Who/what must comply with the policy?