New EU Reporting Mandates for Crypto Wallet Manufacturers

The European Union has officially entered a new era of digital security oversight with the implementation of the Cyber Resilience Act (CRA). This horizontal product law specifically targets commercial manufacturers of digital products, including connected hardware wallets and downloadable wallet software. As of September 11, 2026, these entities are legally required to notify cyber authorities of actively exploited vulnerabilities or severe security incidents within a strict 24-hour window.

A Strict Multi-Stage Reporting Timeline

The regulatory framework establishes a rigorous sequence for transparency to ensure rapid response to digital threats. Manufacturers must first file an "early warning" through a centralized platform managed by ENISA, the EU cybersecurity agency, no later than 24 hours after becoming aware of an issue. This is followed by a detailed notification within 72 hours that includes an assessment of the incident and any corrective measures taken. The process concludes with a final report, due either 14 days after a vulnerability is mitigated or one month after the initial incident notification.

Scope of Coverage and Open-Source Implications

The CRA applies to any hardware or software with digital elements intended for data connection, which encompasses most modern crypto wallet solutions. Notably, the reporting rules apply to existing product lines already on the market, not just new devices released after the law's full implementation. The legislation also clarifies the status of open-source projects, noting that while non-monetized software is generally exempt, commercially supplied open-source products must adhere to these manufacturer obligations. By centralizing incident reporting through ENISA, the EU aims to provide a coordinated defense for users and ensure that manufacturers remain accountable for the security of their products throughout their lifecycle.