[Iv]

Usually CE regulations do not care if you hired an auditor or not. They only care about the regulations being obeyed. My understanding is that warning the users of the level of security they can expect, and handling security flaws reasonably is probably going to be enough.