# EU Mandates 24-Hour Vulnerability Reporting Under Cyber Resilience Act Software manufacturers must now report actively exploited vulnerabilities within a day. - **Source:** [NewsBTC](https://brifing.si/source/1757e8d5-352f-4479-994f-79c6e6161b17) - **Published:** 2026-09-19 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/3d68bcdd-19d6-45b5-aec5-5fc626c20545 ## Immediate vulnerability warnings The EU Cyber Resilience Act now requires manufacturers of digital products to issue early warnings within 24 hours of discovering actively exploited vulnerabilities. This applies to all connected hardware and software sold in the EU market, including commercial crypto wallets. The regulation shifts from waiting for full technical investigations to rapid initial alerts. Detailed follow-up reports remain required after the initial notification. ## Broad digital product scope Crypto wallets fall under these rules not as a special category, but as part of the broader 'products with digital elements' definition. This means wallet manufacturers must comply with both financial regulations and these new cybersecurity obligations. The Act intentionally avoids singling out specific technologies, applying equally to all commercial digital products in the EU market, whether hardware or software. ## Open-source exception The regulation distinguishes between commercial products and purely non-commercial open-source development. Only products placed on the market for commercial purposes must comply with the 24-hour reporting rule. This carve-out protects volunteer-driven open-source projects while ensuring commercial entities maintain proper security accountability for their distributed products. ## Incident response overhaul Engineering teams must now establish processes to evaluate and escalate potential vulnerabilities within the 24-hour window. Legal, security, and technical departments need coordinated workflows to assess whether an active exploit meets reporting thresholds. This compressed timeline forces organizations to make preliminary judgments before complete technical understanding is available. ## Crypto security normalization The Act treats crypto wallet security as conventional software security, merging historically separate discussions about smart contracts, custody, and cybersecurity. This regulatory approach reflects growing recognition that blockchain-based products face similar operational resilience challenges as traditional digital products, requiring comparable security protocols and disclosures. ## Threshold determination challenge Companies must develop internal criteria to identify when an exploit becomes reportable under the 'actively exploited' standard. The regulation doesn't specify technical thresholds, leaving manufacturers to interpret reporting obligations. This creates operational complexity, particularly for distributed teams needing rapid consensus across legal and technical functions. ## Follow-up reporting requirements After the initial 24-hour alert, manufacturers must provide detailed technical information about the vulnerability and remediation status. The Act establishes a two-phase disclosure process: immediate notification followed by comprehensive analysis. This balances rapid awareness with thorough technical understanding for effective vulnerability management. ## EU-wide security standardization The Cyber Resilience Act creates uniform cybersecurity expectations across the EU digital market. By mandating consistent vulnerability reporting, it aims to improve overall ecosystem resilience through faster threat intelligence sharing. The regulation represents a significant shift toward proactive, time-bound security obligations for all commercial digital products. ## Sources covering this story - https://www.newsbtc.com/news/eu-cyber-resilience-act-brings-24-hour-vulnerability-reporting-into-force/ — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._