That's correct. Their obligation is to “ensure”. The obligation is not to achieve the result at all costs; it is to ensure that this result is achieved. If they can demonstrate that they've taken a reasonable step within their own discretion and authorities to achieve the result, then from a regulatory compliance standpoint they're okay.
On October 17th, 2017. See this statement in context.