There seems a pattern with legislators in EU trying to fit the digital ("hacker") culture into service provider/customer model. Individuals hacking on projects

There seems a pattern with legislators in EU trying to fit the digital ("hacker") culture into service provider/customer model. Individuals hacking on projects for fun, bringing up their standalone servers for fun etc. just shouldn't exist in their mind. "Customers" (i.e. non-tech people) demand protection and "service providers" (whoever puts their stuff online) should comply. Rant over. Honestly I don't understand why is it not done the same way as for other certification. You only need to have certification once you start selling your product in a regulated industry - e.g. a connected device in this case. If you use any components (hardware or software) it's your responsibility that they are either pre-certified for you (what commercial suppliers would do) or certify them yourself. This would shift responsibility from open source maintainers to where it's due.