Why not just set a centralized repository of "industry best practices" and have the law require programmers follow it. If they codify the best practices into law, then they have to change and update the law every time there is an update to the best practices.