↳ For manufacturers · runtime authors · system integrators
Publish a reproducible URML federal-validation self-report.
Free, opt-in, self-reported. You run the conformance suite, you publish the result, the
working group reviews the submission for completeness. URML hosts nothing on your behalf
and certifies nothing.
Five steps. About a fortnight of calendar time. Most of it yours.
1
Run the conformance suite
Clone the repo, run the suite on your runtime via the bring-your-own-adapter kit. Output one machine-readable results file.
~10 min on CI
STEP 1 OF 5
2
Author the capability manifest
Declare what your robot can do: mobility, manipulation, perception, frames, safety envelope.
~2 hours · template provided
STEP 2 OF 5
3
Add the provenance block
Where every covered component comes from. Required for a federal-validation self-report.
~1 hour
STEP 3 OF 5
4
Validate against the bundled default policy
Run urml validate with no --policy and no --no-policy. The bundled US-federal default must be the one in effect. Pin the URML commit.
Automated
STEP 4 OF 5
5
Submit a PR to the registry
Open a PR to docs/compatible-runtimes.md (runtimes) or the manufacturer directory (robots/parts).
WG reviews in <2 weeks
STEP 5 OF 5
Default validator policy
Aligned to current US federal robotics & uncrewed-systems regulation.
The bundled default policy is regulation-neutral by construction. Deployments outside the US swap in their own file; the mechanism is the same, only the rules change.
NDAA §889 & FY26 NDAA
Procurement restrictions on covered foreign entities
FCC Covered List
Effective 2025-12-23: DJI, Autel, Hesai, Unitree, et al.
Executive Order 14307
"Unleashing American Drone Dominance"
ASRA (pending)
American Security Robotics Act, tracked, activates on enactment
Override path: Non-US deployments use
urml validate --policy file.yaml
or disable the compliance pass entirely with
--no-policy.
When you're listed
A reproducible self-report you can link from your product page.
FEDERAL-VALIDATION SELF-REPORT
validates clean · pinned commit
A self-report, not a badge of certification
A `URML-FEDERAL-VALIDATION.md` at the root of your own repo, pinned to a URML commit. URML hosts nothing; anyone can reproduce it because the default policy is Apache-2.0 and public.
REGISTRY · SELF-REPORTED · NO ENTRIES YET
The public registry is open and currently empty. URML does not certify, audit, or endorse listed entries; a listing reflects only that the maintainer ran the suite and submitted the result.
Directory listing
Public, queryable, free, opt-in, de-listable any time. Runtime authors and robot/parts makers have parallel directories.
MANDATORY DISCLAIMER: REPRODUCED FROM THE BUNDLED POLICY HEADER
THIS IS NOT LEGAL ADVICE. A policy file passing the validator is not a legal compliance
determination. Deployers must consult counsel for any binding compliance determination.
Audited and certified policy files carrying third-party legal attestation are a separate
commercial surface. A robot whose validation passes under the bundled default is not
automatically "URML-Certified" or "NDAA compliant"; certification is a separate, future,
paid program (Phase 4).
Frequently asked
What manufacturers want to know first.
Does this cost money?
No. The spec, the conformance suite, the registry, and the review are all free. There is no paid tier.
Is there a URML-Certified mark?
No. Certification is a separate, future, paid program (Phase 4, not in use today). A listing is a self-reported result, not a mark, not a certification.
Can I de-list later?
Yes, any time. Open a PR removing your row; it is gone within a day and the removal is recorded in git history.
What if I'm not US-based?
Use urml validate --policy to swap in your jurisdiction's policy file, or --no-policy to skip the compliance pass entirely. The mechanism is the same; only the rules change.
Does the WG see my source?
No. You submit a manifest and a conformance result. Your implementation stays yours.
What does a passing result mean?
Only that the named manifest validates clean under the bundled US-federal default policy at a pinned URML commit. It is not a compliance determination. See the disclaimer below.