The European Union's Cyber Resilience Act took effect on 11 September 2026, requiring crypto wallet makers to report actively exploited bugs within 24 hours. Full notification follows within 72 hours, with fines reaching 15 million euros for breaches.