A trio of harmonised standards, EN 18031-1:2024 for network protection, EN 18031-2:2024 for the privacy of internet-connected, childcare, toy and wearable equipment, and EN 18031-3:2024 for fraud protection of financial assets, were cited in the Official Journal in January 2025 in Annex I to Implementing Decision (EU) 2022/2191, each with restrictions. A manufacturer that applies the relevant standard in full, and is not caught by a restriction, may self-assess under Module A and benefit from the presumption of conformity. The restrictions, as explained in the Commission's guidance, are: the sections headed rationale and guidance are informative and give no presumption; where the default password clauses (6.2.5.1 or 6.2.5.2) would let a user run the product with no password at all, the presumption is lost, so the manufacturer must not offer that option; for toys and childcare equipment under EN 18031-2, the access control clauses give no presumption unless parental or guardian control over access is provided; and under EN 18031-3 the secure update assessment criteria in clause 6.3.2.4 never give a presumption for financial assets, so those products always go to a notified body. Partial application of a standard, or a different specification, is allowed but moves the product to the notified body route.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.