The latest on the EU's Cyber Resilience Act: Why do crypto wallets face a 24-hour repair deadline?

The EU's Cyberelasticity Act comes into effect: What changes are facing cryptowallets?

This month, there has been a major shift in the field of crypto security regulation. Eligible manufacturers of commercial connected hardware wallets and wallet software must alert European cybersecurity authorities within 24 hours after discovering a vulnerability or serious security incident that is being exploited.

This obligation will take effect on September 11, 2026, under the European Union's Cyber Resilience Act. This is a broad product safety regulation that has implications far beyond the realm of encryption, but is now substantively binding on manufacturers selling wallets to the EU market.

Overview of core points

• New reporting obligations: Effective September 11, 2026, applicable to eligible commercial connected wallet hardware and software.
• Early Warning: Manufacturers must send early warnings within 24 hours after discovering a defect or serious event that is being exploited.
• Complete notification: Complete notification must be submitted within 72 hours, with an additional deadline for the final report.
• Reporting channel: Submission is made through ENISA (European Cyber Security Agency)'s new single reporting platform.
• Broader safety framework: Other regulations, including the CE mark, will not come into effect until December 11, 2027.

Which crypto wallets are governed by the EU Cyberelasticity Act?

The law is not written specifically for digital assets, but is a horizontal product rule. This rule applies to goods applicable to hardware and software and placed on the EU market, as long as the intended or foreseeable use of the product includes data connection to a device or network. Commercially available connected hardware wallets and downloadable wallet applications may meet this standard.

It should be noted that regulators have not yet released a specific list of brands covered, and not all crypto wallet items or services are automatically eligible. Whether a particular product is within jurisdiction depends on the way it is supplied, connectivity, and exemptions that may apply.

Source: CRA official page

Cryptowallet vulnerabilities must be reported within 24 hours

This is the most significant change. The countdown begins as soon as the manufacturer becomes aware of a vulnerability or serious security incident that is being exploited. The initial declaration must be completed as soon as possible without delay and no later than 24 hours.

Warning messages must indicate which member states have received the affected products; for serious incidents, they must also state whether malicious activity is suspected.

CRA requires deadline coverage Early warning within 24 hours Full notification of defects or critical events being exploited within 72 hours Detailed vulnerability or event information within 14 days after fixes are available Corrections and mitigations Final event report within 1 month after 72 hours after declaration Final assessment of incidents What must the wallet manufacturer include in the report

The second declaration (which should be submitted within 72 hours) is more in-depth. For vulnerabilities, product details, information about the exploit attack, and ongoing fixes or mitigations must be supplemented.

For serious events, the manufacturer must describe the event, share preliminary assessments, and outline available mitigation steps. If action needs to be taken, affected users must also be notified directly, sometimes including a broader user group.

ENISA's reporting platform becomes the main avenue

Manufacturers only need to submit a report once through the "single reporting platform" operated by the European Union's cybersecurity agency ENISA. The portal forwards submissions to the relevant national Incident Response Service team and makes data available to ENISA to share with other national teams when needed.

Source: CryptoSlate article

Regulations also apply to wallets already sold in the EU

One detail that is easily overlooked: This reporting obligation already applies to qualified products sold before December 2027, not just new wallets introduced after the law takes full effect. Open source projects are not automatically exempt from liability.

Although non-monetized software is treated differently from individual contributors who work outside the scope of its direct responsibility, commercially distributed open source wallet software may still trigger obligations on manufacturers. Specifically, the reporting obligations of open source managers begin in December 2027.

Follow-up progress: Comprehensive CRA obligations will begin in December 2027

September 11 only marks the start of a fast-track reporting obligation, not a comprehensive legal rollover. The broader product safety framework, including "design is safe" requirements, life cycle obligations and the CE marking, will become mandatory on December 11, 2027.

In addition, it is expected that two rounds of technical standards will be introduced in October and December 2026 before this.

Conclusion

For the crypto market, the current direct impact is that the regulatory reporting window is much stricter than what most wallet manufacturers have previously followed. Users will not yet see CE marked wallets or extensive design mandatory requirements because these won't take effect until the end of 2027, but the clock for serious flaws and incident disclosures is already running.

Wallet manufacturers selling to the EU market, and users who rely on their products, should view it as the first real implementation milestone of the Cyberelasticity Act, rather than just a symbolic starting point.