They’re outside of the sandbox operating in the public, but they will still have to retroactively comply with whatever new restrictions that the lawmakers ask to them as part of the lawmaking process. They get this provisional, tentative, regulation-level approval. When the law adds new things, they have to obey, too.