EU Cyber Resilience Act’s 24-Hour Bug Rule Takes Effect, Single Report Confirms

Parts of the European Union’s Cyber Resilience Act have become applicable, putting a 24-hour clock on how quickly software makers must disclose actively exploited vulnerabilities. That detail comes from a single detailed report as of September 19, 2026; a second independent account with matching specifics was not available at the time of writing.

The provision that is now in force covers “products with digital elements,” the CRA’s catch-all term for hardware and software sold into the EU market. Manufacturers must issue an early warning as soon as they become aware a vulnerability in their product is being actively exploited, with a more detailed follow-up report required afterward.

What the reporting window actually covers

The 24-hour figure applies specifically to the initial notification, not the full incident report. Under the CRA framework, that first alert flags that exploitation is happening; a fuller technical writeup follows on a longer timeline set out elsewhere in the regulation.

The available reporting does not specify which EU authority receives these notifications, what penalties apply for missing the window, or the precise date the obligation became binding for different categories of manufacturer. Those gaps matter for anyone trying to build a compliance checklist rather than just track the headline number.

Why crypto wallet software sits inside the scope

Commercial crypto wallets can fall within the CRA’s “products with digital elements” category, according to the same account. That would place wallet providers distributing software commercially in the EU under the same 24-hour early-warning duty as any other consumer software vendor once a vulnerability is confirmed under active exploitation.

For a wallet maker, that means the gap between discovering an exploited bug and having to notify regulators is now measured in hours, not the weeks some vendors have historically taken for coordinated disclosure. The reporting available does not detail whether non-custodial, open-source wallets face the same threshold as commercial custodial products, a distinction that will matter to smaller teams shipping software without a formal compliance function.

What remains unverified

Because this account rests on one detailed source rather than two independently corroborating ones, Cryptaur is treating the scope and enforcement mechanics as reported, not confirmed. Builders operating in the EU should check the European Commission’s own CRA guidance before assuming their product falls in or out of scope, rather than relying on secondary summaries.

A separate wire item circulating the same day claimed an Avalanche network upgrade was scheduled for September 22, but it carried no confirmable detail beyond a headline and a date. It is excluded from this report pending a second source with substance.

Read more: FCA’s UK Crypto Gateway Opens Sept. 30, Applications Run to Feb. 28

Sources

• bitcoinist.com
• newsbtc.com