Three problems: 1. Regulatory capture is not something I want to see happen to IT. The big companies love making rules knowing smaller organizations can't fulf

Three problems: 1. Regulatory capture is not something I want to see happen to IT. The big companies love making rules knowing smaller organizations can't fulfill them. 2. Just because you make some new legally binding principles, doesn't mean that almost any source code in existence will magically meet it, or can ever meet it. That code is not getting rewritten overnight, or possibly, ever. This would make regulatory capture worse than normal, because sloppy code that's impossible to rewrite would be grandfathered in, and only the newer, more innovative, smaller companies would be held to the standard. Just take Google - they have over 2 billion lines of code. Just attempting to touch it is more dangerous than leaving sleeping dogs lie. Sucks if you're a competitor - writing your own 2 billion lines is going to be almost impossibly harder. 3. In which case, you've raised the ladder while doing very little to prevent a reoccurrence. Countries that are not the US will gain the edge in innovation, research, and development. Also, edit: 4. The only reason everyone used Cloudstrike is because everyone's trying to do a CYA (Cover Your Ass) move; which is much easier to outsource to someone else. To regulate would further increase this tendency, which is the opposite of what we need right now.