Despite fears or claims to the contrary, certifying and decertifying voting equipment cannot legally happen with a simple proclamation or social media post. Decertifying a voting system requires a formal investigation; a written finding; a chance for the manufacturer to resolve the problem; and a final federal decision. This is a thoughtful process that can take months. In a primetime address this summer, it took President Donald Trump less than an hour to cast doubt on voting machines and return to a familiar theme—using disproven theories to claim our elections cannot be trusted. Throughout his speech, he recycled fraud allegations that have been investigated and debunked, claimed that China interfered in the 2020 election—contradicting the intelligence community’s findings—and warned without evidence that “our machines and ballot counting systems are exposed to hacking and manipulation and corruption.” The Trump administration’s actions are distorting facts seemingly to protect political power.
During his address, Trump appeared to prod Congress to pass his sweeping voter restrictions. But the speech mattered less for what was said than the groundwork it laid, continuing to impugn election integrity based on myths about untrustworthy voting machines. In anticipation of the speech, there was concern that the Trump administration may declare that it is decertifying a voting system, but presidents have no such authority. Federal law requires the Election Assistance Commission (EAC) to provide for certification and decertification, and the agency’s own program lays out a meticulous procedure for doing so. On top of this, the differing election policy regimes among the states add another layer of complication.
What it takes to certify a voting system
Despite the shadow the Trump administration has cast on the integrity of voting machines, these election systems go through an extensive nonpartisan testing process to become certified. In fact, the EAC certifies voting systems rather than individual devices. The ballot markers, scanners, and software that form the mechanical foundation of an election are tested together as a single configuration. Those systems are submitted to a Voting System Test Laboratory, accredited by the EAC after the National Institute of Standards and Technology’s National Voluntary Laboratory Accreditation Program reviews the lab’s technical competence.
The certification process uses worst-case scenario planning, assuming challenges during voting periods. For example, this could include preparing for a hot gymnasium serving as a polling location, a cold warehouse where equipment may be stored, or a clumsy volunteer drinking coffee. Voting machines undergo a physical gauntlet where they must meet many of the same environmental standards used for military equipment.
In addition to the physical exam, the lab conducts a vulnerability and threat analysis of the system, which must be approved by the EAC before testing. The EAC’s stated purpose for penetration testing is to find flaws that could be exploited to “change the outcome of an election,” produce erroneous results, cause denial of service, compromise ballot secrecy, or modify the audit trail—as well as to identify any malicious software or firmware.
Another safeguard is the gap between the code humans read and the code the machine runs. Rather than accept the manufacturer’s software, the lab builds the software itself while the manufacturer watches and the lab takes a cryptographic fingerprint at every step. Manufacturers must also give election officials the tools to check that a machine still matches what was certified.
Decertification is a process—not a proclamation
The prospect of the Trump administration declaring a voting system decertified is no longer hypothetical. Trump has already ordered the EAC to rescind voting system certifications by executive order in March 2025; pledged in August to end the use of machines altogether before the midterms; and repeated claims of alleged election fraud in his July 2026 primetime speech. But decertification cannot be accomplished with a declaration. Decertification is a procedure built with the same care as certification. Decertification is initiated when the EAC receives information from a source that has “used, tested, or observed” that a voting system may be noncompliant with the Voluntary Voting System Guidelines (VVSG) or the manual’s procedural requirements. Anonymous or hearsay reporting is disqualified; a direct witness is necessary.
After reviewing the informal inquiry, the EAC opens a formal investigation if it determines that the information is accurate and warrants decertification. The EAC must state in writing which system is under investigation and what noncompliance is alleged. During the investigation, the EAC employs evidence-gathering tools, such as interviews, field and manufacturing-site audits, written questions, and testing at a lab. The fact-based investigation concludes in a written report finding that the evidence either supports decertification or does not.
If the inquiry’s evidence supports decertification, the EAC issues a notice of noncompliance, which still does not signify a final decertification decision. Within 10 business days, the manufacturer may request an opportunity to cure and outline how it plans to do so. The EAC approves that request if the defects can reasonably be cured before the next federal election. Only after a compliance plan, retesting, and a test report is a decertification decision issued, effective upon publication.
The EAC must follow its own rules
Trump has no lawful authority to declare voting systems decertified, but some, including election scholar Michael McDonald, posited that Trump could order the EAC executive director to decertify voting machines and, if she refused, he would replace her with someone who would heed his demands. However, even if Trump had the personnel authority to do this, his requests would have to wind their way through the EAC’s multistep, fact-based process. From the notice of noncompliance, the manufacturer has a 30-business-day cure period, and the EAC has 20 business days to decide once the test report arrives. That is 10 weeks, excluding the inquiry, the investigation, compliance-plan review, and lab testing. The process is methodical and nonpartisan—and it protects our voting systems from impulsive decision-making and last-minute surprises, especially in the weeks before an election.
At the same time, a structural issue arises for anyone attempting to decertify, which exists in the EAC’s in-house appeal process. The commissioners serve as the appeal authority,” but because every commissioner position is currently vacant, no one is eligible to join or be designated to the appeal authority. The appeal must be submitted to the EAC chair, but there is no chair currently. Decertification is effective upon publication, but there is no internal remedy to reconsider the decision. Instead, commissioners must be appointed and confirmed by the Senate—a process that takes considerable time itself.
With no commissioners to sit as the appeal authority, the agency cannot follow the procedure it published. When an agency does not follow the rules it has published, a court can throw out its actions. Importantly, no party would have to prove that the appeal would have saved the voting system from an unwarranted decertification—skipping the appeal step is itself a violation of EAC rules. As the EAC’s August 2026 memo reaffirms, the agency would not be able to amend this process, as staff, who are all that remain, cannot adopt new standards or rewrite the program manual to neuter the appeal provision.
State law determines federal certification’s impact
Analysts warn that 11 states and D.C. require federal certification, leaving them exposed to an EAC decertification. However, “requires federal certification” describes statutory structures that have different arrangements, depending on where federal certification appears in the state code—if it does at all—regarding purchasing and testing equipment. The 2002 Help America Vote Act (HAVA)—the same act that created the EAC—creates a federal scheme that is voluntary by design, as HAVA provides for voluntary testing and certification. The EAC manual lays out clearly that an EAC certification is not a substitute for state or local certification; not an endorsement; and not a federal warranty. Nothing the EAC does regarding certification is automatically required of a state.
For example, in California, federal certification is not required. State law provides that all voting systems be certified or conditionally approved by the secretary of state, “independent of voluntary federal qualification or certification,” before use. California connects its testing standards to HAVA’s minimum requirements rather than EAC certification decisions. Georgia, requires federal certification “prior to purchase, lease, or acquisition”—not use. Operating authority comes from the secretary of state, after examination by three appointed examiners and a written report. If the EAC decertified Georgia’s voting system tomorrow, the state’s equipment would stay in service; Georgia would not be compelled under the law to buy more systems. Idaho has its federal requirement earlier in the certification process, where no system may be examined by the state without documentation that it meets EAC guidelines. The secretary of state may also review certified systems using the EAC’s rubric and decertify one if it falls short, after a public hearing.
These three states illustrate that the notion of “requires federal certification” covers a wide range of situations. At one end is a state that legislated the federal question away, and at the other is a state that supplements the federal guidelines with its own examination—and neither must stop using its equipment automatically. Congress designed the EAC’s Voluntary Voting System Guidelines to be a useful tool and resource for states, which ultimately decide how to utilize the system. This deference provides another protective layer for state determination and control of voting systems. The current circumstances are a reminder that states would be well-served to review how state law intersects with federal testing and certification.
Conclusion
Federal voting equipment certification does not rest on the whims of any one individual. Certification and decertification are dependent on an established, fact-driven, nonpartisan process where scientific rigor is required. At this point in the election cycle, it would be impossible to follow the established process to decertify equipment before November. Even so, understanding how state law intersects with federal testing and certification requirements can help states better insulate their systems from external forces going forward.