Article 17(4) of the RED provides that where the harmonised standards have not been applied, or have been applied only in part, for the Article 3(2) or Article 3(3) essential requirements, the manufacturer must use EU-type examination followed by conformity to type based on internal production control (Modules B and C) or full quality assurance (Module H). For this Regulation that route is compulsory in three situations: the manufacturer chooses its own specification or applies EN 18031 only partly; the product's design falls within one of the Official Journal restrictions that the manufacturer cannot avoid; or the product is financial-asset equipment subject to clause 6.3.2.4 of EN 18031-3, where third-party assessment is always required. Only notified bodies listed on NANDO for Article 3(3)(d), (e) or (f) may issue the EU-type examination certificate; the manufacturer may use a different notified body for the cybersecurity aspects than for the other RED requirements. The certificate is tied to the product, the standards and the state of the art, and loses validity when any of them changes, so the file must record the certificate's scope and the triggers for re-examination.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.