Regulation isn't a magic bullet though. I've seen countless companies check the boxes of regulation for their software in the government space only to have them

Regulation isn't a magic bullet though. I've seen countless companies check the boxes of regulation for their software in the government space only to have them fail spectacularly because it was done as cheaply as possible. Regulation will never cover all possibilities of a company acting shitty; if companies find ways to doing things cheaper and still being able to check that box just so they have no liability then they will do it. I don't think these types of get-out-of-jail-free-cards, even though they're very well intentioned, are ultimately a good thing. But time will tell either way :)