From what I see [1] if you search for 'undue delay', it's only:

> an early warning notification of an actively exploited vulnerability, without undue delay and in any event within 24 hours of the manufacturer becoming aware of it

> without undue delay and in any event within 72 hours of the manufacturer becoming aware of the actively

> without undue delay and in any event within 24 hours of the manufacturer becoming aware of it

> without undue delay and in any event within 72 hours of the manufacturer becoming aware of the incident

"Sorry your honour, we only became 'aware of it' 2 years later, pinky promise ;)".

So any competant authority would have to prove when they 'became aware of it', whatever the test to pass that threshold means.

[1]: https://eur-lex.europa.eu/eli/reg/2024/2847/oj/eng