A scalable way, and which I believe is in place, is having rules and then periodic audits validates that the controls and processes provide a high degree of assurance of compliance with the rules and regulations.

This seems far better than having an agency ad hoc review every single specific software update to vehicles - would people at the agency review the code? Do they write automation? Do they do manual verification?