Yes, that's correct. The regulations and legislation obviously are both binding legally, but the legislation gives the authority to pass the regulations, so it gives the broad scope. This legislation, in implementing the Arms Trade Treaty, would give legislation the authority to implement at the level the ATT requires and broader, and those can be changed by regulation, the same way that sanctions law, for example, and the UN-ACT or the Special Economic Measures Act are done by regulation to allow more flexible movement.
That contrasts a policy that, as you say, has some legal effect potentially but can be changed more.... In fact, there's a legal obligation to consider exceptions to policy where there is a legal obligation to comply with regulations and legislation.