Enacted by Stats. 1994, Ch. 920, Sec. 2.
The Secretary of State shall not approve any voting system, or part of a voting system, unless it fulfills the requirements of this code and the regulations of the Secretary of State.
Article 1 - Procedures for Certification of Voting Systems
California Elections Code — §§ 19200-19219
Sections (22)
Amended by Stats. 2024, Ch. 605, Sec. 12. (SB 1328) Effective September 25, 2024.
(a)(1) The Secretary of State may grant conditional approval to a voting system or part of a voting system under either of the following circumstances:
(A) A voting system or part of a voting system was decertified as a result of a review by the Secretary of State pursuant to Section 19232.
(B) A certified voting system or part of that voting system is modified to comply with voting system standards or changes in statute.
(2)For purposes of granting conditional approval to a voting system or part of a voting system pursuant to
paragraph (1), the Secretary of State may impose additional conditions of approval as deemed necessary by the Secretary of State.
(b)The Secretary of State may withdraw conditional approval at any time pursuant to Section 19232.
Amended by Stats. 2016, Ch. 422, Sec. 81. (AB 2911) Effective January 1, 2017.
(a)Except as authorized by Section 19209, a voting system, in whole or in part, shall not be used unless it has been certified or conditionally approved by the Secretary of State prior to any election at which it is to be used.
(b)A voting system that has been tested and approved for use in all elections by the Secretary of State before January 1, 2014, shall be deemed certified or conditionally approved by the Secretary of State and may be used in an election subject to any conditions placed on the use of the voting system by the Secretary of State before January 1, 2014, including conditions imposed in the reapproval documents issued by the Secretary of State in 2007 and 2008 following the Top-to-Bottom Review, and its subsequent revisions. The voting
systems described in this subdivision shall remain subject to review and decertification by the Secretary of State at any time pursuant to Section 19232.
(c)A vendor or county, upon obtaining federal qualification on or before April 28, 2016, may request approval of the voting system from the Secretary of State based on the examination and review
requirements in place before January 1, 2014.
(d)A jurisdiction shall not purchase or contract for a voting system unless it has been certified or conditionally approved by the Secretary of State.
(e)Notwithstanding subdivision (d), a local jurisdiction may contract and pay for the following:
(1)Research and development of a new voting system that has not been certified or conditionally approved by the Secretary of State and uses only nonproprietary software and firmware with disclosed source code, except for unmodified commercial off-the-shelf software and firmware, as defined in paragraph (1) of subdivision (a) of Section 19209.
(2)Manufacture of the minimum number of voting system units reasonably necessary for either of the following
purposes:
(A)To test and seek certification or conditional approval of the voting system pursuant to Sections 19210 to 19214, inclusive.
(B)To test and demonstrate the capabilities of the voting system in a pilot program pursuant to paragraph (2) of subdivision (b) of, and subdivision (c) of, Section 19209.
Added by renumbering Section 19216 by Stats. 2013, Ch. 602, Sec. 31. (SB 360) Effective January 1, 2014.
The Secretary of State shall not certify or conditionally approve a voting system or a part of a voting system that uses paper ballots unless the paper used for the ballots is of sufficient quality that it maintains its integrity and readability throughout the retention period specified in Chapter 4 (commencing with Section 17300) of Division 17.
Added by renumbering Section 19200.5 by Stats. 2013, Ch. 602, Sec. 11. (SB 360) Effective January 1, 2014.
The Secretary of State shall not certify or conditionally approve any voting system that includes features that permit a voter to produce, and leave the polling place with, a copy or facsimile of the ballot cast by the voter at that polling place.
Added by Stats. 2015, Ch. 723, Sec. 9. (AB 44) Effective January 1, 2016.
(a)The Secretary of State shall not certify or conditionally approve a voting system that cannot facilitate the conduct of a ballot level comparison risk-limiting audit.
(b)(1) For purposes of this subdivision, a voting system that is “noncompliant” is a voting system that cannot facilitate the conduct of a ballot level comparison risk-limiting audit.
(2)Notwithstanding subdivision (a), the Secretary of State may, until January 1, 2021, approve a proposed change or modification to a noncompliant voting system even if the voting system will remain noncompliant after the change or
modification. This paragraph shall become inoperative on January 1, 2021.
Amended by Stats. 2024, Ch. 605, Sec. 13. (SB 1328) Effective September 25, 2024.
A voting system shall comply with all of the following:
(a)No part of the voting system shall be connected to the internet at any time.
(b)No part of the voting system shall electronically receive or transmit election data through an exterior communication network, including the public telephone system, if the communication originates from or terminates at a polling place, satellite location, or counting center.
(c)(1) No part of the voting system shall receive or transmit wireless communications or wireless data transfers.
(2)A network connection to any device not directly used and necessary for voting system functions shall not be established. Communication by or with any component of the voting system by wireless or modem transmission at any time is prohibited. A component of the voting system, or any device with network connectivity to the voting system, shall not be connected to the internet, directly or indirectly, at any time.
(d)(1) The voting system shall be used in a configuration of parallel central election management systems separated by an air-gap.
(2)For purposes of this subdivision, “air-gap” includes all of the following:
(A)A permanent central system known to be running unaltered, certified
software and firmware that is used solely to define elections and program voting equipment and memory cards.
(B)A physically isolated duplicate system, reformatted after every election to guard against the possibility of infection, that is used solely to read memory cards containing vote results, accumulate and tabulate those results, and produce reports.
(C)A separate computer dedicated solely to this purpose that is used to reformat all memory devices before they are connected to the permanent system again.
Repealed and added by Stats. 2013, Ch. 602, Sec. 19. (SB 360) Effective January 1, 2014.
Except as authorized by Section 19209, both of the following apply:
(a)If more than one voting system is used to count ballots, the names of candidates shall, insofar as possible, be placed on the primary voting system.
(b)If more than one voting system or a combination of a voting system and paper ballots is used to count ballots, a single ballot measure or the candidates for a single office may not be split between voting systems or between a voting system and paper ballots.
Added by renumbering Section 19210 by Stats. 2013, Ch. 602, Sec. 23. (SB 360) Effective January 1, 2014.
The governing board may adopt for use at elections any kind of voting system, any combination of voting systems, or any combination of a voting system and paper ballots, provided that the voting system or systems involved have been certified or conditionally approved by the Secretary of State or specifically authorized by law pursuant to Section 19209.
Added by Stats. 2023, Ch. 300, Sec. 4. (AB 969) Effective October 4, 2023.
(a)An elections official or the governing body of any jurisdiction that administers elections shall use a voting machine, as defined in Section 361, or a voting system, as defined in Section 362, that has been certified pursuant to this division, to do all of the following:
(1)Provide sufficient numbers of voting machines or voting systems for accessibility pursuant to Section 19242 and the Help America Vote Act of 2002 (52 U.S.C. Sec. 20901 et seq.).
(2)Tabulate votes.
(b)If a jurisdiction that administers elections terminates a contract for an existing certified voting system, that termination shall be provisional and shall not become final unless and until the jurisdiction that administers elections has satisfied all of the following:
(1)The jurisdiction has a plan to transition to a new voting system
that will ensure compliance with applicable state and federal laws.
(2)The jurisdiction has finalized and signed a new contract for a certified voting system.
Added by renumbering Section 19212 by Stats. 2013, Ch. 602, Sec. 25. (SB 360) Effective January 1, 2014.
The governing board may provide for the payment of the cost of the voting system equipment in any manner and by any method as it deems best for local interests, and also may for that purpose issue bonds, certificates of indebtedness, or other obligations that shall be a charge on the county or city. The bonds, certificates, or other obligations may be issued with or without interest, payable at any time as the authorities may determine, but shall not be issued or sold at less than par. The governing board may enter into lease agreements or lease-purchase agreements for the use of equipment.
Added by renumbering Section 19211 by Stats. 2013, Ch. 602, Sec. 24. (SB 360) Effective January 1, 2014.
(a)For purposes of this section, the following terms have the following meanings:
(1)“Commercial off-the-shelf” means mass-produced, readily available hardware devices, including card readers, printers, or personal computers, and their firmware or software products, including operating systems, programming language compilers, or database management systems.
(2)“Incorrect in part” means a full manual tally of the votes cast on the pilot system would reveal rates of error in the pilot system tally that, if extrapolated to the entire contest, would alter the electoral outcome.
(3)“Partial risk-limiting audit” means a procedure that guarantees a large minimum chance of a full manual tally of the votes cast on the pilot system if the electoral outcome is incorrect in part.
(4)“Risk-limiting audit” means a procedure that ensures a large, predetermined minimum chance of requiring a full manual tally whenever a full manual tally would show an electoral outcome that differs from the outcome reported by the voting system for the audited contest.
(b)The governing board, without formally adopting a voting system, may provide for the experimental use of the voting system in a pilot program held in one or more precincts at a single election or, in the case of a special election, the special primary
election and the special general election, if the voting system complies with either of the following:
(1)The voting system is certified or conditionally approved prior to its experimental use.
(2)The voting system meets all of the following requirements:
(A)Uses only software and firmware with disclosed source code, except for unmodified commercial off-the-shelf software and firmware.
(B)Meets the requirements of subdivision (b) of Section 19101.
(C)Meets the requirements of the regulations adopted by the Secretary of State pursuant to subdivision (g).
(D)Implements risk-limiting audits.
(c)A voting system that meets all of the requirements of paragraph (2) of subdivision (b) need not be certified or conditionally approved prior to its experimental use in a pilot program if the number of voting system units deployed in the pilot program is limited to the number necessary to test and demonstrate the capabilities of the voting system in a limited number of precincts or locations, including a prudent number of reserve units to ensure that sufficient working units will be available to conduct the pilot program. In no event shall the number of voting system units exceed 50 percent of the estimated number of units that would be required for full deployment of the voting system at every polling place and early voting site in a statewide election throughout the jurisdiction.
Capabilities that may be taken into account in determining the number of voting system units reasonably necessary to test and demonstrate the capabilities of the voting system include, but are not limited to, all of the following:
(1)The capability of the voting system to accommodate voting in all languages in which the jurisdiction is required to provide ballots under applicable state and federal laws.
(2)The capability of the voting system to accommodate voting by persons with a broad range of physical and cognitive disabilities, as required by applicable state and federal laws.
(3)The current and projected number of voting-eligible individuals in the jurisdiction.
(4)The geography and distribution of the population in the jurisdiction.
(d)No later than nine months before the election at which the pilot program of a voting system is proposed to be conducted, the governing board shall submit to the Secretary of State a plan for the pilot program. The Secretary of State shall approve or reject the plan no later than three months after receipt of the plan.
(e)The votes cast on a voting system during a pilot program pursuant to subdivision (b) shall be subject to risk-limiting audits.
(1)For each contest conducted entirely on the pilot voting system, the jurisdiction conducting the pilot program shall conduct a risk-limiting audit with at least a 90-percent chance of requiring a
full manual tally of the contest whenever a full manual tally would show an outcome that differs from the outcome reported by the pilot voting system.
(2)For each contest conducted partially on the pilot voting system, the jurisdiction conducting the pilot program shall conduct a partial risk-limiting audit of the portion of the contest in which the voters cast their votes on the pilot voting system, with at least a 90-percent chance of requiring a full manual tally of all votes
cast using the pilot voting system whenever the outcome is incorrect in part.
(3)(A) If a risk-limiting audit of a contest leads to a full manual tally of all of the ballots cast in the contest, then the contest outcome according to that manual tally shall become the official result.
(B)If a partial risk-limiting audit of a contest leads to a full manual tally of the ballots cast using the pilot voting system, the vote counts according to that manual tally shall replace the vote counts reported by the pilot voting system for the purpose of determining the official contest results.
(4)Risk-limiting audit procedures shall comply with all other requirements in regulations adopted by the
Secretary of State pursuant to subdivision (g).
(f)Upon completion of the pilot program, the governing board shall notify the Secretary of State in writing of any defect, fault, or failure of the hardware, software, or firmware of the voting system or a part of the voting system.
(g)A voting system pilot program shall not be conducted in a legally binding election without the prior approval of the Secretary of State. The Secretary of State shall adopt and publish regulations governing voting system pilot programs.
Added by renumbering Section 19202 by Stats. 2013, Ch. 602, Sec. 14. (SB 360) Effective January 1, 2014.
(a)A person, corporation, or public agency owning or having an interest in the sale or acquisition of a voting system or a part of a voting system may apply to the Secretary of State for certification that includes testing and examination of the applicant’s system by a state-approved testing agency or expert technicians and a report on the findings, which shall include the accuracy and efficiency of the voting system. As part of its application, the applicant shall notify the Secretary of State in writing of any known defect, fault, or failure of the version of the hardware, software, or firmware of the voting system or a part of the voting system submitted. The Secretary of State shall not begin his or her certification process until he or she
receives a completed application. The applicant shall also notify the Secretary of State in writing of any defect, fault, or failure of the version of the hardware, software, or firmware of the voting system or a part of the voting system submitted that is discovered after the application is submitted and before the Secretary of State submits the report required by Section 19213. The Secretary of State shall complete his or her certification process without undue delay.
(b)The Secretary of State shall publish and make publicly available on his or her Internet Web site a quarterly report of regulatory activities related to voting systems.
(c)As used in this article:
(1)“Defect” means any flaw in the hardware or
documentation of a voting system that could result in a state of unfitness for use or nonconformance to the manufacturer’s specifications or applicable law.
(2)“Failure” means a discrepancy between the external results of the operation of any software or firmware in a voting system and the manufacturer’s product requirements for that software or firmware or applicable law.
(3)“Fault” means a step, process, or data definition in any software or firmware in a voting system that is incorrect under the manufacturer’s program specification or applicable law.
Added by renumbering Section 19204 by Stats. 2013, Ch. 602, Sec. 16. (SB 360) Effective January 1, 2014.
(a)Prior to publishing his or her decision to certify, conditionally approve, or withhold certification of a voting system or part of a voting system, the Secretary of State shall provide for a 30-day public review period and conduct a public hearing to give persons interested an opportunity to review testing and examination reports and express their views for or against certification or conditional approval of the voting system.
(b)The Secretary of State shall give notice of the public review period and hearing in the manner prescribed in Section 6064 of the Government Code in a newspaper of general circulation published in Sacramento County.
The Secretary of State shall also provide notice of the hearing on his or her Internet Web site. The Secretary of State shall transmit written notice of the hearing, at least 14 days prior to the public review period and hearing, to each county elections official, to any person that the Secretary of State believes will be interested in the public review period and hearing, and to any person who requests, in writing, notice of the public review period and hearing.
(c)The decision of the Secretary of State to certify, conditionally approve, or withhold certification of a voting system or part of a voting system shall be in writing and shall state the findings of the Secretary of State. The decision shall be open to public inspection.
Amended by Stats. 2025, Ch. 238, Sec. 10. (SB 851) Effective October 1, 2025.
(a)(1) No later than 10 business days after the Secretary of State certifies or conditionally approves the use of a new or updated voting system, the vendor or county seeking certification or approval of the voting system shall cause an exact copy of the approved source code for each component of the voting system, including complete build and configuration instructions and related documents for compiling the source code into object code, to be transferred directly from the voting system testing agency that evaluated the voting system and is approved by the Secretary of State, and deposited into an approved escrow facility.
(2)No later than 10 business days after the Secretary of State certifies or conditionally approves a new or updated
ballot marking system, the vendor or county seeking certification or approval of the ballot marking system shall cause an exact copy of the approved source code for each component of the ballot marking system, including complete build and configuration instructions and related documents for compiling the source code into object code, to be deposited into an approved escrow facility.
(b)The Secretary of State shall adopt regulations relating to all of the following:
(1)The definition of source code components of a voting system or ballot marking system, including source code for all firmware and software of the voting system or ballot marking system. Firmware and software shall include commercial off-the-shelf or other third-party firmware and software that is available and able to be disclosed by the vendor or county seeking certification or approval of a voting system or ballot
marking system.
(2)Specifications for the escrow facility, including security and environmental specifications necessary for the preservation of the voting system or ballot marking system source codes.
(3)Procedures for submitting voting system or ballot marking system source codes.
(4)Criteria for access to voting system or ballot marking system source codes.
(5)Requirements for the applicant to include in the materials deposited in escrow build and configuration instructions and documents so that a neutral third party may create, from the source codes in escrow, executable object codes identical to the code installed on certified or conditionally approved voting systems or ballot marking systems.
(c)The Secretary of State shall have reasonable access to the materials placed in escrow, under any of the following circumstances:
(1)In the course of an investigation or prosecution regarding vote counting or ballot marking equipment or procedures.
(2)Upon a finding by the Secretary of State that an escrow facility or escrow company is unable or unwilling to maintain materials in escrow in compliance with this section.
(3)In order to fulfill the provisions of this chapter related to the examination and certification or conditional approval of voting systems or ballot marking systems.
(4)In order to verify that the software on a voting system is identical to the certified or conditionally approved version.
(5)For any other purpose deemed necessary to fulfill the provisions of this code or Section 12172.5 of the Government Code.
(d)The Secretary of State may seek injunctive relief requiring the elections officials, approved escrow facility, or any vendor or manufacturer of a voting system or part of a voting system to comply with this section and related regulations. Venue for a proceeding under this section shall be exclusively in Sacramento County.
(e)This section applies to all elections.
Added by renumbering Section 19207 by Stats. 2013, Ch. 602, Sec. 20. (SB 360) Effective January 1, 2014.
Within 60 days after the completion of the examination of a voting system, the Secretary of State shall make publicly available a report stating whether the voting system has been certified or conditionally approved, or whether certification has been withheld. The report shall also contain a written or printed description and drawings and photographs that clearly identify the machine or device and its mechanical operation.
Added by renumbering Section 19209 by Stats. 2013, Ch. 602, Sec. 22. (SB 360) Effective January 1, 2014.
Within 10 days after issuing and filing a certification decision and associated testing reports, the Secretary of State shall make available to the public a full and complete copy of the certification report and all associated documentation, except that portions of the report or documentation that contain information that the Secretary of State determines to be confidential or proprietary shall not be made publicly available. The Secretary of State shall also notify the board of supervisors and elections official of each county of the availability of the report and associated documentation.
Amended by Stats. 2025, Ch. 238, Sec. 11. (SB 851) Effective October 1, 2025.
If a voting system or a part of a voting system has been certified or conditionally approved by the Secretary of State, the vendor or, in cases where the system is publicly owned, the jurisdiction shall notify the Secretary of State and all local elections officials who use the system in writing of any defect, fault, or failure of the hardware, software, or firmware of any voting system or part of any voting system created or manufactured by the vendor, or supplied by the vendor to any jurisdiction, within 30 calendar days after the vendor learns of the defect, fault, or failure.
Added by renumbering Section 19213 by Stats. 2013, Ch. 602, Sec. 27. (SB 360) Effective January 1, 2014.
If a voting system or a part of a voting system has been certified or conditionally approved by the Secretary of State, it shall not be changed or modified until the Secretary of State has been notified in writing and has determined that the change or modification does not impair its accuracy and efficiency sufficient to require a reexamination and recertification, or conditional approval, pursuant to this article. The Secretary of State may adopt rules and regulations governing the procedures to be followed in making his or her determination as to whether the change or modification impairs accuracy or efficiency.
Added by renumbering Section 19214 by Stats. 2013, Ch. 602, Sec. 28. (SB 360) Effective January 1, 2014.
The Secretary of State may seek injunctive and administrative relief if a voting system or a part of a voting system has been compromised by the addition or deletion of hardware, software, or firmware without prior approval or is defective due to a known hardware, software, or firmware defect, fault, or failure that has not been disclosed pursuant to Section 19210 or 19215.
Added by renumbering Section 19214.5 by Stats. 2013, Ch. 602, Sec. 29. (SB 360) Effective January 1, 2014.
(a)The Secretary of State may seek all of the following relief for an unauthorized change in hardware, software, or firmware in a voting system certified or conditionally approved in California:
(1)A civil penalty from the offending party or parties, not to exceed ten thousand dollars ($10,000) per violation. For purposes of this subdivision, each voting system component found to contain the unauthorized hardware, software, or firmware shall be considered a separate violation. A penalty imposed pursuant to this subdivision shall be apportioned 50 percent to the county in which the violation occurred, if applicable, and 50 percent to the office of the Secretary of State for
purposes of bolstering voting systems security efforts.
(2)Immediate commencement of proceedings to withdraw certification or conditional approval for the voting system in question.
(3)Prohibiting the manufacturer or vendor of a voting system from doing elections-related business in the state for one, two, or three years.
(4)Refund of all moneys paid by a local agency for a voting system or a part of a voting system that is compromised by an unauthorized change or modification, whether or not the voting system has been used in an election.
(5)Any other remedial actions authorized by law to prevent unjust enrichment of the offending party.
(b)(1) The Secretary of State may seek all of the following relief for a known but undisclosed defect, fault, or failure in a voting system or part of a voting system certified or conditionally approved in California:
(A) Refund of all moneys paid by a local agency for a voting system or part of a voting system that is defective due to a known but undisclosed defect, fault, or failure, whether or not the voting system has been used in an election.
(B) A civil penalty from the offending party or parties, not to exceed fifty thousand dollars ($50,000) per violation. For purposes of this subdivision, each defect, fault, or failure shall be considered a separate violation. A defect, fault, or failure
constitutes a single violation regardless of the number of voting system units in which the defect, fault, or failure is found.
(C) In addition to any other penalties or remedies established by this section, the offending party or parties shall be liable in the amount of one thousand dollars ($1,000) per day after the applicable deadline established in Section 19215 until the required disclosure is filed with the Secretary of State.
(2)A penalty imposed pursuant to subparagraph (B) or (C) of paragraph (1) shall be deposited in the General Fund.
(c)Before seeking any measure of relief under this section, the Secretary of State shall hold a public hearing. The Secretary of State shall give notice of the hearing in the
manner prescribed by Section 6064 of the Government Code in a newspaper of general circulation published in Sacramento County. The Secretary of State also shall transmit written notice of the hearing, at least 30 days prior to the hearing, to each county elections official, the offending party or parties, a person that the Secretary of State believes will be interested in the hearing, and a person who requests, in writing, notice of the hearing.
(d)The decision of the Secretary of State to seek relief under this section shall be in writing and state his or her findings. The decision shall be open to public inspection.
Added by renumbering Section 19215 by Stats. 2013, Ch. 602, Sec. 30. (SB 360) Effective January 1, 2014.
(a)The Secretary of State may seek injunctive relief requiring an elections official, or any vendor or manufacturer of a voting machine, voting system, or vote tabulating device, to comply with the requirements of this code, the regulations of the Secretary of State, and the specifications for voting machines, voting devices, vote tabulating devices, and any software used for each, including the programs and procedures for vote tabulating and testing.
(b)Venue for a proceeding under this section shall be exclusively in Sacramento County.