Ye. It's unfortunate that companies cannot responsibly do the proper thing on their own.

Though I wanna raise that, CRA may be an unfathomably high bureaucratic load on software companies. If it were just about security disclosure, it would be quite manageable.

As it is formulated in its current form, CRA sets the general software development industry... to the current industrial automation and automotive standards; which is absurd.