I've talked to various people over the last couple of years, and it seems Colonial Pipeline was the big eye-opener for politicians in USA: Nobody could be sued, even though they were aware of the problems.

In EU I've heard more about ransomware in general and the behavior of Microsoft and Oracle in license negotiations and "audits" in particular.

But the overall tenor is that politicians have had it up to here with the IT industry's "What me worry?" attitude to quality, responsibility and liability.

You greatly overestimate the speed at which bureacracy moves

You have no idea how slow governments are.