They are now required to do just that, if they want to sell to the EU market. When you hear the term "cybersecurity," the real subject is the protection of revenue streams from attack by end users.