Have to be compliant != compliant, and there are multiple reasons for that. 1. An American company without any EU representation is still happy to sell the pro

Have to be compliant != compliant, and there are multiple reasons for that. 1. An American company without any EU representation is still happy to sell the product to anyone who can pay them regardless of location. They may or even will do the bare minimum to have compliance on paper, but that is often not enough for legal team/DPOs. If you are big enough customer you may push them to complete the checklist, but in the end see 2. 2. An American company with significant business in EU will do everything to be compliant, but they cannot overcome limitations of American laws and thus will never be compliant unless there will be a solution not leading to Schrems III/IV etc. A few of them are very creative and actually find such solution (see e.g. AWS CloudHSM), but most of them don’t have resources or technical possibilities to build such things.