The EU’s cyber-sanctions regime under Regulation (EU) 2019/796 is a legal instrument of coercive diplomacy, and its six-year record shows both reach and friction.