I'm not knowledgeable about how the US administration works, but I think it's a universal principle that when you write laws and regulations, it generally has to come with means to inspect and check that the rules are not violated.

It's especially difficult with anything digital. Do you really want to rely just on whistleblowers?