The reporting clock, explained
Every case moves through the same forward-only sequence. There is no state for "late" and no state for "corrected" — both are handled differently than you might expect, and that's the point of this page.
The deadlines behind each transition
| Stage | Deadline | Basis |
|---|---|---|
| Early warning | 24 hours | from recorded awareness |
| Notification | 72 hours | from recorded awareness |
| Final report (vulnerability) | 14 days | from a corrective measure becoming available |
| Final report (incident) | 1 calendar month | from notification submission, clamped at month end |
Why there's no "late" state
Overdue is computed at read time by comparing the stored dueAt against now — it
is never written as its own state. A case that's overdue still shows as
early_warning_drafting, just with an overdue countdown instead of a running one.
This is deliberate: Declara has no way to know whether you've already been in
contact with your CSIRT outside the product, so it detects and surfaces lateness
rather than asserting a consequence it isn't positioned to judge. See
What to do if you're already overdue.
Why there's no "corrected" state
A case's state is about what you have filed, and a filed stage is never reopened: what was filed stays as it was filed. What happens to a filing afterwards on the reporting platform (the CSIRT marks it valid or invalid, you correct it there, it is closed) is recorded beside the stage as its platform status, without moving the case. See Track a filing. New information can also be carried into the next stage's report, which builds on the last.
Why the platform shows a different 72-hour deadline
The reporting platform currently displays the notification as due 48 hours after the early warning was submitted. ENISA calls this a known error (FAQ 26). The legal deadline is 72 hours from awareness, which is what Declara's clocks, reminders and overdue states use. Once the early warning is filed, the timeline also shows the platform's time, labelled Platform shows, so the two can be compared.
Drills run the same clocks
An Article 14 drill is a case like any other for the state machine and the deadlines, but it sends no reminders and is left out of every live count.
Withdrawal is the one escape hatch
withdrawn is reachable from any non-terminal state and always requires a
written reason. Use it when triage turns out to have been wrong — a false
positive discovered mid-drafting, for instance — rather than leaving a case to
run down a clock that no longer applies.
What Mark submitted actually checks
A case can't move to a *_submitted state without either an SRP reference number
or a note explaining why it was filed outside the SRP. This exists so the case's
history is honest about what actually happened, not just what the clock predicted.