The other other Dave here.
It certainly depends on what you say in your QMS, however, if you're serious about compliance you need to be able to access the latest info, which therefore suggests control is required. If you prove access via internet, or what ever, then that's OK.
I'd go with referencing critical legislation relating to your product or service, and make sure you can access them in their lastest version. 'Cause there is a lot of legislation that applies to companies, and I've yet to find a company that has ALL the bases covered.
Of special mention is that your certifier will probably be ecstatic if you have made even the smallest effort to control these external docs. Also note that external docs are a pain to control, so do so with a minimalist approach.
Cheers.