I agree with you in principle but I think writing this regulation, in a way that actually solves the problem and is not trivial to work-around, is much harder t

I agree with you in principle but I think writing this regulation, in a way that actually solves the problem and is not trivial to work-around, is much harder than you think. Here's an example: The other day I was using a lidar sensor has a very well documented API, into its c-library. I do have the source for that c-library, and can build it, but it's calling into the part which doing many undocumented things because the part itself has a micro inside it and it has been updated since the documentation was written. And that c-library comes with a binary file that is filled with micro firmware and magic numbers that were determined by the factory during calibration. I have no idea how those measurements represent or how they were made, not that I can reproduce them anyway. Is this sensor compliant? And, it probably was compliant once, but now is it still? Because the sensor itself changed, even though the C API remained constant. Also, many parts, like this sensor, are made internationally: hardware is from one country, firmware is from another, company headquarters are a third.