What a certificate actually asserts

A testing-lab certificate is narrower and more honest than its logo suggests. Using what the labs themselves publish — GLI names its tests, a 99% confidence level and a 10,000-outcome floor; eCOGRA and iTech describe their process — here is what a certificate does assert: a named standard, a tested build, a stated amount of data, on a date. And what it deliberately does not.

A little seal on a game says “tested” or “certified,” and it is easy to read that as a blanket guarantee. It is not — and reading it accurately is more reassuring than the myth, not less, because the claim a certificate makes is specific and checkable. This chapter starts by inventorying what the laboratories actually publish (more than the cynical account admits), then states plainly what a certificate does and does not assert.

What the labs actually publish

The claim that testing houses reveal nothing about their methods does not survive contact with their pages. GLI publishes its standards for free download, and they are concrete: for the random source the laboratory applies named statistical tests — Chi-square, Overlaps, Coupon Collector’s, Runs, the two Correlation tests and Duplicates — to be “evaluated, collectively, at a 99% confidence level”, and it sets a data floor: the lab “shall collect game outcome data for at least 10,000 game outcomes”. eCOGRA describes its return testing as gathering evidence “on simulations based on large sample sizes” and checking whether a game’s payout “falls within a statistically acceptable interval, based on the games volatility,” and its RNG service “performs extensive statistical analysis on the output of the RNG over many iterations.” iTech Labs describes RNG testing as “source code evaluation, compilation to generate the raw RNG output, and testing the raw numbers and scaled/shuffled output”, and is candid that “each jurisdiction sets the standards they are willing to accept, and we use those standards.”

So the methodology is not a black hole. What the labs do not publish is the game-specific figures — the exact sample size, tolerance or confidence interval used to sign off a particular title — which is precisely the interpretive layer the RTP pillar’s verification chapter supplies.

What a certificate asserts

Assemble those pieces and a certificate makes a precise, four-part claim. It attests that a specific build of a game or generator — the code the laboratory actually saw — was evaluated against a named standard (GLI-11, a jurisdiction’s rules, an operator’s requirements), using a stated amount of data, and met that standard’s requirements as of the date on the document. GLI-11 makes the data disclosure a duty, not a courtesy: the laboratory “will clearly state in the applicable certification, the amount of data used for testing”, and if fewer than 10,000 outcomes were used, “a statement on the statistical limitations of reduced testing will be clearly denoted.” A certificate is, in other words, an honest and bounded instrument by design.

What it deliberately does not assert

The boundaries follow directly from the claim. A certificate does not assert future behaviour: it describes the build tested, not whatever code is running server-side later, nor which configuration an operator has since deployed — the multi-configuration reality covered in configurable RTP. It does not assert an empirical measurement of the return to a stated precision; the theoretical return is verified against the game’s model, and pinning it by spinning would take the tens of millions of rounds the verification chapter quantifies. And unless the regulator specifically required a cryptographic RNG, a certificate’s statistical pass does not assert adversarial resistance — the property whose absence let approved machines be beaten in the failures chapter, and the exact gap NIST names when it says statistical testing “cannot serve as a substitute for cryptanalysis” (see testing limits).

How to read a certificate page, then

Look for four things and you will read it correctly: the standard named, the build or version identified, the amount of data stated (and any note about reduced testing), and the date. Those turn a vague seal into a specific, dated claim you can weigh. A certificate is strong evidence that a tested build met a written bar — no less, and, read honestly, no more. That honest reading is the whole point of this pillar: the reassurance is real precisely because it is bounded.

Common questions

Sources (4)

• GLI-11 Gaming Devices in Casinos, v3.0 (2016) — §3.2.2 tests & 99% confidence, §3.5.2 data-collection amount and disclosuregaminglabs.com
• eCOGRA — Random Number Generator (RNG) Certification (public service description)ecogra.org
• eCOGRA — RTP Percentage Testing (public methodology description)ecogra.org
• iTech Labs — RNG testing and evaluation (public description of method and standards stance)itechlabs.com

Education, not advice. This chapter explains how the random number generators behind casino games are built, tested and certified so you can judge the claims made about them honestly. It is not a system, and nothing here treats gambling as a way to make money — over enough play the mathematics favours the house. 18+.