The EU’s proposal for a Cyber Resilience Act (CRA) is the first horizontal regulation to introduce security requirements for connected devices and related services. However, the draft regulation has promoted a debate about the type of products that should be covered. We discussed the critical aspects of the proposal with Grégoire Gaonach, a cybersecurity engineer and digital policy consultant at Political Intelligence.