In the US, under the OIO/Title II, an ISP could do basic network management (e.g. blocking ddos attacks, holding people to the bandwidth limits they paid for) and basic QoS, though I'm not exactly sure how that was defined or implemented.