At the absolute minimum, it needs to put that in a legally enforceable document.
Says who? Quote please

Says me, as far as that being my judgement of what the minimum is likely to be. That a legal agreement is needed: the EU.