They got approved by California DMV. The procedure to get such an approval is section 227.38 of [1].
There is no audit or anything of the sort. It's just a form to fill where the company must certify that their car is good enough and they have certain processes in place to take remote control of the vehicle if needed, and to deal with an eventual accident.
> "The manufacturer certifies that the autonomous vehicles are capable of
operating without the presence of a driver inside the vehicle and that the
autonomous technology meets the description of a level 4 or level 5 automated
driving system under SAE International's Taxonomy and Definitions for Terms
Related to Driving Automation Systems for On-Road Motor Vehicles, standard
J3016 (SEP2016), which is hereby incorporated by reference."
Basically anyone can get approved, as long as they can prove they can deal with the consequences (sufficient insurance coverage etc.).
It reminds me a little bit of the FAA letting Boeing certify the 737 Max themselves.
[1]: https://www.dmv.ca.gov/portal/uploads/2020/06/Adopted-Regula...