Which is totally not the case here. The law mandates certain actions. If you're certified to comply with the standard, then you're in compliance with the law, however you can be in compliance with the law without implementing the standard - you just carry the burden of proof.