You underestimate the power EU believes it has

Subset of industry feedback on EU CRA, https://github.com/orcwg/cra-hub/blob/main/product-definitio...

You just mandate the scanning into the OS, then mandate what OSes hardware is allowed to boot.