Most of the obligations already existed. The change is in enforcement, and in who counts as a controller.