I think they were speaking more generally: the requirements in the legislation are similar in structure to the kind of safety/serviceability requirements that a

I think they were speaking more generally: the requirements in the legislation are similar in structure to the kind of safety/serviceability requirements that already exist for hardware being sold in the EU (much of which is just self-certifying you have implemented the relevant standards). Having security requirements and applying them to pure software products is what's new.