What stops a driving model from crossing a border

Two contradictory statements, one week, one company

Munich, mid-July 2026. XPeng launches its L03 across some sixty markets at once and drives its VLA VLA Vision-Language-Action. An end-to-end driving architecture where a single model takes camera frames in and emits control commands directly (steering, throttle, braking), replacing the classic perception, prediction, planning and control pipeline. 2.0 model, trained on Chinese roads, through the city streets. On July 15, a company vice-president writes on Weibo that the model shows a high level of adaptability in Europe and handles complex urban scenarios with almost no additional training data. The same day, the head of intelligent driving concedes on X that the same model does not yet succeed in every European scenario. And the Chinese technical press reports that engineers must specifically train the German culture of yielding to pedestrians, because many tacit rules can only be learned through local collection.

Three statements, one house, seven days. The first two are in tension, the third flatly contradicts the first: you cannot simultaneously need almost no additional data and have to collect locally the unwritten rules of German traffic. The question that interests us is not who is lying, but understanding what, inside a driving model, crosses a border and what does not.

Before answering, the trap of the subject has to be defused, otherwise everything else reads wrong. In Europe, an absent feature proves nothing about the model.

European regulation 2018/858 imposes type approval type approval The European procedure (Regulation 2018/858) that approves a vehicle type before any of it reaches the road, every conforming unit then inheriting the approval. The opposite of US self-certification, where the manufacturer attests its own compliance and faces scrutiny afterwards. before any circulation on open roads, where the United States operates by self-certification. A software stack can therefore be technically ready and remain prohibited. The framework authorizing system-initiated manoeuvres off the highway, meaning assisted urban driving, arrives with the series 02 amendments to UNECE regulation R171, adopted in June 2026 and applicable around January 2027. To date, no R171 approval is confirmed for XPeng, NIO, BYD or Zeekr. Those that exist went to BMW, Lotus and Tesla.

The constraint cuts both ways, which is the best proof it has nothing geopolitical about it. After a Xiaomi SU7 crashed on a highway in March 2025, three dead, driver assistance active and the driver taking back control two seconds before impact, the Chinese industry ministry froze public testing of uncertified systems, banned autonomous-driving terminology in advertising, and made over-the-air updates touching driving subject to approval. Xiaomi recalled nearly 117,000 vehicles for insufficient recognition capability.

What gets taken for a technical failure is most often an unchecked homologation box. Once that confusion is cleared, we can look at what happens inside the model.

A perception model does not cross the Atlantic

The measurement exists, it is old, and it is unambiguous. Cornell researchers trained a 3D object detector on KITTI, a dataset collected in Germany, then tested it on Waymo, collected in the United States. The paper’s title says everything: Train in Germany, Test in the USA.

The authors summarize the drop with one figure: the imported detector is 36% worse than the one trained locally. The detail is more brutal still. On their most demanding metric, average precision of three-dimensional bounding boxes for the car category, the imported model falls to 11.9% where the local model reaches 85.3%. These two values do not measure the same thing and do not divide into one another: the first is the authors’ summary, the second a precise metric on one category at one threshold.

A word about that threshold, because it explains the violence of the second figure. The protocol only counts a detection as correct if the predicted box and the real object overlap by 70%. Below that, the detection is rejected outright, with no partial credit. A systematic dimension error therefore does not degrade the score gradually: it flips whole detections from the right side to the wrong one.

Now the interesting part, the cause. The authors looked for what, in the gap between the two continents, explained the collapse. It is not signage. It is neither weather, nor lighting, nor driver behaviour. It is the size of the cars. A Ford F-150 is 5.3 metres long, a Volkswagen Golf 4.

Here is why that detail is enough to break a model. A 3D detector does not measure a bounding box the way a rangefinder measures a distance: it regresses one. From a partial point cloud, noisy and truncated by occlusions, it produces an estimate of length, width and height. And to produce that estimate it leans on what it saw during training, that is to say a prior over the plausible dimensions of a car. In Germany that prior is centred on short vehicles. Take the model to Texas and the prior that was helping becomes a systematic bias: it underestimates every vehicle, its boxes no longer overlap real objects enough, and the 70% threshold rejects them outright.

The phenomenon is symmetric, which settles that this is a property of the data rather than an inferiority of one dataset. The ST3D work redoes the experiment in the other direction, from a model trained on Waymo towards KITTI, and reports a drop of more than 45%, dominated by the same factors: object size and point cloud density.

One caveat before going further, because it bounds what these numbers license. This is 3D perception by LiDAR LiDAR Light Detection And Ranging. A sensor that measures distance by timing laser pulses back to the source, producing a 3D point cloud. Unlike a camera it hands you geometry directly, which moves the hard part away from depth estimation and towards classification and point density. , on the car category alone, at the strictest overlap threshold. Nothing in there speaks to planning, or to how the vehicle decides. We are coming to that.

The reversal: this flaw repairs for almost nothing

If the story stopped there it would confirm the common intuition: a driving model is a prisoner of its geography, and exporting it means starting over. The same authors showed the opposite.

Since the dominant cause is a distribution error on dimensions, correcting it does not require relearning how to see. It is enough to statistically renormalize object sizes towards the target country’s distribution. The operation recovers 41.4 points of average precision, on the least difficult subset of the test set, the one where vehicles are close and barely occluded. No new collection campaign, no additional fleet, no months of retraining. A statistical rescaling.

We will not go so far as to subtract that gain from the gap measured above: the two figures do not cover the same test subset, and the authors do not publish enough to reconstruct precisely where you land relative to the locally trained model. That is not what matters anyway. A gain of that size is obtained without a single new piece of data, and it is that sentence which structures the rest of the article.

Perception travels badly, and a large part of what it loses is recovered without collecting anything. The entry price for a new market is therefore elsewhere. The question is where.

Behaviour, on the other hand, does not recalibrate

Move from what the vehicle sees to what it decides. The gap there is comparable in size, but no cheap fix has been published.

The most direct measurement comes from the nuPlan benchmark, which covers four real cities. A learned planner trained only on Las Vegas, then evaluated on the other locations, loses 35.1% of its performance in non-reactive closed-loop closed-loop An evaluation protocol where the model's decision changes the next state: the simulated vehicle actually follows the trajectory it picks, and its mistakes compound. In open-loop evaluation the decision is scored against a human's on a frozen recording, never leaving the reference trajectory, which hides exactly that compounding. evaluation and 41.5% in reactive closed loop. The worst location is Singapore, and the authors give the reason without hedging: they drive on the left there, while the model learned on the right.

That is the exact counterpart of car size, transposed to the register of decision. The model did not memorize a statistic about dimensions, it memorized a statistic about conventions. And that one does not renormalize with a coefficient, because it does not bear on a continuous quantity but on the very structure of what to do at an intersection.

Other work measures the same fragility from different angles. A matched-route benchmark reports an average 22.8% drop in success rate under distribution shift, across seven state-of-the-art models. In transfer between simulated towns, some policies fall to a flat 0% success outside their training town, against 57% at home. And a nuPlan study quantifies what separates two cities within the same country: the distance to the lead vehicle, measured on real data, shows that Boston drivers are more aggressive than those in Pittsburgh.

The underlying mechanism has been known for a long time and has nothing specific to cars about it. A policy learned by behavioral cloning behavioral cloning Learning a policy by directly imitating human demonstrations. Its structural flaw: the model is trained on the states a good driver visits, but once released it visits the states its own mistakes produce, which its training never contained. The gap grows with the square of the episode length rather than in proportion to it. suffers a structural flaw: it is trained on the states a good driver visits, but once released it visits the states its own mistakes produce, states its training by construction never contained. The foundational work on the subject quantifies that drift, and the result is harsher than one imagines: the total gap does not grow in proportion to trip duration, it grows with its square, because each mistake makes the next more likely. Feeding back into training the states the policy actually visits brings that growth back to proportional. Changing country merely widens the entrance to that vicious circle.

A second result piles on, more insidious. An imitation model can lock onto misleading correlations specific to its home environment, to the point where giving it more information degrades its performance instead of improving it.

Field evidence confirms all this, and the best-documented case does not involve a Chinese manufacturer in Europe. It involves Tesla in China. Unable to export Chinese driving data, Tesla trained the local version of its system on public videos of Chinese roads and signs found on the internet. The result matched the method: one driver received seven fines on a single trip, for incursions into bus lanes and cycle lanes. A comparative test run in Shanghai records on the order of 34 violations and 24 interventions in one session, against roughly fifteen violations each for the two local vehicles put through the same exercise.

One gap needs naming. Every measurement of policy degradation we have just cited was obtained in simulation, on nuPlan or on CARLA. No academic benchmark measures what becomes of a driving policy in a real-to-real transfer between two countries. That is a hole in the public literature, and the only figures claiming to fill it are self-reported.

The counter-argument, and what it is worth

Those figures come from a company that claims the opposite, and it would be dishonest to skip it. Wayve claims a single foundation model, trained on data from more than seventy countries, capable of driving anywhere. The numbers advanced are impressive: 506 cities visited, of which 219 with no prior local data, or 43% of the total, for 1.45 million kilometres accumulated. The move from the United Kingdom to the United States is said to have happened first with no local data, then, after 500 hours of American data collected over eight weeks, the company announces performance multiplied by forty, at the level of its British benchmark. It raised $1.2 billion in February 2026 at an $8.6 billion valuation.

Three things must be said before using any of it.

First: there is no independent corroboration. No third-party evaluation, no peer review, no verification by a regulator, an insurer or a customer. Every external repetition simply relays the company’s figures. The papers published on its world models are technical reports posted to arXiv, not peer reviewed, and they describe the generative simulator rather than driving generalization. Press rides exist, at MIT Technology Review, Forbes and TIME, but they are qualitative: nobody measures a disengagement rate or a success rate.

Second: the factor of forty announced after 500 hours of local data is unverifiable, because the company nowhere defines what its notion of British-level performance measures. A multiplier without a metric is not a result.

Third, and this is the most important, reframing everything else: those 1.45 million kilometres are supervised real driving, with a safety driver on board. It is neither simulation nor driverless service. An external summary puts it correctly: read it as tested operation, not continuous commercial deployment.

That said, and this is what makes the counter-argument useful rather than awkward: even at its most favourable, it concedes the point. Five hundred hours of local data is not zero. Tesla had to build a data centre in China. Waymo redoes a manual collection city by city, including in Tokyo, where the campaign started with drivers from a local operator before the first autonomous kilometre. The defensible formulation is not that compute does not travel. It is that the trip has a local cost that decreases but never reaches zero.

The bill is a validation bill

We now know what travels and at what price. Which leaves the question nobody asks: what does it cost to prove the result is safe?

The answer starts with a figure that closes the door on the naive approach. To demonstrate with 95% confidence that an autonomous vehicle cuts the fatality rate by 20% relative to a human driver, you would have to drive 8.8 billion miles. With a fleet of a hundred vehicles running twenty-four hours a day all year, the study producing that number calculates it would take four hundred years. Empirical validation on open roads is not difficult, it is statistically out of reach.

The industry therefore did the only thing available: it moved the proof into the simulator. Waymo now claims more than twenty billion simulated miles against a little over two hundred million real ones, a ratio of a hundred to one. The imbalance is not new: as early as 2016 the company was accumulating two and a half billion virtual miles for three million real ones, with twenty-five thousand simulated vehicles driving eight million miles a day.

What that costs in compute, nobody publishes properly, and that is in itself the most interesting result of our research. No company gives the split of its compute budget between training and validation. The best approximation available sits in a Cruise engineering post from 2022, and its value comes from both figures appearing in the same document.

Those figures are expressed in GPU-years, a unit worth a second of explanation: one GPU-year is one accelerator busy for a year, or three hundred and sixty-five accelerators busy for a day. It measures compute consumed, not hardware owned.

Company	Training	Simulation and validation
Cruise (2022)	Hundreds of GPU-years per month	Tens of GPU-years per day, plus thousands of core-years per day
Zoox (2025)	64-odd GPUs for the multimodal model	Up to 2,000 GPUs reserved in a single cluster
Waymo (2025)	Not disclosed	More than 20 billion simulated miles against 200 million real ones

Do the multiplication, it takes two lines. A few hundred GPU-years per month, over twelve months, gives a few thousand GPU-years for the year. A few tens of GPU-years per day, over three hundred and sixty-five days, gives several thousand as well, and probably more. Both budgets land in the same order of magnitude, with the advantage probably to simulation.

The caveat is real and has to be carried: the second bucket also aggregates ground-truth labelling and remote builds, so the ratio is an upper bound. But the conclusion holds on either reading, and Zoox confirms it from a different angle.

Validation compute is not a side item next to training compute. It is at least its equal, and probably more.

Add the data volume that implies. A test vehicle produces between 1.4 and 19 terabytes per hour. Replaying those recordings to evaluate a new version of the stack, what the trade calls resimulation resimulation Replaying sensor recordings captured on the road through a new version of the software stack, to observe what it would have decided. Maximum realism, since the data is real, but it only covers situations that were actually encountered: rare events still require synthetic generation. , mobilizes hundreds of petabytes, tens of thousands of cores and more than thirty gigabytes per second of sustained input/output.

The order of magnitude of what that represents in practice can be read in a recent approval. To get its stack accepted in the Netherlands in April 2026, under R171 and via the article 39 exemption route, Tesla presented more than 1.6 million kilometres of European testing, thirteen thousand ride-alongs, eighteen months of campaign and a file covering more than four hundred requirements. The Dutch authority notes in passing that the European software differs substantially from the American version.

That is the entry price for a market. Not a recompilation. Not even a retraining. A campaign of proof.

Where compute is allowed to live

Which leaves where that campaign can physically take place, and this is where data law takes over from engineering.

China classifies mapping and autonomous driving data as important data. It must be stored on the territory, and any cross-border transfer goes through a prior security assessment. Compiling navigation maps is closed to foreign investors, who must subcontract to a qualified entity.

The Tesla case shows what that constraint produces when it meets a symmetric one. China forbids training data from leaving. American export controls on chips prevent Tesla from building large compute centres in China. The company therefore finds itself with the data on one side, the compute on the other, and a prohibition on bringing them together. Hence the training on videos scraped from the internet, and hence the seven fines. A regulatory constraint produced a technical limit, by way of the geography of compute.

In the other direction, XPeng claims to operate a European data security domain on European cloud infrastructure, logically and physically isolated. Its European privacy policy, updated in January 2026, nonetheless provides for processing involving Chinese affiliates for IT operations, research and support, framed by the European Union’s standard contractual clauses. No published independent audit backs the claimed isolation. We mention it as a claim, not a fact.

In our view, this is where the real industrial question sits, and it is not automotive. The map of training and validation compute is no longer drawn by GPU availability or by the price of a kilowatt-hour. It is drawn by data law, which decides on which side of a border a dataset may meet a cluster. A manufacturer wanting a model for a given market will have to run compute inside that market, because it will not be able to repatriate the raw material anywhere else.

The question that follows is whether the capacity available in each jurisdiction will suffice when several manufacturers discover at the same moment that they each owe a second campaign of proof, on that particular soil.

Sources and method

Amounts are quoted in dollars. Generalization measurements are reported with their protocol, because an open-loop evaluation and a closed-loop evaluation do not measure the same thing. We systematically distinguish a technical limit from a homologation limit.

Verified facts

Perception and geographic transfer. Wang et al., Train in Germany, Test in The USA: Making 3D Object Detectors Generalize, CVPR 2020 (arXiv 2005.08139), for the 36% drop, the 11.9% against 85.3% precisions, the attribution to vehicle size and the 41.4-point gain from statistical renormalization. Yang et al., ST3D, CVPR 2021 (arXiv 2103.05346), for the drop of more than 45% in the other direction.

Policy transfer. The nuPlan benchmark (arXiv 2403.04133) for the 35.1% non-reactive and 41.5% reactive closed-loop losses of a planner trained on Las Vegas, and for attributing the worst case to Singapore’s left-hand traffic. AdaptiveDriver (arXiv 2406.10714) for the lead-vehicle gap difference between Boston and Pittsburgh. Fail2Drive (arXiv 2604.08535) for the 22.8% average drop across seven models. DriveVLM-RL (arXiv 2603.18315) for the collapse in transfer between simulated towns.

Imitation theory. Ross, Gordon and Bagnell, A Reduction of Imitation Learning and Structured Prediction to No-Regret Online Learning, AISTATS 2011, for the quadratic growth of behavioral cloning error and its reduction to linear. de Haan, Jayaraman and Levine, NeurIPS 2019 (arXiv 1905.11979), for causal confusion.

Discrediting of open-loop evaluations. AD-MLP (arXiv 2305.10430) and Is Ego Status All You Need for Open-Loop End-to-End Autonomous Driving? (arXiv 2312.03031, CVPR 2024) for the 73.9% share of straight-line scenes in nuScenes and the near-absence of planning degradation when camera input is removed.

Validation cost. RAND, Driving to Safety (RR1478, 2016) for the 8.8 billion miles and the four hundred years. Cruise engineering post on Google Cloud, March 2022, for the hundreds of GPU-years per month in training and the tens of GPU-years per day in simulation, both figures coming from the same document. AWS case study and a re:Invent 2025 presentation for Zoox’s two thousand simulation GPUs against sixty-odd for its training. Waymo’s official page for the twenty billion simulated miles against two hundred million real ones, and The Atlantic’s August 23, 2017 investigation into Carcraft for the 2016 figures. Microsoft’s documented ValOps architecture for resimulation orders of magnitude.

Regulatory framework. Regulation (EU) 2018/858 for prior type approval. Implementing regulation (EU) 2022/1426 for the prohibition on basing approval on simulations alone. Document GRVA-18-50e (2024) for the proposal of 30% physical testing. UNECE regulations R157 and R171, the latter for the five credibility characteristics of the virtual toolchain. Approval of FSD (Supervised) by the Dutch RDW on April 10, 2026 for the 1.6 million kilometres of European testing, the thirteen thousand ride-alongs and the four hundred requirements. The world’s first UN-R157 approval was granted by Germany’s KBA to Mercedes-Benz DRIVE PILOT on December 9, 2021; the type designation Japan’s MLIT granted Honda in November 2020 falls under a separate national framework.

Data localization. China’s Cybersecurity Law (2016, amended January 1, 2026), Data Security Law (2021) and Personal Information Protection Law (2021) for important-data status and export assessment. The 2024 negative list for the prohibition on foreign investors compiling navigation maps. XPeng’s European privacy policy, updated January 16, 2026.

Credible estimates

The claim that validation compute is at least of the same order as training compute is an annualization of Cruise’s two figures, not a measurement. The simulation bucket cited also aggregates ground-truth labelling and remote builds, which makes the ratio an upper bound. No company publishes an explicit split between the two budgets, and that absence is itself a result.

The 8.8-billion-mile figure holds for one confidence level and one scenario (95% confidence, a 20% improvement on a fatality rate baseline of 1.09 deaths per 100 million miles) and loses all meaning detached from them.

Hypotheses and unverified claims

Wayve’s generalization figures (506 cities, 219 zero-shot, 1.45 million kilometres, a factor of forty after 500 hours of local data) come exclusively from company communications. No independent, peer-reviewed, regulatory, insurance or customer evaluation corroborates them. The GAIA-1 (arXiv 2309.17080) and GAIA-2 (arXiv 2503.20523) technical reports are not peer reviewed and concern the generative simulator. The kilometres announced correspond to supervised real driving with a safety driver, not a driverless service.

The isolation of the European data domain XPeng claims is backed by no published third-party audit.

What we could not establish

No academic benchmark measures the degradation of a driving policy in a real-to-real transfer between two countries. Every measurement cited above was obtained in a simulator.

No direct monetary cost of a validation campaign, per campaign or per validated kilometre, is published by anyone in the sector. Only compute fleet sizes and storage volumes circulate.

No quantified comparison sets the cost of log replay against that of synthetic scene generation. The trade-off between them is documented only qualitatively.

We found no public technical evidence that a Chinese driver assistance system fails in Europe. That absence is a result, and it is the reason this article treats a mechanism rather than a contest.