Few parts of the proposed Cybersecurity Act revision have drawn as much scrutiny as Title IV, which would let the Union designate high risk suppliers and require their equipment to be removed from critical networks. At its debate on 29 September, the European Internet Forum heard from those who would have to apply the rules: a network vendor, a Member State negotiator, a cloud and software provider and the telecom operators' association. Two questions ran throughout: what should make a vendor high risk, and what evidence and process should stand behind such a decision.