Depends on who you ask. Those who trust government will tell you that you can count on the subjective enforcement not to go after you as much, and of course the good ol "don't break the law and you have nothing to worry about". The rest of us that understand government incompetence/corruption and risk mitigation would tell you that you have to weigh whether these risks are real enough to you. I would tell a non-growth-focused early stage company uninterested in locale variety with limited resources (e.g. bootstrapped company in beta) to avoid EU customers since there are only downsides.