Four commands, five minutes, no account, no network after the first one. This is what a contracting authority, a notified body or a buyer can run.
$ python -m pip install --require-hashes -r https://certanix.eu/try/requirements.txt
$ certanix-verify --version certanix-verify 0.17.0
Every package is pinned by its SHA-256 (requirements.txt); pip refuses any other file. Then download the pack, the comparison and the key into one folder.
$ certanix-verify verify wp2-aloha-transfer-cube-v1-act-pergroup-s0-n40-k8-release-b-v3.evidence-pack.json --key certanix-hsm.pub VERIFIED (0) wp2-aloha-transfer-cube-v1-act-pergroup-s0-n40-k8-release-b-v3.evidence-pack.json signature valid over the canonical bytes; schema valid; no gate violation schema v1.14 certanix-verify 0.17.0, rules sha256:dd64efc6d190d1cec8035997c9c95902658c250db346e4dbd743d70a4bb6993c
certanix-verify show)$ certanix-verify show wp2-aloha-transfer-cube-v1-act-pergroup-s0-n40-k8-release-b-v3.evidence-pack.json --key certanix-hsm.pub
VERIFIED (0) wp2-aloha-transfer-cube-v1-act-pergroup-s0-n40-k8-release-b-v3.evidence-pack.json
signature valid over the canonical bytes; schema valid; no gate violation
schema v1.14
certanix-verify 0.17.0, rules sha256:dd64efc6d190d1cec8035997c9c95902658c250db346e4dbd743d70a4bb6993c
What this pack covers
System tested
Policy repository: lerobot/act_aloha_sim_transfer_cube_human
Revision: bf09d3a9c6fd382bbcae1167297f4ec88a38f650
Weights fingerprint: d9f89098a0ec…
Policy class: policy-learned-deterministic
Task and pass criterion
Task: AlohaTransferCube-v0
A scenario passes when: gym_aloha/env.py AlohaEnv.step: `terminated = is_success = reward == 4`. gym_aloha/tasks/sim.py TransferCubeTask.get_reward, from contact pairs: 1 = cube touches the right gripper finger; 2 = and not the table (lifted); 3 = cube touches the left gripper finger (attempted transfer); 4 = left finger and not the table (successful transfer). max_reward = 4.
Results
Scenarios executed: 8
Outcome: 5 passed, 3 failed
Pass rate: 62.5%
Failing scenarios: aloha-transfer-cube-v1-s0-c021
aloha-transfer-cube-v1-s0-c027
aloha-transfer-cube-v1-s0-c020
When and where it ran
Ran at: 2026-11-08T17:46:25Z
Platform family: macos-arm64
Platform version: certanix-beta@e9b999d5
Linked artefacts
embodied-trace: sha256:cd89fe69dda3…
parameter-coverage-map: sha256:c8a4470e8255…
About the regulation references. This evidence pack records tests that Certanix ran and signed. It lists the EU legal provisions those tests relate to, and for each one what the pack does not show. It is not a declaration of conformity, a certification, or a conformity assessment under any EU legislation. It does not replace the manufacturer's own obligations, or the involvement of a notified body where the law requires one. The Certanix signature attests that this record is complete and unchanged since signing. It does not attest that the tested product complies with any requirement.
Requirements this evidence relates to
The evidence in this pack relates to the clauses below. It is not an assessment of conformity with them.
Machinery Regulation: Regulation (EU) 2023/1230 (CELEX 32023R1230), Annex IV, Part A, point (g)
How it can apply: Internal production control (module A, Art. 25(4) and
Annex VI) against the Annex III essential health and
safety requirements; no notified body. Annex I, Part A,
points 5 and 6 concern machine learning that both
ensures a safety function and is fully or partially
self-evolving (recital 55); this is a frozen task
policy. Applies from 20 January 2027 (Art. 54, as
corrected); Directive 2006/42/EC until then.
Not shown by this pack: Which essential health and safety requirement each
test verifies (the manufacturer's risk assessment,
Part A (b), makes that link); tests on the
physical machine.
Machinery Regulation: Regulation (EU) 2023/1230 (CELEX 32023R1230), Annex III, section 1.1.2(a)
How it can apply: Internal production control (module A, Art. 25(4) and
Annex VI) against the Annex III essential health and
safety requirements; no notified body. Annex I, Part A,
points 5 and 6 concern machine learning that both
ensures a safety function and is fully or partially
self-evolving (recital 55); this is a frozen task
policy. Applies from 20 January 2027 (Art. 54, as
corrected); Directive 2006/42/EC until then.
Not shown by this pack: That the machine can be operated without putting
persons at risk; reasonably foreseeable misuse.
Machinery Regulation: Regulation (EU) 2023/1230 (CELEX 32023R1230), Annex III, section 1.2.1, first paragraph and point (c)
How it can apply: Internal production control (module A, Art. 25(4) and
Annex VI) against the Annex III essential health and
safety requirements; no notified body. Annex I, Part A,
points 5 and 6 concern machine learning that both
ensures a safety function and is fully or partially
self-evolving (recital 55); this is a frozen task
policy. Applies from 20 January 2027 (Art. 54, as
corrected); Directive 2006/42/EC until then.
Not shown by this pack: That an error in the control logic does not lead
to a hazardous situation: the campaign scores task
success, not hazards.
Machinery Regulation: Regulation (EU) 2023/1230 (CELEX 32023R1230), Annex III, section 1.2.1, point (d)
How it can apply: Internal production control (module A, Art. 25(4) and
Annex VI) against the Annex III essential health and
safety requirements; no notified body. Annex I, Part A,
points 5 and 6 concern machine learning that both
ensures a safety function and is fully or partially
self-evolving (recital 55); this is a frozen task
policy. Applies from 20 January 2027 (Art. 54, as
corrected); Directive 2006/42/EC until then.
Not shown by this pack: That the machine prevents modification of its
settings or rules in use; the limits of the safety
functions.
EU AI Act: Regulation (EU) 2024/1689 (CELEX 02024R1689-20260727), Annex IV, point 2(g)
How it can apply: Likely not high-risk: Art. 6(1)(b) needs a third-party conformity
assessment under the Annex I legislation, and the Machinery route
for this frozen task policy is internal production control (see the
Machinery entries). The Machinery Regulation is in Annex I, Section
B (item 21, as amended by Regulation (EU) 2026/1744), where Art. 9,
10, 15 and Annex IV do not apply directly (Art. 2(2)). Related here
as reference requirements only.
Not shown by this pack: Testing in real-world conditions (Art. 60, 60a); the gap
between simulation and the real cell; test reports signed by
the provider's responsible persons.
EU AI Act: Regulation (EU) 2024/1689 (CELEX 02024R1689-20260727), Annex IV, point 1(c)
How it can apply: Likely not high-risk: Art. 6(1)(b) needs a third-party conformity
assessment under the Annex I legislation, and the Machinery route
for this frozen task policy is internal production control (see the
Machinery entries). The Machinery Regulation is in Annex I, Section
B (item 21, as amended by Regulation (EU) 2026/1744), where Art. 9,
10, 15 and Annex IV do not apply directly (Art. 2(2)). Related here
as reference requirements only.
Not shown by this pack: Firmware on the physical robot; requirements related to
version updates.
EU AI Act: Regulation (EU) 2024/1689 (CELEX 02024R1689-20260727), Annex IV, point 3
How it can apply: Likely not high-risk: Art. 6(1)(b) needs a third-party conformity
assessment under the Annex I legislation, and the Machinery route
for this frozen task policy is internal production control (see the
Machinery entries). The Machinery Regulation is in Annex I, Section
B (item 21, as amended by Regulation (EU) 2026/1744), where Art. 9,
10, 15 and Annex IV do not apply directly (Art. 2(2)). Related here
as reference requirements only.
Not shown by this pack: The safety of persons near the arm; foreseeable unintended
outcomes in the real cell.
EU AI Act: Regulation (EU) 2024/1689 (CELEX 02024R1689-20260727), Article 9(8)
How it can apply: Likely not high-risk: Art. 6(1)(b) needs a third-party conformity
assessment under the Annex I legislation, and the Machinery route
for this frozen task policy is internal production control (see the
Machinery entries). The Machinery Regulation is in Annex I, Section
B (item 21, as amended by Regulation (EU) 2026/1744), where Art. 9,
10, 15 and Annex IV do not apply directly (Art. 2(2)). Related here
as reference requirements only.
Not shown by this pack: The risk management system; the Machinery risk assessment.
EU AI Act: Regulation (EU) 2024/1689 (CELEX 02024R1689-20260727), Article 15(4)
How it can apply: Likely not high-risk: Art. 6(1)(b) needs a third-party conformity
assessment under the Annex I legislation, and the Machinery route
for this frozen task policy is internal production control (see the
Machinery entries). The Machinery Regulation is in Annex I, Section
B (item 21, as amended by Regulation (EU) 2026/1744), where Art. 9,
10, 15 and Annex IV do not apply directly (Art. 2(2)). Related here
as reference requirements only.
Not shown by this pack: Fail-safe and redundancy; behaviour outside the simulated
variations.
Frameworks considered and not related
Cyber Resilience Act: The campaign tests task behaviour in simulation, not a cybersecurity property, and no SBOM or vulnerability scan is ingested.
$ python -c "import sys;p=sys.argv[1];b=open(p,'rb').read();open(p,'wb').write(b.replace(b'0.625',b'0.925',1))" wp2-aloha-transfer-cube-v1-act-pergroup-s0-n40-k8-release-b-v3.evidence-pack.json
$ certanix-verify verify wp2-aloha-transfer-cube-v1-act-pergroup-s0-n40-k8-release-b-v3.evidence-pack.json --key certanix-hsm.pub SIGNATURE_MISMATCH (7) wp2-aloha-transfer-cube-v1-act-pergroup-s0-n40-k8-release-b-v3.evidence-pack.json recomputed canonical bytes do not match the signed digest schema v1.14 (as stated by the file, not verified) certanix-verify 0.17.0, rules sha256:dd64efc6d190d1cec8035997c9c95902658c250db346e4dbd743d70a4bb6993c (exit code 7)
The verifier does not know which byte changed. It knows the bytes are no longer the ones Certanix signed.
The line above is the same in a Linux or macOS terminal and in Windows PowerShell. It replaces the first 0.625 in the file, the pack's pass rate, with 0.925.
$ certanix-verify verify arm-compare-release-a-v3-vs-release-b-v3.delta-report.json --standalone --key certanix-hsm.pub VERIFIED (0) arm-compare-release-a-v3-vs-release-b-v3.delta-report.json signature valid over the canonical bytes; schema valid; no gate violation schema v1.0 certanix-verify 0.17.0, rules sha256:dd64efc6d190d1cec8035997c9c95902658c250db346e4dbd743d70a4bb6993c
Read from the signed fields of the comparison:
Verification shows that these bytes are the ones Certanix signed, unchanged, including the date they state, and that the comparison was computed from them. It says nothing about whether the system is fit for any purpose, compliant with any law, or safe.
The same checks in a browser: certanix.eu/verify. The sample files: two releases compared.