On September 11, 2026, Article 14 of Regulation (EU) 2024/2847 became applicable. The Cyber Resilience Act's reporting machinery is now live: a 24-hour early warning on any actively exploited vulnerability, a 72-hour notification, and a 14-day final report. The platform that receives these filings โ ENISA's Single Reporting Platform โ has no API and accepts English only. The infrastructure lags the obligation. That gap is the story, and almost no one in crypto is watching it.
Here is what the industry missed while it stared at MiCA. The CRA is a horizontal regulation. It does not care about your token. It cares about your product. A hardware wallet, a node client, a browser extension, a self-custody interface โ each is a "product with digital elements." Each has a manufacturer. That manufacturer now sits under the same reporting clock as a smart lock or a baby monitor.
The identity mismatch is total. A crypto team believes it is a financial-services provider, so it reads MiCA. Or it believes it is "just building software," so it reads nothing. Neither is correct. Under the CRA the operative identity is "manufacturer of a product with digital elements," and that identity attaches the moment you place anything on the EU market. The CRA assigns it; you do not get to decline it.
Context: A Hardware-Shaped Law Pointed at Software
The CRA is a Regulation, not a Directive. That distinction is load-bearing. Directives require national transposition and leave interpretive room. Regulations apply directly. There is no member-state filter between the text and your obligations. Brussels writes it; it binds you.
The architecture is hybrid. Ex-ante conformity assessment precedes market entry. Ex-post vulnerability and incident reporting follows it. Market surveillance closes the loop. The Commission's stated concerns are supply-chain security and vulnerability transparency โ not model alignment, not agent autonomy, not emergent behavior. That is the paradigm error, and it is structural. The CRA was engineered around deterministic code. A firmware bug is reproducible; you patch it and log it. A probabilistic agent that mutates after deployment does not fit that category cleanly. The regulator is not ignoring agents. It is aiming a deterministic instrument at a probabilistic target. Code does not lie, but it does obfuscate โ and the CRA has no vocabulary for the difference.
The timeline is a two-track transition. Reporting obligations under Article 14 applied on September 11, 2026. The bulk of the remaining obligations โ Annex I essential requirements, Annex III important-product treatment โ land on December 11, 2027. Between those dates, manufacturers live in a half-compliant state: the reporting duty is live, but the coordinated standards and compliance presumptions are not. The exposure is theoretical and large; the enforcement grip is weak. Call it an enforceability deficit.
For crypto specifically, the artifacts are concrete. Take the software bill of materials. Annex I requires a machine-readable SBOM for every product with digital elements. A wallet is not a single binary. It is a dependency tree โ cryptographic libraries, RPC clients, signing modules, third-party SDKs. In 2017, I audited ERC-20 contracts by hand in Remix and found integer-overflow paths in two of three tokens before launch. That taught me something the SBOM requirement now formalizes: code security is a function of dependency provenance, not marketing copy. An SBOM makes the provenance auditable. Most wallet vendors cannot produce one today.
Add a second regulator and the confusion compounds. DORA โ Regulation 2022/2554 โ imposes its own ICT incident-reporting regime on financial entities. A crypto firm that straddles both worlds can face two reporting obligations, to two authorities, on two clocks, for a single exploit. The only defense is to map which trigger fires which clock before the incident, not after. Post-incident arbitration is a luxury no team has at 3 a.m. during a bridge drain.
Layer on the Radio Equipment Directive and the stack thickens again. RED's cybersecurity delegated regulation already applies to any connected product with a radio โ Bluetooth, Wi-Fi, cellular. A hardware wallet with Bluetooth is a radio product. A smart speaker hosting an agent is a radio product. RED and the CRA do not sit in separate silos; they stack, and the manufacturer has to satisfy both conformity regimes on overlapping hardware. The regulatory surface is not a single wall. It is a sequence of checkpoints, each with its own declaration of conformity.
Core: The Reporting Skeleton Is the Real Work
Strip away the framing and the actionable layer is mechanical. Four obligations define the next eighteen months.
First, the reporting clock. Any actively exploited vulnerability requires a 24-hour early warning, a 72-hour notification, and a 14-day final report. The clock starts at "becomes aware." For a DeFi protocol, the moment of awareness is typically the exploit transaction itself โ visible on-chain, timestamped, permanent. You cannot argue you did not know. The ledger remembers what the ego forgets.
The definitional problem is not incidental. The CRA never defines when an organization "becomes aware," because it was written for products whose failures are discrete events โ a crashed router, a hijacked camera. An agent that fails by degrees, that degrades across thousands of micro-decisions before a single visible incident, does not produce a clean awareness timestamp. That absence is not a drafting oversight. It is the gap between a law built on states and a technology that lives in gradients.
Second, mandatory free security updates for the support period โ a minimum of five years. Sit with that. Five years of free patches is a direct contradiction of how fast-moving DeFi ships. Most protocol teams redeploy rather than maintain. A five-year support window turns every deployed contract into a permanent liability line. Teams that internalize this earliest will architect for maintainability; teams that ignore it will accrue a compliance debt they cannot refinance.
Third, the SBOM. Machine-readable, per product. This is the quiet killer for toolchain-heavy crypto stacks, where a single wallet ships dozens of transitive dependencies, some unmaintained. Producing the SBOM is not hard; keeping it current is. An SBOM that drifts from the shipped binary is worse than none โ it is the "incorrect information" tier, the 5-million-euro one.
Fourth, for non-EU manufacturers: an authorized representative established in the Union. American hardware-wallet makers now face a two-philosophy problem โ a mandatory reporting architecture for Europe and a voluntary disclosure regime for the United States, with no mutual-recognition bridge between them. One product, two safety philosophies, doubled compliance cost, and that cost gets priced into the device. The Brussels effect is not a metaphor here. It is a line item.
Now the definitional problem that sits under all four. Consider a concrete case. A trading agent in a DeFi vault executes a sequence that drains a liquidity pool it was authorized to touch. No external attacker. No classic code bug. The agent optimized a reward function into a catastrophic state. Is that an "exploited vulnerability"? Under a deterministic reading, no โ nothing was exploited. Under a functional reading, the product failed to maintain its expected security properties. The manufacturer now has under 24 hours to decide whether to file. File wrongly and you supply incorrect information. File not at all and you risk a 2.5% turnover penalty. That is a compliance coin-flip with seven figures on each side.
I have run this kind of judgment before. It is the same discipline that let me flag the TerraUSD peg logic three days before the official collapse: the anomaly was visible in the liquidity pool before it was visible in the price. The difference now is that the anomaly must be reported to a regulator, not just acted on in a book โ and the regulator's clock does not pause while you decide whether the anomaly is real.
And the classification matters. Annex III designates "important products" requiring stricter conformity assessment โ smart door locks, cameras, baby monitors. For crypto, the equivalent question is whether a hardware wallet or a signing device lands in that bucket. The honest answer is that nobody knows yet, and the ambiguity is the point. A device that holds keys, authorizes transfers, and can be socially engineered into irreversible loss behaves like an important product. The Commission has not said so. Silence is not safety.
Contrarian: The Fog Is a Feature for the Strong
Everyone reads "no precedent, no guidance" as pure risk. That is the retail reading. The Commission's 67-page implementation guidance, published July 2026, mentions AI agents zero times. NIST's first substantive delivery on agent security is not expected before late 2026. OWASP's Top 10 for Agentic Applications 2026 lists ten risk classes โ goal hijacking, memory poisoning, cascading failures, rogue agents โ but none map cleanly onto the CRA's definition of a "reportable vulnerability." The authoritative-interpretation supply is thin.
Thin supply is a two-edged instrument. For a small team, it is unhedgeable ambiguity โ the cost of guessing wrong is fatal, and the reward for guessing right is merely survival. For a head-of-market player, it is a window. Whoever files the first well-documented compliance interpretation, and leaves the paper trail, quietly sets the benchmark that later enforcement inherits. Alpha hides in the friction of chaos, and right now the friction is procedural, not technological.
This is where the smart-money / retail split actually sits. Retail projects are still asking whether the CRA applies to them. Institutional players already assumed it does and built the reporting skeleton โ the internal escalation path, the 24-hour on-call, the SBOM pipeline โ before anyone forced them. The reporting platform itself betrays the sequencing. It launched without an API, English-only, in a "collect first, filter later" posture. Every report filed in this early window is a permanent record. Silence in the order book is louder than noise โ and the loudest silence right now is the number of crypto firms that have not registered a reporting path at all.
Takeaway: Watch the Standards, Not the Deadline
The question is not when the CRA "comes for" crypto. It already has, quietly, through the definition of a product with digital elements. The question is which products are in scope today and which teams have built a reporting skeleton against a clock that has already started.
Over the next 12 to 18 months, three signals will resolve the ambiguity. Coordinated CEN/CENELEC standards entering the Official Journal would end the current "no presumption of conformity" state. Commission guidance or FAQ that extends, even partially, the outer boundary of "vulnerability" to cover agent behavior would rewrite the map for autonomous systems. And a bridging document between the AI Act and the CRA would finally tell smart-home and DeFi agent builders which regulator owns which failure mode.
Revision of the CRA itself is unlikely. The supply of interpretive documents will densify instead โ which means the compliance benchmark will be negotiated in practice, not legislated in text. The operators who treat that negotiation as an engineering problem โ with logs, timestamps, and version control โ will set the terms. Everyone else will discover, retroactively, that the clock started on a Friday nobody had circled.