Europe cannot secure what It cannot see: The supply-chain challenge in CSA2

CSA2 marks a significant shift in European cybersecurity policy by treating concentration and critical interdependencies as security risks. Those risks sit largely in upstream manufacturing and critical-material supply chains, where concentration reflects global industrial structure more than procurement choice. For investors, is not simply whether the regulation reduces risk, but whether it can do so without creating new forms of dependency elsewhere in the supply chain. Given these constraints, can CSA2 provide meaningful security?