> So if an EU-based company audits and then needs to make some changes to a non-EU-based project, I'd assume by default they'd want all those changes upstreamed

> So if an EU-based company audits and then needs to make some changes to a non-EU-based project, I'd assume by default they'd want all those changes upstreamed and made permanent since it'd reduce the burden going forward. Humans aren’t behaving logically. If a company A audited their dependencies, it doesn’t benefit them at all to “upstream” their audits because: 1) dependencies are already audited for that company and only new version has to be audited in the future, 2) holding an audit will be a competitive advantage because everyone else has to consume their resources to get audits in place, 3) “my people on my salary got those audits for me so if I had to pay for it, the others have to pay, why should I share that when I paid for it, it cost money and sweat, nobody’s getting it for free”.