STALE: OUR MEASUREMENT

Our published benchmark result was measured with v0.41.2, 5 releases ago, past this project's own 2-release window, and the newest real-model measurement, dated 2026-09-18, is past this project's own 7-day window. That is our own number, not your assessment, which runs against your policy on the current release. Why, and what unblocks it

STALE: REGULATORY CLOCK

The regulatory entries on this page were last checked against their primary sources on — 34 days before this build’s anchor of , past this project’s own 30-day window. Every date here was true when it was read and has not been re-read since. Verify against the primary source before relying on it. The clock, with every source

ProvaelGitHub, star the repositoryQuickstart
ISO 10218-1:2025 · ISO 10218-2:2025

ISO 10218-1/-2:2025

The 2025 revision of ISO 10218, the core industrial-robot safety standard, added cybersecurity provisions for the first time: a compromised robot controller or policy is a safety problem, not just an IT one. A Provael report is adversarial-robustness evidence an integrator can attach to an ISO 10218-2 system assessment.

Timing ISO 10218-1:2025 and ISO 10218-2:2025 were published February 2025 (the month ISO’s catalogue shows; verified 28 September 2026).

From the regulatory clock

At a glance

Read from the site’s regulatory clock, the record that is re-verified against primary law, as of 19 September 2026.

Instrument
ISO 10218-1:2025 · ISO 10218-2:2025 (industrial robot safety, incl. cybersecurity) — Voluntary standard or framework — referenced, not a legal duty
Applies?
Published February 2025 — a publication date, not a date from which anything applies
Responsible actor
Robot integrator / system assessor.
What Provael measures toward it
Adversarial-robustness evidence for the policy driving an industrial robot, mappable to a 10218-2 system assessment.
What that does not establish
Not conformity to ISO 10218; not a certificate.
Source and review
Primary source · verified 28 September 2026
Use it for

What a Provael report can be used for

Cybersecurity provisions (standard-level mapping — see note)

Paraphrase, not a quotation: the 2025 revision requires security-relevant threats to safety functions to be considered, including manipulation of the control logic that drives motion. Clause-level citation is deliberately omitted — the standard is paywalled and was restructured in 2025, so a clause number cannot be verified against a public source. Read this mapping against your own copy of the standard text before relying on it.

The evidence

  • Adversarial-robustness evidence for the policy that drives an industrial robot, in simulation.
  • A mapping from each finding to a security-relevant safety concern (e.g. keep-out-zone violation).
  • A reproducible, versioned report that an integrator can attach to a 10218-2 system assessment.
Limits

What it cannot be used for

A mapping identifies possible relevance. It does not establish that this framework applies to your product, that anything here is compliance, that an assessor or insurer will accept it, or a real-world risk probability. Whether it applies to your product depends on your role, market and product class: a question for your counsel, not a determination this page makes.

  • Simulation evidence for the tested checkpoint and protocol. Physical safety and conformity require separate assessment.
  • Provael measures adversarial robustness - susceptibility to manipulation - not general accuracy, reliability, or functional safety.
  • The measured result uses templated, auditable attacks; the search-based families (optimized, universal_patch, gradient_patch) have no real-policy rate. Results are a floor on susceptibility - a behavioural lower bound, not a certified worst-case bound.
Evidence, not certification

Running Provael does not make a system compliant or certified - it generates measurements you can put into a conformity or assurance file. Provael is not a notified body, a lab, or a certification scheme.

Independent project. Not affiliated with or endorsed by ISO, the EU, NIST, IEC, OWASP, or MITRE. Not legal advice.

Clause references are indicative: check each against the text you hold before you cite it.

What it is

The framework

  • ISO 10218-1:2025 covers the robot; ISO 10218-2:2025 covers robot systems and integration.
  • The 2025 revision introduces cybersecurity requirements alongside the traditional mechanical and functional-safety clauses.
  • It adds cybersecurity requirements to the extent they apply to industrial robot safety, and names IEC 62443 only in its informative Bibliography - so it does not hand the detail off to that series. Provael publishes its own mapping onto IEC 62443; that mapping is Provael’s, not something ISO 10218 routes to.
Timing

Dates (verified 28 September 2026)

Published
February 2025This is the publication date of ISO 10218-1:2025 and ISO 10218-2:2025 (February 2025), not an entry-into-force date.

Check the live EUR-Lex or ISO text before relying on a date.

Sources

Primary references

Sample SARIF ↓All frameworks

See what a report contains.

The sample report comes from a public run and is published in full, nothing redacted. To have this mapping filled in for your own policy, request a scoping call.

See the sample reportRequest a scoping call