As you indicate, some devices have to function according to your documentation. But even that doesn't mean that they work. For example, an EEG machine may blink lights and show some graphs on the screen, but it doesn't mean that it produces any useful output. The standard is only concerned with using it during the test as a customer would.
Most of the compliance testing is done based on honesty of everyone involved. For example, if you are certifying a gadget you test what you are going to manufacture, and not a hand-built and hand-optimized version of it. The lab people wouldn't know the difference because they aren't going to travel to China to see what comes from the production line. A less than honest manufacturer can always test a product that is built well enough, and then manufacture a cheaper version of it. In essence, as long as he is not sued nobody would ever know what he did.
For example, Rossi uses an electric heating element, presumably in contact with the water flowing through the system. He would have to document that his device will not electrocute someone because of this. The easiest way of doing this is to buy a heater that is already CE certified to work in that environment, which is probably what Rossi did. He would then have to document that he is using that particular heater, and that he is using it as designed.
I would be interested in knowing whether his application mentions nuclear fusion. It might be that nuclear processes are outside of the jurisdiction of CE, and they might ignore it since it is outside of their jurisdiction.
But, presumably, there is some government organization that does have jurisdiction for any sort of nuclear reactor, and if Rossi is running his reactor without their knowledge and consent, he could be in serious trouble because of it. Especially if he blows up the city when his reactor goes supercritical.
Of course, if he isn't really doing any nuclear process, he wouldn't need to worry about certification from any nuclear agency.