Even the OP's quote made it clear this isn't the case. Companies need to show they rigorously tested that the model doesn't do this.

It's like cyber insurance requirements - for better or worse, you need to show that you have been audited, not prove you are actually safe.