EU Cyber Resilience Act Brings 24-Hour Vulnerability Reporting Into Force

TL;DR

• Parts of the EU Cyber Resilience Act’s vulnerability-reporting regime are now applicable.
• Manufacturers must issue early warnings for actively exploited vulnerabilities within 24 hours.
• Commercial crypto wallets can fall within the broader category of products with digital elements.

One of the more practical pieces of Europe’s Cyber Resilience Act is starting to matter for software companies: the clock on exploited vulnerabilities is getting much shorter.

The EU framework requires manufacturers of products with digital elements to issue an early warning after becoming aware that a vulnerability is being actively exploited.

The initial reporting window is 24 hours, with more detailed follow-up information required later.

The rules sit inside the EU’s wider Cyber Resilience Act, which covers connected hardware and software products sold into the European market.

Crypto Wallets Sit Inside A Much Bigger Rulebook

This is not a crypto-specific law.

That is worth making clear because the implications for wallets come from the way the CRA defines digital products rather than from a special section written specifically for crypto.

Commercial hardware wallets and wallet software placed on the EU market can fall within the broader scope of products with digital elements.

That gives wallet manufacturers another set of security obligations to think about alongside financial and data-protection rules.

The practical expectation is simple enough: if a serious vulnerability is being actively exploited, regulators want to hear about it quickly.

Waiting until a full technical investigation has been completed is no longer the model.

Twenty-Four Hours Changes Incident Response

For engineering teams, a 24-hour warning requirement changes how vulnerabilities are handled internally.

A company may still be trying to understand exactly how an exploit works when the reporting obligation begins.

That means legal, security and engineering teams need a process for escalating an incident quickly enough to decide whether the threshold has been met.

The law also draws distinctions around open-source software.

Purely non-commercial open-source development receives different treatment from commercial products placed on the market, an important carve-out for the wider software ecosystem.

For crypto companies, the main lesson is that wallet security is increasingly being regulated as ordinary software security.

That may sound obvious, but historically the crypto conversation has tended to separate smart-contract risk, custody risk and cybersecurity into different buckets.

Europe is increasingly treating them as overlapping parts of the same operational-resilience problem.

This article was written by the News Desk and edited by Samuel Rae.