[orangeoxidation]

Note that this is only about known and disclosed security vulnerabilities.

It will not be enforced by an overworked regularly body, but by customers suing software companies.

No reason for the government to investigate proactively (as long as the government was not affected).