Can you think of any good technical regulations that do lay out requirements & obligations in a useful manner without being massively outdated, trivially bypassable, or some sort of hugely onerous 'one size swamps all'?

I mostly agree that the lack of concrete measures makes it horrible from a compliance view, but I'm not sure you can have both things, especially in a relatively immature area of law.