But that is because the requirement is binary - warning vs. no warning. This problem doesn't happen if the requirement is to disclose what was used although it could still lead to other issues.