There is no audit or anything of the sort. It's just a form to fill where the company must certify that their car is good enough and they have certain processes in place to take remote control of the vehicle if needed, and to deal with an eventual accident.
> "The manufacturer certifies that the autonomous vehicles are capable of operating without the presence of a driver inside the vehicle and that the autonomous technology meets the description of a level 4 or level 5 automated driving system under SAE International's Taxonomy and Definitions for Terms Related to Driving Automation Systems for On-Road Motor Vehicles, standard J3016 (SEP2016), which is hereby incorporated by reference."
Basically anyone can get approved, as long as they can prove they can deal with the consequences (sufficient insurance coverage etc.).
It reminds me a little bit of the FAA letting Boeing certify the 737 Max themselves.
[1]: https://www.dmv.ca.gov/portal/uploads/2020/06/Adopted-Regula...