It's dependent on jurisdiction. Black box reverse engineering is only required in certain countries. If I remember correctly, most of Europe doesn't require it.