re: money, insurance nonsense
@vidister@chaos.social @Dee ... so hold up. Wouldn't you also be compliant if your "AV" was just a shell script searching your disk for the EICAR test string (after all, that's how an AV is verified to be functional!), and you just never ran it? It's even up-to-date, because there's no newer version of it available!
re: money, insurance nonsense
you can also have a "database" file containing nothing but a timestamp of the last update, and then you can actually distribute and download updates!