The October incident in California saw a pedestrian dragged for 20 feet by one of the vehicles.
Now the state's Public Utilities Commission says Cruise could face fines of $1.5 million.
There may be additional sanctions over the firm's initial failure to disclose all details of the accident.
Last month the agency said that Cruise took two weeks to supply the full video of the event.
Separately, GM chief executive Mary Barra said Monday that the company's review of the incident would last into the first quarter of next year.
She said she was focused on "righting the ship" at the unit.
But analysts say the prospect of fines and other penalties could delay efforts to rebuild trust and restart operations.
Cruise suspended all driverless car trips in the U.S. following the accident.
The unit's chief executive and chief product officer both stepped down.
GM says it has hired a law firm to examine management's handling of the accident, and their response to regulators.
One investor told Reuters that it would take many months to rebuild trust as resolve the issue.