NIS2 and the Cyber Resilience Act are imposing additional obligations on organizations and software vendors. But is this merely an extra layer of red tape, or does it represent a fundamental shift in how systems are designed? Traceability, security by design, product liability: do these regulations truly reshape system architectures? A debate on the structural impact of the new European requirements.