Where robustness evidence fits in your fleet's security work.
Your cybersecurity process was built for firmware and networks; the learned policy in a vehicle or robot is new to it. Provael measures, in simulation, how often an unusual instruction pushes a robot policy out of its safe zone. Its simulators run manipulation and humanoid tasks today, not driving or navigation.
Who this is for
You operate or integrate a fleet whose navigation or manipulation is a learned policy. Your cybersecurity process already has a threat analysis and risk assessment for everything else. The row for the policy has no measured number in it yet.
What applies to you, and when
- EU Machinery Regulation 2023/1230 - Annex III 1.1.9 and 1.2.1
- Every machine placed on the EU market must meet the Annex III requirements that apply to it, 1.1.9 and 1.2.1 among them, from this date: protection against corruption and resistance to malicious attempts. An AMR or AGV that is machinery rather than a road vehicle sits here, not under UN R155; the policy is its control system. The delegated acts carrying the AI Act requirements apply by 2 August 2028.
- EU Cyber Resilience Act - reporting duties, then full application
- The Article 14 reporting duties have applied since 11 September 2026; full application is on this date. The manufacturer of a product with digital elements in the fleet reports actively exploited vulnerabilities on a clock measured in hours. The first 24 hours, step by step →
- UN R155 / ISO/SAE 21434 - the TARA
- In force for road vehicles through type approval, which requires a risk assessment of each vehicle type; ISO/SAE 21434 sets out threat analysis and risk assessment (TARA) methods. A measured attack-success rate with its benign control can be the likelihood figure in the policy’s row: a simulation rate, not a type approval and not a substitute for one.
- Product Liability Directive (EU) 2024/2853
- For products placed on the market after this date defectiveness may be presumed where relevant evidence is not disclosed.
What you get
- The report and its SARIF file: the attack-success rate (how often the policy left its safe zone) with 95% confidence intervals, the benign and clean-task-success controls, and the release decision under your acceptance protocol, per checkpoint, per release, in CI.
- The signed attestation over the whole pack, which you verify offline.
- The technical-file annex: the test report in the ISO/IEC 17025 clause-7.8 shape (not accredited, no statement of conformity) and the crosswalk, with the UN R155 / ISO/SAE 21434 rows the product implements.
- For a fleet, the Assurance subscription re-runs the red-team each quarter and gates your CI on your acceptance protocol; per-checkpoint CI across a fleet is scoped on request. Running a fleet? See continuous assurance →
The one measured result, and what it does not mean, is on the results page.
Read a real report first
The sample pack holds the test report and the SARIF file from the committed run, published in full. To set up the same for your fleet, start with a scoping call.
Feature and status claims on this page were read against the product repository on . This page was rewritten on , after that check; the re-check is pending. Unlike the numbers on /results and /leaderboard, these claims are not enforced by a build check: this is a human review with a date on it, not a guarantee. The maintained source is the repository; where it disagrees with this page, it wins.