According to CoinMeta, the EU's Cyber Resilience Act requires commercial networked hardware wallets and wallet software manufacturers within its scope to issue a warning to cybersecurity authorities within 24 hours of discovering actively exploited vulnerabilities or serious security incidents, and to submit a complete notification within 72 hours. The final report on vulnerabilities must be submitted within 14 days after remedial measures are available, while the deadline for the final report on serious incidents is one month after completing the 72-hour notification. This regulation came into effect on September 11, 2026, and also applies to related products that were previously sold in the EU market. The main product safety obligations and reporting obligations for open-source software managers will come into effect on December 11, 2027.