The whole point is they're selling you some hardware only (a modified Android), and it's legal if you yourself modify your own car or something. You have to manually install the software and mount it physically after buying this.

https://techcrunch.com/2016/10/28/comma-ai-cancels-the-comma...

It seems well-tested and safe though, not something sizzling out the lab, they're just using a legal loophole.