They can’t create rules.
The law is the law and their duty is to follow it or enforce it.
There’s a regulatory layer built into the law, which delegates to the ISP considerable rule-making power. The current fracas demonstrates why this was a bad idea. But that’s how it works. For now. We expected these growing pains.