# How a Voting System Is Certified and Decertified The chain that decides what machine a voter actually touches, drawn end to end — and the fact that **not one link in it is mandatory**. The [[Election Assistance Commission]] accredits the test laboratories; a laboratory tests a system against the [[Voluntary Voting System Guidelines]]; the EAC certifies; and then **fifty states decide separately whether federal certification means anything at all.** [[Help America Vote Act]] participation in the certification program is voluntary by statute. The standard binds because roughly thirteen states have written federal certification into their own procurement law, another thirteen require testing *to* the federal standard, and about fifteen more require testing *by* a federally accredited laboratory — so a voluntary guideline functions as a national floor by fifty independent decisions, and could be abandoned the same way. Beside the certification track runs the decertification track, which is where the 2020–26 fights actually landed: who can pull a system, on what showing, mid-cycle or not, and what a county does with equipment it already owns and has already paid for. The single structural fact this map exists to show: **the pipeline has four gates that require three EAC commissioners, and since July 2026 there have been none — but certification is not one of the four.** Career staff may keep certifying systems against VVSG 2.0 under delegated authority. What they cannot do is adopt a revised standard, accredit a new laboratory, revoke an existing laboratory's accreditation, or hear a decertification appeal. The floor can be neither raised nor lowered. It is not a shutdown; it is a ratchet welded in place, and the welding happened nine weeks before a midterm. It is the equipment-layer companion to the vault's other election maps. [[State Election Administration Tree]] shows who administers the machinery; [[How a Candidate Gets on the Ballot]] covers who appears on it; [[How a Midterm Election Is Certified]] begins after the votes are counted. > [!note] How to read this chart > `──▶` = the main path · `└─▶` = a branch or bypass · `◇` = a decision point · `⚑` = a load-bearing stage · `❄` = **a gate that requires three commissioners and is therefore frozen** · `✕` = the route ends · `[ ]` = a dated note or caveat. The left column is the federal track; the decertification block at the bottom carries both the federal route and the state route, which are the ones that actually fire. Everything inside the fence is plain text; linked entities appear in the prose, Notes, and See also. ``` HOW A VOTING SYSTEM IS CERTIFIED AND DECERTIFIED (as of 27 September 2026) │ Legend: ──▶ main path └─▶ branch ◇ decision ⚑ load-bearing ✕ route ends │ ❄ FROZEN — requires 3 EAC commissioners; there have been ZERO since 9 Jul 2026 │ Scale: 2 accredited test laboratories nationwide · 3 manufacturers supplying most of │ the country · 2 systems certified to the current standard · 0 commissioners. │ [ 52 U.S.C. § 20928: "any action which the Commission is authorized to carry │ out . . . may be carried out only with the approval of at least three of its │ members." EAC guidance, Aug 2026, applies that to the ❄ gates below. ] │ ■ 0. THE STANDARD ITSELF ⚑❄ (what a system is measured against) │ NIST director chairs the Technical Guidelines Development Committee ──▶ TGDC drafts │ the Voluntary Voting System Guidelines ──▶ ❄ THE COMMISSION ADOPTS THEM BY VOTE. │ ├─ VVSG 1.0 (2005) · VVSG 1.1 (2015) · VVSG 2.0 (adopted 10 Feb 2021). │ ├─ Since 16 Nov 2023, VVSG 2.0 is the ONLY version accepting new submissions. │ │ Systems certified to 1.0 and 1.1 stay valid — most fielded equipment is 1.x. │ └─ ❄ VVSG 2.1 was circulated to TGDC members in draft in June 2025 and CANNOT BE │ ADOPTED. The drafting body is functioning; the adopting body does not exist. │ [ A TGDC vacancy was noticed in the Federal Register, 9 Mar 2026. ] │ ├─◆ 1. THE LABORATORY ⚑❄ (who is allowed to do the testing) │ ◇ is the lab accredited? │ ├─ NIST NVLAP reviews technical competence ──▶ recommends to the EAC │ ├─ EAC reviews the NON-technical side: conflict-of-interest policy, organizational │ │ structure, recordkeeping ──▶ ❄ THE COMMISSION VOTES ON ACCREDITATION. │ └─ ✕ THE ENTIRE FEDERAL TESTING ESTATE IS TWO PRIVATE FIRMS: │ Pro V&V (Huntsville, AL) · SLI Compliance (Wheat Ridge, CO — a division of │ Gaming Laboratories International, which tests casino equipment). │ ❄ No third lab can be added and neither can be revoked. The set is fixed. │ ├─◆ 2. REGISTRATION (the manufacturer enters the program) │ Organizational information · manufacturing facilities · quality-assurance policy · │ change-management procedures ──▶ Program Director reviews for completeness. │ ├─◆ 3. APPLICATION (the system is named and the standard is chosen) │ System specification · functional diagrams · components · accessibility capabilities │ ├─ THE MANUFACTURER PICKS ITS OWN LABORATORY — and pays it. │ │ [ A structural feature of the program, not an irregularity: the vendor selects │ │ and funds its own examiner, and the same two labs also test for the states │ │ that run certification programs on top of the federal one. ] │ └─ EAC accepts or rejects the application within 5 business days. │ ├─◆ 4. TEST READINESS REVIEW (before the clock starts) │ Technical Data Package review · physical inspection · preliminary source-code review │ of at least 1% of total code. │ ├─◆ 5. TEST PLAN (the scope is fixed here, and scope is everything) │ ◇ new system or modification? │ ├─ NEW ──▶ full testing of all hardware and software. │ └─ MODIFICATION ──▶ delta testing (the change) + regression testing (what the change │ touched) + system integration testing. NARROWER BY DESIGN. ──▶ see stage 10. │ Program Director approves; testing may not begin until he does. │ ├─◆ 6. PENETRATION TESTING AND THE TRUSTED BUILD ⚑ │ Phase I vulnerability and threat analysis ──▶ Phase II actual penetration testing │ └─▶ TRUSTED BUILD: the source code is compiled in a controlled environment into │ cryptographically verified executables, and the build is deposited with the EAC. │ This is the artefact a state or county can later hash a machine against — the │ only point in the pipeline that produces an independently checkable object. │ ├─◆ 7. TESTING (against the VVSG version chosen at stage 3) │ Failures and anomalies documented · manufacturer performs root-cause analysis │ └─▶ ✕ systems idle more than 90 days, or 18 months without a test report, are │ returned to the manufacturer. │ ├─◆ 8. TEST REPORT ──▶ EAC TECHNICAL REVIEW │ The laboratory RECOMMENDS. It does not certify. │ Program Director approves the report or sends it back. │ ├─◆ 9. THE CERTIFICATION DECISION ⚑ ← NOT FROZEN, AND THAT IS THE POINT │ Software deposited in the EAC repository · hardware photographs and software │ verification tools supplied ──▶ THE DECISION AUTHORITY ISSUES THE CERTIFICATION. │ ├─ Under Testing and Certification Program Manual v3.0, this runs on DELEGATED │ │ authority through the Certification Division and the Executive Director — │ │ so it survives the absence of commissioners. Staff may still certify. │ ├─ Output: a unique certification number + a Certificate of Conformance. │ └─ [ 3 product lines (4 certificates) are certified to VVSG 2.0 as of late Sep │ 2026. The first was Hart InterCivic's Verity Vanguard, 7 Jul 2025 — more │ than four years after the standard was adopted, and twenty months after it │ became the only standard on offer. ] │ ├─◆ 10. THE FIFTY-STATE GATE ⚑ (the part no federal statute controls) │ ◇ what does the state actually require? — HAVA makes this VOLUNTARY │ ├─ 10a REQUIRES FULL EAC CERTIFICATION ──▶ ~13 states, e.g. GA, MN, NC, SC, WI, DE, │ │ RI, UT, MD, MA, NV, AR, D.C. Federal certification is a precondition by state law. │ ├─ 10b REQUIRES TESTING BY A FEDERALLY ACCREDITED LAB ──▶ ~15 states, e.g. AZ, LA, │ │ MI, IL, IN, IA, KY, ID, AL. The lab must be federal; the certificate need not be. │ ├─ 10c REQUIRES TESTING TO FEDERAL STANDARDS ──▶ ~13 states, e.g. CO, CT, KS. Some │ │ still point at the 2002 standard by name, freezing an older floor in statute. │ └─ 10d BASELINE HAVA ONLY ──▶ ~20 states and territories, e.g. CA, FL, AK, HI, ME, │ GU, AS. California writes its own standards and certifies independently. │ ⚑ THIS IS WHY THE VOLUNTARY STANDARD IS LOAD-BEARING: it was made compulsory fifty │ times over by state legislatures, none of which needs Congress to undo it. │ ──▶ then the state's own examination, and in most states a separate state certificate. │ ├─◆ 11. LIFE AFTER CERTIFICATION (how a certified system legally changes) │ ◇ how big is the change? │ ├─ MINOR / DE MINIMIS ──▶ submitted to a VSTL, which independently classifies it. │ │ Roughly: does not touch counting or tally logic, does not affect accuracy, under │ │ ~100 hours of lab review. EAC approves. NO NEW CERTIFICATION NUMBER. │ ├─ MODIFICATION ──▶ delta + regression + integration testing ──▶ NEW certification │ │ number and a new Certificate of Conformance. │ └─ ✕ FIELDING AN UNAPPROVED MODIFICATION IS ITSELF A GROUND FOR DECERTIFICATION. │ ├─◆ 12. QUALITY MONITORING (the only ongoing federal look at fielded equipment) │ Manufacturing site audits · field system testing · manufacturer cooperation required │ └─▶ MALFUNCTION REPORTING: any failure not caused solely by operator error that │ impairs confidentiality, integrity or availability must be reported within │ 15 BUSINESS DAYS. This is the tripwire that feeds the decertification track. │ └─◆ 13. DECERTIFICATION ⚑ (two tracks; only one of them fires in practice) │ ├─ 13a THE FEDERAL TRACK │ ◇ grounds — any of: │ │ · manufacturer fails to comply with program requirements │ │ · a FIELDED system is non-conformant with the VVSG │ │ · changes implemented without EAC approval (see stage 11) │ │ · violation of registration-suspension terms │ │ · the EAC concludes the ORIGINAL TESTING WAS INSUFFICIENT │ ├─ THE PROGRAM DIRECTOR INITIATES ──▶ written notice naming grounds and system │ ├─ manufacturer responds: no factual basis, or a proposed corrective measure │ ├─ informal hearing ──▶ formal hearing │ ├─ THE DECISION AUTHORITY DECIDES ──▶ system struck from the certified list, │ │ election officials and the public notified │ └─ ❄ APPEAL TO THE COMMISSION — FROZEN. There is no body to hear it. A │ manufacturer facing decertification today has a first instance and no │ appeal; a manufacturer that wins at first instance faces no review either. │ ✕ AND AT THE END OF IT: decertification removes a name from a federal list. │ It does not reach into a county warehouse. What happens to the machines is │ decided at 10a–10d, by state law, one state at a time. │ └─ 13b THE STATE AND COUNTY TRACK — where 2020–26 actually happened ├─ SECRETARY OF STATE DECERTIFICATION — the real instrument. Georgia's │ secretary may revoke approval where a machine "can no longer be safely or │ accurately used"; Idaho's may decertify after a public hearing. │ [ The precedent everyone cites is CALIFORNIA 2007: the Top-to-Bottom │ Review decertified most of the state's electronic systems, then │ RE-CERTIFIED them subject to use conditions. Decertification-with- │ conditions, not removal — the form the sanction usually takes. ] ├─ THE LEGISLATURE ──▶ ban a technology and strand the equipment. │ [ GEORGIA, the worked example. State law banned counting ballots by QR │ code after 1 Jul 2026 with no replacement system certified and the │ ~$66M to buy one never appropriated. On 28 Jun 2026 the governor signed │ a delay to 2028, adding automatic hand recounts of the top two races │ before certification and a committee steered by a July amendment toward │ hand-marked paper ballots with ballot-on-demand printing. A legislature │ decertified a technology in advance and then had to un-decertify it. ] ├─ THE COUNTY ──▶ terminate the vendor contract. No certification power is │ required and none is exercised; the machines simply leave. │ [ Shasta County, CA voted to terminate its Dominion contract in 2023. ] └─ THE STATE THAT NEVER CERTIFIES ──▶ a system can be federally certified and still sit outside a state's approved list indefinitely, which is a decertification in effect with no proceeding and nothing to appeal. [ Louisiana ran the 2026 cycle still courting vendors for a replacement system ahead of 2028, under its own 2025 state certification standards. ] ``` ## Notes - **The four frozen gates.** The EAC's own August 2026 guidance, *Commission Operations in the Absence of Commissioners*, divides the agency's work by whether it needs the three-member approval required by 52 U.S.C. § 20928. On the permitted side: running the testing and certification program under the delegations in Program Manual v3.0, running the VSTL program under VSTL Program Manual v3.1, and disbursing election security grants. On the prohibited side: adopting new or modified VVSG, accrediting a new laboratory or revoking an existing accreditation, and modifying the National Mail Voter Registration Form. Certification continues; the machinery for changing the rules does not. - **How the commission emptied.** Commissioner Donald Palmer left earlier in 2026 for the [[Heritage Foundation]]. On **9 July 2026** the President removed the three remaining commissioners — chair Thomas Hicks, [[Benjamin Hovland]] and Christy McCormick, the last of whom was permitted to resign — citing the removal authority recognized in [[Trump v. Slaughter]]. HAVA provides for four commissioners, no more than two from one party, with a quorum of three. - **Certification survived the purge because it was already delegated.** This is worth stating plainly, because the intuitive reading — no commissioners, no certifications — is wrong. The Decision Authority acts through the Certification Division and the Executive Director under authority the Commission delegated while it still existed. The delegation is what is holding the program up, and a delegation is an instrument the Commission itself would have to revisit, which it cannot. - **The appeal that cannot be heard.** The asymmetry at stage 13a is the sharpest thing on this map. Decertification can be *initiated* by a Program Director and *decided* by a Decision Authority, both of them staff. The review of that decision is the frozen step. For as long as the vacancy persists, a staff decertification decision is final in both directions. - **Two laboratories.** [[Pro V&V]] and [[SLI Compliance]] are the whole accredited estate. Because accreditation and revocation are both ❄ gates, the number cannot currently move up or down. The federal testing capacity of the United States is fixed at two private firms by operation of a quorum rule. - **VVSG 2.0 adoption is slow, and now permanent.** Adopted February 2021; sole standard for new submissions since November 2023; first certified system — [[Hart InterCivic]]'s Verity Vanguard — July 2025. By late September 2026 the EAC listed four VVSG 2.0 certificates covering three product lines: Hart's Vanguard 1.0 and 1.1, [[Smartmatic]]'s VSR1 2.1 and VotingWorks' VxSuite 4.0 (corrected 2026-10-03; the map first said two). Most fielded equipment in the November 2026 midterms is certified to VVSG 1.0 or 1.1, which remain valid indefinitely unless a state says otherwise. - **The state counts are approximate and the categories overlap.** Several states' statutes are drafted loosely enough to sit in two buckets at once; the figures come from the EAC's own 2025 overview of state requirements and should be treated as a shape, not a census. The load-bearing point does not depend on the exact numbers: a clear majority of states have made a voluntary federal standard compulsory in their own law. - **Georgia is the cleanest demonstration that the decertification power lives in the states.** A legislature banned a counting method, no certified replacement existed, the money to buy one was never appropriated, and the ban had to be postponed to 2028 — all without the EAC doing anything, and all while the federal certification of the equipment involved remained perfectly valid. See [[Brian Kemp]] and [[Brad Raffensperger]] for the offices involved; the equipment is [[Dominion Voting Systems]]'. - **What this map deliberately leaves open.** Whether any completed *federal* decertification has ever occurred is not established here — the EAC describes decertification as the ultimate sanction and publishes the procedure, but the public record reviewed for this map does not document a completed case. Marked `[unconfirmed]` rather than asserted either way. Also left open: what a court would do with a staff decertification decision that has no available administrative appeal, which is an exhaustion question nobody has had to answer yet. - **Audits are a separate layer and are not on this map.** Post-election verification — see [[Risk-Limiting Audit]] — checks whether a certified machine counted correctly on the day. Certification checks whether the design met a standard in a laboratory. They fail independently. ## See also - [[How a Ballot Is Counted]] — what the certified machine then does: the sort into an exception pile, the adjudication board, and the frozen 2002 accuracy cross-reference that is the only binding federal standard the voluntary guidelines sit on top of - [[Election Ballot Chain of Custody Flow]] — what happens to the certified machine after it is sealed: the seal that follows logic-and-accuracy testing, the tabulation-room access list, and the real-time audit log the central accumulator keeps on itself - [[How Election Results Are Transmitted and Reported]] — the reporting path the certification regime barely touches, and where VVSG 2.0 requirement 15-4-C's wireless prohibition meets the modems still in use in August 2026 - [[State Election Administration Tree]] — who runs the machinery this equipment sits inside - [[How a Midterm Election Is Certified]] — what happens after the machines finish counting - [[How a Candidate Gets on the Ballot]] — the front end of the same election pipeline - [[Voluntary Voting System Guidelines]] · [[Election Assistance Commission]] · [[Help America Vote Act]] - [[Technical Guidelines Development Committee]] · [[National Institute of Standards and Technology]] - [[Pro V&V]] · [[SLI Compliance]] - [[Dominion Voting Systems]] · [[Election Systems & Software]] · [[Hart InterCivic]] - [[Trump v. Slaughter]] · [[Risk-Limiting Audit]] · [[CISA]]