EU Cyber Resilience Act requires manufacturers to report exploited flaws within 24 hours

The EU Cyber Resilience Act’s vulnerability-reporting requirements are now in effect, compressing the time manufacturers have to disclose actively exploited flaws from weeks to hours. For crypto wallet makers selling into Europe, this creates a new compliance layer that treats digital asset security as ordinary software security rather than a distinct category.

• Manufacturers must report actively exploited vulnerabilities within 24 hours of discovery under the EU Cyber Resilience Act.
• Commercial crypto wallets fall within the scope of products with digital elements subject to the regulation.
• The requirement forces engineering teams to escalate incidents and make disclosure decisions before full technical investigation is complete.

• 24 hours Initial reporting window for actively exploited vulnerabilities under the new EU rule
• 2024 Year the EU Cyber Resilience Act entered force with these provisions

The EU Cyber Resilience Act is beginning to reshape how software and hardware manufacturers respond to security incidents across the European market. As reported by NewsBTC, the framework’s most pressing requirement takes effect immediately: when a company discovers that one of its products with digital elements is suffering from an actively exploited vulnerability, regulators must receive an early warning within 24 hours. More detailed follow-up information comes later, but the initial disclosure window is non-negotiable.

Crypto Wallets enter europe’s broader software regulation

The Cyber Resilience Act is not a cryptocurrency-specific law, but its scope captures commercial hardware wallets and wallet software distributed in the EU market as products with digital elements. This classification means wallet manufacturers now operate under the same vulnerability-reporting obligations as traditional software companies, alongside existing financial regulation and data-protection rules.

Europe is treating wallet security as a component of operational resilience rather than as a distinct category separated from smart-contract risk and custody risk.

The 24-hour requirement reshapes internal Incident Response

For engineering teams, the 24-hour reporting window fundamentally changes how vulnerabilities are handled internally. A company may still be working to understand exactly how an exploit functions when the clock starts running. This forces legal, security and engineering teams to establish processes for rapid escalation and threshold assessment, rather than waiting until a full technical investigation is complete before deciding whether to report.

The law exempts purely non-commercial open-source software from these obligations, preserving a carve-out for community-driven development while applying the rule to commercial products.

The BlockWest read. Wallet operators should expect their compliance and incident-response functions to expand significantly. The 24-hour rule does not allow for the deliberation security teams traditionally use to verify exploits and assess scope before disclosure. Companies must now treat initial reporting as a time-critical decision point, with incomplete information, while preparing more comprehensive technical details for regulators afterward.

Wallet makers distributing products into EU member states should audit their incident-response procedures immediately to determine whether their current escalation timelines can meet a 24-hour threshold from vulnerability discovery to regulatory notification. The first material test of compliance and enforcement will arrive the moment a major wallet provider or software vendor faces an actively exploited vulnerability on the EU market.

BlockWest is a news publication. Nothing here is investment advice. Read our disclaimer and editorial policy.