This page reflects our reading of Cyber Resilience Act, Article 14(2) as of . It is not legal advice. Review process.
What "overdue" actually means
overdue isn't a stage a case gets pushed into and isn't escalated by the product.
It's computed every time the case is read, by comparing the stage's due date against
the current time. There is no separate database record for "this case is late," and
no automatic penalty logic runs when a deadline passes — the case simply shows
overdue instead of a countdown, on whichever stage hasn't been submitted yet.
What to do
File as soon as you can. The regulation's actual standard is to report "without undue delay" within the relevant window — it is not a hard cutoff that voids a filing made after the deadline has passed. Being late doesn't relieve you of the obligation to file; it means filing now, honestly, is still the right move.
Steps: filing an overdue stage
- Open the case. The stage that's overdue shows an overdue countdown rather than a running one.
- Start (or continue) drafting that stage the same way you would on time — see File an initial Article 14 report, File the 72-hour notification, or File the final report.
- File it on the SRP web form yourself, the same as any other stage.
- Return to the case and click Mark submitted.
Marking a stage submitted after the fact
A stage can't be marked submitted without one of two things:
- an SRP reference number, once you've filed on the platform, or
- a note explaining an offline filing — for the rare case where you contacted your CSIRT directly rather than through the SRP.
The case won't accept neither. If you filed outside the SRP and don't record why, the case has no way to know the filing happened at all, and will keep showing overdue even after you've actually reported it.
If the case shows overdue but you already filed
This is almost always a missing SRP reference or offline-filing note, not a bug. See Troubleshooting.