Contrary take: it's easier to move "should" regulation to "must" regulation than it is to create the latter from nothing.

E.g. HIPAA security rule updates