This is definitely going to work the way policy creators imagine and not incentivize companies to throw as many hacks under the rug as they can.