That probably defines the minimum legal standards for companies to adhere to, I guess? Companies should be free to implement their own additional improvements (identity verification, for example).

Adding too many legal requirements could make it more challenging for competitors to build their own compliant implementations.