It is a convention, not a rule. Before the Update Service existed, providers needed some interval, and three years was long enough to be affordable and short enough to be defensible. Many commissioning contracts and insurers wrote it in, which is why it now feels like law. If your contracts require it, you must follow it. If they do not, it is your policy to set.