I don't think Comma would pass compliance as any control-related automotive system, much less a self-driving one, at any established automotive manufacturer in a regulated market (US, EU). The code isn't written to any commercial audit standard that I can tell, the hardware is COTS mobile phone hardware, and change management and testing (in a formal sense) seems pretty much non-existent. Most manufacturers demand compliance with standards like ISO 26262 for liability reasons. Arguments about the value of these kinds of standards aside, it's vanishingly unlikely that any mature automaker would buy Comma's product as it stands - a major or nearly complete overhaul would be required. Now, that's not to say they couldn't sell into a less-mature company or one in an unregulated market, but I don't think the opportunity for them is as great as it seems.

EDIT: On an additional reading of https://github.com/commaai/openpilot/blob/master/SAFETY.md Comma claim to be ISO 26262 compliant on the premise that there's no real risk model, because the driver is paying attention and will simply take back control. One could call this the "Elon Model" to safety compliance. I suppose it works for some manufacturers.

It does seem that starting around 2018, Comma added a C layer to their CAN intercept board (Panda) which audit-checks some safety-critical CAN messages to bounds-check the control inputs. That's... a start, but not really a detailed risk analysis model by any means.