Attested once is not enough.
Check that your product can prove what it runs
Your product was checked once, at launch. It has changed since. Use this site to find out if it can still prove what it runs, and what to do if it cannot.
Start the check ›
Or check what your product trusts, or book a 30-minute call.
Before you start
You need to know:
- where your product runs
- how it gets updates
- who can log in to it
The check takes 2 minutes. Your answers stay on your device.
The next date set by law is 24 December 2026: EU Digital Identity Wallets are due in every member state. That is in
42 days.
See all dates.
What re-attestation is
Attestation is when a machine proves what hardware and software it runs.
Most products do this once. Then they change. They get updates, repairs, new models and new owners. After each change, the old proof describes a product that no longer exists.
Re-attestation is when the product proves itself again after each change. A product that does this is reattested.
Attested once✓Launch?Update?Repair?New model?New flaw
Reattested✓Launch✓Update✓Repair✓New model✓New flaw
Read more: Remote attestation, Re-attestation, Continuous attestation, the history of attestation, and why integrity comes first.
Why companies do this
- A deal is stuck in security review. Your buyer's security team asks how they can check what runs on their data. A PDF does not answer that. Evidence they can verify themselves does. Evidence Pack
- A deadline is coming. EU wallets, the Machinery Regulation, the Cyber Resilience Act and the AI Act all ask for proof that stays current after the product changes. Regulations and standards
- A vulnerability made your proofs stale. When a TEE, a firmware or a component breaks, every attestation made before the fix says less than it did. Someone has to decide what gets proved again. Vulnerability tracker
Read what it costs to wait.
Our main fields
AI and agents
Your customer asks what runs on their data, and who your agent works for. We make both checkable.
Industrial control and machines
Plants, grids, robots and vehicles run for decades and change every month. We make each unit prove what it runs.
Digital identity and trust services
EU wallets and remote signing rest on wallet and key attestation. We design how that proof is issued, renewed and revoked.
Who builds in these fields: 214 companies, projects and standards.
Find your industry
- Healthcare and medical data: hospitals, health records, medical AI, research data
- Pharma and life sciences: drug development, laboratories, clinical trials, manufacturing
- Energy and smart grids: grid operators, substations, smart meters, distributed energy
- Blockchains and decentralised networks: validators, rollups, bridges, oracles, confidential contracts
- Legal services and digital trust: law firms, notaries, courts, signing and trust services
Worked examples: 5 use cases.
Find your product
AI you can check
Models, agents and the machines they run on.
Machines you can check
Things that move, switch and measure in the physical world.
- Attested OT and industrial control: pLCs, SCADA, substations, factories, building automation
- Attested robots: humanoids, drones, mobile robots, industrial arms
- Attested autonomous vehicles and machines: autonomous trucks, mining haulage, ports, agriculture, construction
- Attested devices: ioT, industrial and medical devices, edge gateways
Infrastructure you can check
Identity, cloud, builds and the evidence auditors ask for.
How the hardware under your product attests: the platform guide.
Dates set by law
All 14 rules, with official texts. What already broke: the vulnerability tracker.
Questions we are often asked
We already do remote attestation.
Good. The question is what happens after the first one. If an update, a repair or a published flaw does not lead to a new proof, you attest once and trust afterwards.
We have ISO 27001 and SOC 2.
They show your processes were sound over a period. They do not show what one unit of your product runs today. Large customers and the new EU rules ask the second question.
It is too early for us.
The cheapest moment is before the fleet exists. An identity that was not put in at the factory, or measurements nobody recorded at build, cannot be added later.
Our engineers can do this.
They can, and they should own it. What saves months is a design and a complete list of the events to cover, from someone who works on nothing else.
Our sources are public: the reading list.
Get expert help
Reattested arranges 4 kinds of help, and brings in the experts each one needs. Most companies take them in this order.
- Team training (two days): teams that will build or buy attested systems and want the same foundation first.
- Reattestation Review (two weeks): teams that want to know where their proof goes stale, and what the law will ask of them.
- Evidence Pack (after a review): vendors whose deals wait on a customer's security review.
- Retainer (monthly): teams that ship often and want their proof to keep up.
Talk to us
Book a call with Reattested. It takes 30 minutes and commits you to nothing. Bring your product and the one question that worries you.
Book a 30-minute call
Concepts
What Reattested is
Reattested is an independent centre for attestation. It does three things:
- it publishes what companies need to know, and keeps it current
- it is building a network of experts in the field
- it matches a company's project with the right experts
It sells no product, and a place on this site cannot be bought. About Reattested. Join as an expert.