It would have to drive fully autonomous in all conditions that humans drive in, for enough miles to produce a statistically valid lower rate of accidents than humans.

Since it can't drive fully autonomous until it has proved itself, it would be allowed to have a safety observer onboard. But here is the catch: Any intervention by the observer counts as an accident, since we are simulating what it would do without a human. Assume worst case.

Oh, and software updates reset the clock.