Digital strategic autonomy: the EU needs to go beyond legislation