I work in embedded security. CRA and RED are game changers. We can argue this is years late but at least EU is giving security requirements teeth. Very expensive teeth.
I haven't seen US enterprise data teams sit up and do something as quickly as they did when GDPR rolled out very often. Regardless of other issues, the toothy part seems to work.