Working Draft
Assessment domains | A-F classification | Evidence requirements
A to F performance classification
Physical and digital safety considered together
Assessment linked to initial production configuration
Results accompanied by defined scope and evidence
The assessment architecture
What AUTOSAFE Is Designed to Deliver
AUTOSAFE is designed as a whole-vehicle assessment architecture. Its principles make the basis of a result visible, keep technical decisions separate from commercial relationships, and ensure that evidence remains tied to the configuration being assessed.
AUTOSAFE is an A to F classification system developed to assess an identified vehicle's initial production configuration through defined tests and verifiable technical evidence. It records performance within a stated assessment scope; it is not a promise of safety in every circumstance.
Scores cannot conceal critical failures
A high total does not compensate for failure of a mandatory safety condition or a required class-specific test.
Configuration-linked results
Coverage identifies the vehicle generation, equipment, software, energy system and production boundary to which a result applies.
Evidence for higher classes
Classes A and B require more than a higher total: they depend on additional released test conditions and acceptance limits.
Performance, not novelty
Terms such as intelligent, autonomous or next generation do not earn credit by themselves. Demonstrated safety performance does.
Change-triggered reassessment
Safety-relevant technical changes, not the calendar, determine when evidence or focused reassessment may be needed.
Traceable result records
Scope, method edition, evidence basis, class decision and any correction or restriction should be verifiable from one record.
Independent technical decisions
Testing, technical review and public class decisions are separated so membership, sponsorship or payment cannot improve a result.
A high total score should never hide a critical safety shortfall.
Twelve assessment domains
A Whole-Vehicle View of Safety
AUTOSAFE brings twelve connected domains into one proposed 1,000-point assessment structure. Each domain examines a distinct safety outcome, while mandatory gates prevent critical weaknesses from being averaged away.
Initial technical profile: the first proposed profile is for passenger cars in category M1. Other vehicle categories require their own validated and released profiles; this page does not represent AUTOSAFE as a universal rating for every road vehicle.
| Domain | Assessment focus |
|---|---|
| D01 |
Safe Driving & Human FactorsDriver interaction, attention, clear controls, warnings and response to an unresponsive driver. |
| D02 |
Crash AvoidanceHazard detection, intervention quality, false interventions and controlled avoidance scenarios. |
| D03 |
Frontal Protection & CompatibilityFrontal crash performance and the effect of the vehicle on an impact partner. |
| D04 |
Side, Rear & Rollover ProtectionNear-side, far-side, rear-impact, rollover and defined multiple-event protection. |
| D05 |
Occupant Diversity & Child ProtectionDifferent occupant characteristics, seating positions, child restraints and child-presence response. |
| D06 |
Vulnerable Road User ProtectionProtection for pedestrians, cyclists and other vulnerable people outside the vehicle. |
| D07 |
Energy, Electrical & Fire SafetyBattery, fuel, electrical, thermal and fire hazards, including isolation and containment. |
| D08 |
Functional & Intended Function SafetyFault response, functional limits, foreseeable misuse and vehicle-level safety arguments. |
| D09 |
Cybersecurity & Software IntegritySafety-relevant access, update integrity, recovery and external dependencies. |
| D10 |
Post-Crash Rescue & EscapeAccess, emergency release, rescue information, communications and emergency power. |
| D11 |
Initial Production EquivalenceMatching of the tested sample and evidence to the labelled production configuration. |
| D12 |
Evidence Quality & ReproducibilityTraceability, independent calculation checks and evidence reproducibility beyond essential validity. |
A to F classification
Understand the A-F Framework
The letter class describes assessed performance under the stated conditions. Colour may support legibility, but every class remains explicitly identified by its letter and description.
A
Highest AUTOSAFE class within the stated assessment envelope, supported by more demanding released requirements.
B
Enhanced protection supported by additional released test conditions and acceptance requirements.
C
Advanced protection under the AUTOSAFE core and robustness programme.
D
Intermediate assessed performance with material limitations disclosed in the record.
E
Lowest qualifying assessed performance class under the applicable system requirements.
F
Below qualifying E conditions or a defined critical failure. It is an adverse result, not an approval mark.
Unrated is not F.
An unassessed, incomplete or unresolved configuration does not become a low-performance class by default.
An unassessed, incomplete or unresolved configuration does not become a low-performance class by default.
Classes are not injury probabilities.
A letter does not promise survival, freedom from injury or a fixed real-world risk outcome.
A letter does not promise survival, freedom from injury or a fixed real-world risk outcome.
Class A is not armour protection.
Any ballistic, blast or other protective claim requires a separate, bounded assessment.
Any ballistic, blast or other protective claim requires a separate, bounded assessment.
Decision logic
More Than a Total Score
A class is available only when all relevant conditions are met together. Strong results in one area cannot be transferred to compensate for a critical weakness in another.
Total score condition
The proposed assessment architecture allocates 1,000 points across twelve domains. The total is one part of the decision.
Minimum in every domain
Each class requires an applicable minimum level of performance in every domain, not simply a favourable average.
Mandatory gates and class tests
Common safety gates and any class-specific requirements must be satisfied before the class can be issued.
Proposed scoring structure: the twelve-domain, 1,000-point architecture and its class thresholds remain subject to technical validation and formal release. They are not an injury-risk model, survival prediction or current operational rating basis.
Configuration-based assessment
Assessed at Initial Production. Linked to the Tested Configuration.
AUTOSAFE is designed to assess the defined production configuration that is intended for customer supply. Its record identifies the vehicle design and scope on which a result depends, rather than treating a brand, factory or marketing name as a blanket rating.
Defined production baselineThe assessed vehicle is identified by its generation, structure, restraints, powertrain, energy system, software, relevant equipment and market coverage.
Representative samplesRepresentative samples may be selected and tested; every production unit is not expected to undergo the destructive test sequence.
No automatic calendar expiryThe proposed certificate records an assessment basis without an automatic expiry date, renewal date or routine retesting cycle.
Continued production is not a retest triggerContinued manufacture or a new model-year name does not by itself require a new assessment where the controlled configuration remains unchanged.
Technical changes receive focused reviewA safety-relevant hardware, software, battery, structure or configuration change may require evidence review, targeted testing or a new assessment decision.
New generations stand on their own evidenceA successor vehicle does not automatically inherit an earlier result merely because it retains a familiar model name.
What the record means: a configuration-linked test and assessment result. It is not a lifetime safety certificate and it does not certify the current condition of any individual used vehicle.
Technology applicability
Designed for Evolving Vehicle Technologies
AUTOSAFE is intended to use a common safety core alongside controlled technology-specific methods. New technology does not arrive pre-approved: where it changes the hazard or evidence basis, it requires a defined method, validation and traceable evidence.
Automated Driving
Operating conditions, transitions of control, fallback behaviour and the vehicle response when a driver takeover does not occur.
Artificial Intelligence
Model identity, independent evaluation, uncertainty, degraded outputs, authority boundaries and permitted learning limits.
Connected & Software-Defined Vehicles
Communication loss, remote authority, external services, update integrity, shared resources and safe local behaviour.
Emerging Energy Systems
New battery chemistries, hydrogen, charging interfaces, bidirectional power and their interacting safety hazards.
Digital Twins & Virtual Evidence
Simulations with defined contexts of use, physically correlated evidence, independent validation and reproducible scenario controls.
Evolving Cabins & Accessibility
Reconfigurable seating, novel interfaces, accessibility needs, emergency actions and escape after the defined loss of power or deformation.
New technology requires new evidence.
Labels and public records
A Label With a Traceable Record
The label is intended to provide a clear entry point to an authoritative assessment record. It should identify the class while keeping the configuration scope, method edition and material limitations available for review.
Illustrative example - not an issued rating
IAF AUTOSAFE
BAssessed configuration only
What the public record is designed to show
- Class letter, assessment record identity, vehicle generation and covered variants.
- Required safety package, powertrain, relevant hardware and software configuration.
- Assessment edition, scope, domain results, applicable gates and material limitations.
- Any corrected result, restriction or change to label authorization, with the affected configuration boundary.
Verification principle: a QR or similar reference is intended to lead to the relevant authoritative record, not a general sales page. The verification service is not yet published.
Proposed operational flow
From Production Definition to a Documented Decision
Once the technical package has been validated, released and formally adopted, the intended assessment process would connect vehicle identity, test evidence and public communication through a documented decision path.
01Define vehicle and configuration
02Agree scope and test plan
03Select representative samples
04Complete tests and evidence review
05Perform independent technical review
06Decide class and coverage
07Issue record, summary and label authorization
Manufacturers
Defined assessment scope and evidence-based review of changes that may affect the recorded configuration.
Consumers & Fleets
A clearer basis for understanding what has been assessed, which vehicle configuration is covered and where the limits are.
Laboratories & Experts
A route to contribute to method development, pilot work, measurement correlation and technical validation.
Current programme status
IAF AUTOSAFE First Edition is a development proposal for technical review. Technical validation, released methods and formal adoption are required before operational ratings, certificates or label authorizations may be issued. Membership, sponsorship or payment cannot improve an established technical class.
Continue with the full technical document
Review the complete AUTOSAFE First Edition working draft, including the assessment domains, classification rules, evidence requirements and technical annexes.