Traceable Cybersecurity Conformity Pre-Assessment of Electric Vehicle Charging Equipment Using Cross-Standard Gap Analysis and a Local LLM

Abstract

Electric vehicle charging equipment now links vehicles, payment and roaming services, cloud platforms, and the grid, but its cybersecurity requirements are fragmented across standards. This study combines a cross-standard gap analysis with a traceable conformity pre-assessment framework for a local large language model; the framework is a design-validation proof of concept, not a production-ready conformity-assessment system. Using EN 18031 as the reference axis, IEC 62443-4-2, ETSI EN 303 645, and NIST IR 8473 requirements were mapped on a five-level correspondence scale by a single researcher and consolidated into integrated requirements with applicability, evidence, and acceptance rules. A clause-aware retrieval-augmented generation pipeline (semantic retrieval only) was compared with no-retrieval and fixed-length baselines on 80 synthetic design-gold cases, reported on the 44 holdout cases not used for tuning. Better retrieval did not ensure trustworthy conformity reasoning: retrieved clause text in the judgment prompt lowered verdict accuracy (0.89 without, 0.77 with), the most accurate configuration (0.93) used retrieval only for citations, and a rule-based classifier with no model or corpus reached 0.66 on the same cases. Citation extraction, citation verification, and human review were each necessary. Extraction guarantees citation existence, but exact-gold-clause agreement remained at most 0.38. External validity on real manufacturer documents is untested; the framework complements rather than replaces accredited certification.