NewsBTC
1 hour ago
Neutral

EU requires 24-hour vulnerability reporting for digital products, including crypto wallets

2 min

Europe’s Cyber Resilience Act introduces a 24-hour early-warning requirement for actively exploited vulnerabilities in products with digital elements. Commercial crypto wallets sold in the EU fall within scope, which changes incident response expectations for wallet manufacturers and software vendors.

TL;DR

  • Early warning for actively exploited vulnerabilities: 24 hours from awareness.
  • Applies to products with digital elements sold in the EU, including commercial hardware and software wallets.
  • Non-commercial open-source development receives different treatment than commercial products.

Crypto Wallets Sit Inside A Much Bigger Rulebook

The law is not crypto-specific. It defines obligations for connected hardware and software in the EU market. Commercial wallet hardware and wallet applications qualify as products with digital elements. Wallet manufacturers must align security reporting with this framework in addition to financial and data-protection requirements.

Regulators expect quick notification when a serious vulnerability is being exploited. Waiting for a complete technical investigation is no longer the reporting model.

Twenty-Four Hours Changes Incident Response

A 24-hour reporting window requires internal escalation across legal, security and engineering teams. Companies must assess quickly whether an incident meets the threshold for early warning, often while technical analysis is ongoing.

The act distinguishes non-commercial open-source development from commercial products placed on the market. This carve-out limits obligations for purely non-commercial open-source projects while imposing duties on commercial offerings.

For crypto companies, wallet security is being regulated as standard software security. Europe is aligning custody, smart-contract and cybersecurity considerations within operational resilience.

Source: European Union Cyber Resilience Act — https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32024R2847