EU requires wallet makers to report breaches within 24 hours

From Sept. 11, 2026, the Cyber Resilience Act requires commercial makers of connected hardware wallets and downloadable wallet software offered in the EU to send an early warning to cyber authorities within 24 hours of becoming aware of an actively exploited vulnerability or a severe security incident.

The rule applies to manufacturers of products with digital elements that are made available on the EU market and whose intended or reasonably foreseeable use includes a direct or indirect data connection to a device or network. Whether a specific hardware wallet or wallet app falls under the rule depends on how the product is supplied and any applicable exclusions; Commission guidance does not name brands or automatically cover every wallet service or project.

Manufacturers must file an early warning without undue delay and no later than 24 hours after awareness. The early warning should identify, where applicable, the member states where the product is known to have been made available and, for severe incidents, indicate whether unlawful or malicious acts are suspected. A more detailed notification is due within 72 hours unless the relevant information was already provided.

For actively exploited vulnerabilities, the 72-hour notification must include general information about the product, the exploit and the vulnerability, plus any corrective or mitigating measures. For severe incidents, that filing must describe the nature of the incident, provide an initial assessment and list available mitigation measures. A final vulnerability report is due no later than 14 days after a corrective or mitigating measure becomes available. A final severe-incident report must be filed one month after the 72-hour notification, as set out in the regulation.

All notifications must be submitted through the Single Reporting Platform operated by ENISA, the EU cybersecurity agency. The portal forwards reports to the coordinating Computer Security Incident Response Team designated by the member state, makes the information available to ENISA and supports distribution to other relevant national teams. Manufacturers must also inform impacted users and, when appropriate, all users about required actions and steps they can take to protect themselves.

The rapid reporting rules cover products already placed on the market before Dec. 11, 2027, so existing wallet product lines are included as well as new releases. The CRA is a horizontal product law; its main product-security duties, including obligations on secure design and product lifecycle management, take effect on Dec. 11, 2027.

The Commission’s guidance addresses open-source software. Commercially supplied free and open-source products can be in scope and face manufacturer obligations. Non-monetized software supplied by its manufacturer generally should not count as commercial activity, and individual contributors are not treated as manufacturers for software outside their responsibility. A separate legal category for open-source stewards carries reporting duties beginning on Dec. 11, 2027.