Cannot you just force every company to list all of the things their tools do and publish it online every six months (like you do with clinical research trials with results) and then sanction them when whistleblowers talk?