EU cyber law enforces 24-hour vulnerability reporting

TLDR

The European Union now requires many digital product makers, including crypto wallet providers, to report actively exploited security vulnerabilities to regulators within 24 hours of discovery.

1. Under the Cyber Resilience Act, makers of products with digital elements must file an early warning within 24 hours, then fuller reports at 72 hours and after fixes.
2. Commercial hardware and software wallets sold in the EU fall in scope, with non?compliance risking fines up to 15 million or 2.5% of global turnover.
3. Crypto firms need always?on incident playbooks, while users may see faster official disclosure of serious wallet flaws, though reports themselves are usually confidential.

Deep Dive

1. What The New 24-Hour Rule Actually Does

The 24?hour clock comes from the EUs Cyber Resilience Act (CRA), whose incident and vulnerability reporting provisions took effect on 11 September 2026.

Manufacturers of covered products with digital elements must submit an early warning within 24 hours of becoming aware that a vulnerability is being actively exploited or that a severe security incident is underway, followed by a fuller notification within 72 hours and a final report after mitigation, typically within 14 days for vulnerabilities and one month for severe incidents.

Reports go through ENISAs Single Reporting Platform and are shared with national Computer Security Incident Response Teams, but they are not automatically public. Multiple outlets highlight this 24?hour early warning requirement and its staged follow?ups as the core change for software vendors and wallet makers.

2. Impact On Crypto Wallets And Providers

The CRA is not crypto?specific, but commercially supplied hardware wallets and wallet apps sold into the EU clearly fit the products with digital elements definition, so wallet manufacturers now sit on a 24?hour reporting clock for actively exploited flaws or serious incidents.

Coverage applies to products already on the EU market, not only new launches, and includes many free or open?source wallets when they are distributed commercially, while purely non?commercial open?source projects are treated differently and see most duties start in late 2027.

For crypto firms, failing to meet these timelines can trigger significant penalties, with reported maximum fines of up to 15 million or 2.5% of worldwide annual turnover for serious breaches of CRA cybersecurity duties.

3. What Users And Builders Should Watch Next

For builders and exchanges, the practical shift is that you may need 24/7 monitoring, clear awareness thresholds, and pre?agreed workflows so legal, security, and engineering teams can file credible early warnings before investigations are complete.

For everyday users, this does not guarantee instant public disclosure or instant fixes, but it increases pressure on wallet vendors to detect active exploits quickly and to coordinate with EU cyber authorities, which can improve systemic visibility of attacks.

Developers of open?source or niche wallets should watch EU guidance on when a project counts as a manufacturer and whether monetization or distribution choices bring them into scope.

Conclusion

The new EU cyber rules turn rapid vulnerability reporting into a legal requirement for a wide range of connected products, including many crypto wallets, with tight 24?hour early warning deadlines backed by large fines.

For crypto, the key effect is stronger regulatory oversight of wallet security and incident response, which raises compliance costs for providers but can improve how quickly serious wallet bugs and attacks are surfaced to authorities and, indirectly, to users.