Should add to that that the law (which is generally abstract) will be interpreted by 28 different legal systems. EU legal system is not homogeneous and there are definitely different sensitivities between countries (e.g. Germans seem very happy about GDPR - the Poles less so). That's an extra risk factor imho.