My "device" is a laptop. You say "like Apple", but I believe Apple's CSAM is unique - nothing else tries to scan your messages between keyboard and encryption.

I think the term « device » is a bit misleading. I should have used client side instead. It doesn’t need to scan your messages between keyboard and encryption, the application handles your messages in plaintext and it can scan them without needing any decryption. The encryption is done just before sending the messages.

Well, I did say "properly encrypted". An encryption scheme that, by design, shares information from my plaintext with a third party, isn't "proper" in my book. That's phony encryption.

[Edit] I evidently don't understand your remark. If some "encryption app" processes the plaintext before it is encrypted, isn't it processing plaintext between the keyboard and the encryption?

It's true that "regulations" are effectively laws. They are also quite rare, compared to directives.

Directives have to be implemented in national legislation; it is customary for nations to ignore deadlines on implementing directives they don't like, and to finally implement them in a way that serves the interests of the party in power. So the national legislation is often full of loopholes, or provides zero mechanisms and funding for enforcement.

The EU does nothing to ensure that the implementing legislation actually implements its directives.

I welcome the GDPR (which is a regulation); I can't think of another occasion on which a piece of EU legislation I thought was good, has been handed down as a regulation.