A lot of regulation is legally defined in terms of outcomes. That in itself isn't unusual. Checklists of technical requirements are almowt always a derivative and a suggestion about a safe path to meet the regulated outcome. This is how "blessed" standards for e.g. medical devices work. This shields the laws themselves from overly technical discussions.

The only difference that I can see here is that the standards layer hasn't solidified yet.