1. Look at what they did to satisfy the regulators.
2. Respond in as similar a manner as possible.
The commercial info is not necessary. They need to learn and follow the forms and protocols, and at least pretend to to be respectful when kissing the ring. If GeoHotz ran a restaurant, I wouldn't want him to be the one talking to the health inspector, either. He has the wrong personality for it. You really want the schmooziest suck-up in the company to do that stuff.
I fully expect that all the companies with compliance departments have reams and bales of responsive documentation. As comma.ai appears to be clueless with respect to regulators, the more sample material that they can look at to crib the correct answers, the less likely it is that regulators would summarily drop the axe rather than try to work with them in a reasonable manner.
They want his compliance, or his $21k/day. The document is all stick and no carrot. And it is a big, federal regulatory agency stick. I think "kissing the ring" applies.
Also: secret commercial information is exempt from FOIA.