What if the regulation largely ignored the technology and instead focused on responsibility: prohibit license terms requiring arbitration or restricting class action cases, setting minimum warranty terms which treat software support as a primary requirement (no selling a washing machine with a 10+ year hardware lifetime but ending software support 6 months after release), and restricting liability disclaimers so a company can&#x27;t completely shirk responsibility the way everyone does now?<p>The one which would make the most sense to me is something like a souped-up CERT: researchers report vulnerabilities to them, staff grades the severity, and a company has increasingly strict penalties if the fix isn&#x27;t shipped within certain timeframes. Imagine if e.g. Samsung, Lenovo, etc. executives knew that their personal assets would be frozen in the U.S. if they continued not to support all of the millions of vulnerable Android devices?<p>The main thing I&#x27;d hope an approach like this could avoid would be the PCI bureaucracy you mentioned where a company might choose to avoid riskier areas rather than being required to expensively audit a process.