How a Random Number Generator Gets Independently Certified (Beyond Self-Run Statistical Tests)
A random number generator used in a regulated lottery draw or licensed gaming system is typically certified by an independent testing laboratory accredited under ISO/IEC 17025, applying a published technical standard such as GLI-19, rather than relying only on the generator’s own statistical test results — the accreditation and the standard are what turns a self-reported pass into an externally verified one.
A worked example with numbers
Statistical testing, such as the NIST SP 800-22 battery described elsewhere on this site, evaluates a sequence of output values against mathematical criteria: is the bit balance close to even, are run lengths distributed as expected, and so on. Certification for a regulated product adds a separate layer on top of that: an accredited laboratory — one whose own competence has itself been assessed against ISO/IEC 17025, the international standard for testing and calibration laboratories — reviews the generator’s design, seeding method, and integration into the surrounding system against a published technical standard, then issues a report and, where the system passes, a certificate. GLI-19, published by Gaming Laboratories International, is one such standard specifically covering interactive gaming systems, including a dedicated chapter on random number generator requirements: how a generator should be seeded, how its outputs should map to game results, and what statistical and design evidence a lab expects to see before certifying it.
How to set the rule before the result
The practical difference between self-testing and certification is who runs the test and under what accountability. A developer can run a chi-square or NIST-style statistical suite on their own generator’s output at no cost and with no outside oversight, which is a reasonable first check but carries no independent verification. Certification instead requires submitting the generator, its documentation, and often its source code to a laboratory that has no stake in the result passing, whose own competence is independently assessed under ISO/IEC 17025, and whose findings are typically reported to a regulator rather than only to the generator’s own operator. Checking whether a specific product is certified means looking for a named laboratory, a specific standard version — GLI-19 has had multiple revisions — and a certificate or regulator filing, not just a general claim of “tested for fairness.”
Common mistakes that change the odds or the process
A common mistake is treating any statistical testing claim as equivalent to certification — a page stating its generator “passed randomness testing” without naming a laboratory, a standard, or an accreditation body is describing self-testing, which is a meaningfully weaker claim than third-party certification, even if the underlying statistics are genuinely sound. A second mistake is assuming certification is a one-time, permanent status; standards like GLI-19 are periodically revised, and a certificate tied to an older version does not automatically carry forward every requirement of a newer one. A third mistake is assuming certification proves the generator is used correctly in every downstream feature — a certified RNG can still be paired with flawed range-conversion or selection logic elsewhere in a system, a distinct bug class from the generator itself and outside what an RNG-specific certification evaluates.
Where this method stops being appropriate
This certification framework is built for regulated, typically commercial gaming and lottery contexts, where a regulator requires independently verified evidence before licensing a product; it is not the standard a casual browser-based tool for coins, dice, or list picks is expected to meet, and nothing about lacking such certification makes an otherwise well-implemented casual tool untrustworthy for its actual use. It also does not certify fairness in any moral or legal sense beyond the generator’s statistical and design properties — a certified RNG paired with dishonest odds disclosure or misleading rules is still an unfair product overall, because certification evaluates the number generator, not the complete offer made to a participant.
How the random source fits into the rule
Gaming Laboratories International’s GLI-19 standard for interactive gaming systems publishes the RNG-specific technical requirements referenced above, including seeding and statistical evidence expectations for interactive gaming systems; ISO/IEC 17025:2017 defines the accreditation standard a testing laboratory itself must meet before its certifications carry independent weight.
Self-testing vs. independent certification, side by side
| Self-run statistical test | Accredited certification | |
|---|---|---|
| Who runs it | The generator’s own developer | An outside laboratory |
| What it checks | Output statistics only | Design, seeding, integration, and statistics |
| Accountability | None beyond self-report | Lab accredited under ISO/IEC 17025 |
| Typical audience | Developer’s own confidence | Regulator or licensing body |
Neither column is “better randomness” in a mathematical sense — the underlying statistical tests can be identical. The difference is entirely about who performed the check and what independent accountability stands behind the result, which matters most when real money, a license, or a legal requirement depends on the answer.
A second case: what a GLI-19 review asks about seeding
Beyond running a generator’s output through statistical tests, a GLI-19-style RNG review specifically examines how the generator is seeded — where its initial entropy comes from, whether the seed is predictable from information available to a player, and whether the generator is reseeded on a schedule that prevents a long-running instance from drifting into a predictable state. A generator can pass every output-based statistical test while still using a weak, guessable seed, the same distinction covered elsewhere on this site between statistical randomness and cryptographic unpredictability — exactly why a seeding review is treated as a separate, mandatory line item rather than something the statistical tests are assumed to cover on their own.
Regulated lottery and gaming markets frequently layer a second, jurisdiction-specific approval on top of a technical standard like GLI-19: a regulator in a given state or country typically requires its own review before licensing a product for that market, even when the underlying generator already holds a GLI-19 certificate from an accredited lab. That layering means a single generator can be certified against the same technical standard yet still be unlicensed in a specific jurisdiction, simply because the separate regulatory approval step has not been completed there — a distinction worth checking before assuming a certified product is legally available everywhere.
Where a certificate stops answering the question
A certificate confirms that a specific generator, in a specific configuration, met a specific standard’s requirements as assessed by a specific accredited lab on a specific date — a narrower claim than “this system is fair” in the everyday sense. It says nothing about whether the certified generator was later modified without recertification, whether it was correctly wired into the game logic that actually uses its output, or whether the game’s payout structure and disclosed odds are honest, all of which are questions a regulator’s broader licensing review — not the RNG certificate alone — is meant to cover. A regulator’s jurisdiction-specific licensing decision is a separate legal question from the RNG’s own technical certification, and neither one substitutes for the other.