Every modification of the vehicle type that affects its technical performance with respect to cyber security or the documentation required by the Regulation is notified to the approval authority that approved the type, which then either considers the approval still valid (8.1.1) or carries out a complementary assessment under paragraph 5 and may require a further test report (8.1.2), and communicates confirmation, extension or refusal on the Annex 2 form with an extension number (8.1.3). The Interpretation Document's table: a new E/E architecture or a change altering the risk assessment outcome through new technology (a new external interface, a new gateway) needs a new type; replacing or adding a subsystem with minor changes to the outcome (a 5G unit replacing UMTS, an ECU gaining an HSM) needs an extension; a like-for-like replacement needs neither.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.