A random company might
state on their website: "We shall comply with all laws and regulations governing information security".
Obviously, they cannot make a contradicting
claim, e.g. "we will not comply with laws and regulations, if we bloody hell do not feel like it".
Thus the policy statement in the web page, is a
non-statement.