That's actually meaningless in Europe under the Cyber Resiliency Act by the way. They are liable even if they say they aren't.