Nothing whatsoever to do with IATA. The Denied Boarding Regulation is EU law, directly applicable in every Member State.
To the best of my knowledge, IATA don't make rules any more (not enforceable ones anyway). The days when IATA inspectors would roam the world, counting the number of cherry tomatoes on each plate and fining over-generous miscreants, are long gone.