Electronic archiving of Qualiopi evidence: digital vaults and legal probative value

A Caisse des Dépôts inspector asks to see, for a session run two years earlier, the attendance sheet, the programme and the certificat de réalisation. They exist — somewhere, in a shared folder, on a computer whose hard drive has since been replaced, in the mailbox of an employee who has since left. Nothing has been altered, but nothing formally proves it either. That is exactly what electronic archiving is meant to solve — and it’s also where most French training organisations improvise.

What the regulation actually requires

No text requires a training organisation to hold a certified electronic archiving system. The obligation that does exist is different: article L6362-6 of the Labour Code requires being able to present, on request from the administration or a funder, the documents justifying that an action actually took place; failing that, the action is deemed not to have happened and the sums received must be reimbursed. The national quality framework adds its own layer of requirement through indicator 32 (continuous improvement and risk management), which assumes reliable traceability of evidence from one year to the next — of the same kind expected under indicator 27 when the service is subcontracted.

What these texts require are outcomes — integrity, availability, traceability — not a specific technology. A well-kept paper binder already met these criteria; a poorly organised digital folder meets them no better than a misplaced box file, even though it looks more modern.

NF Z42-013 and NF Z42-020: two standards, two scopes

Two French standards structure this topic, and they are often confused:

• NF Z42-013, now aligned with the international standard ISO 14641, describes the requirements for a full electronic archiving system (EAS): document lifecycle management, preservation format, event log, retrieval procedure in the event of a check.
• NF Z42-020, published in 2012, covers a narrower scope: the digital vault component, a module that guarantees the integrity and confidentiality of deposited documents, without necessarily offering the full document-management functions of a complete EAS.

A consumer-grade “digital vault” (often offered by a bank or a personal-vault provider) typically meets NF Z42-020, not NF Z42-013: it protects a deposit, but does not manage the full document lifecycle that an in-depth audit might require over several years.

What NF461 certification does — and doesn’t — guarantee

NF461 certification, issued by AFNOR Certification, attests that an electronic archiving system complies with both NF Z42-013 and ISO 14641. It certifies the publisher or provider of the solution, not the training organisation using it: subscribing to an NF461-certified service gives a strong presumption of reliability in a dispute, but doesn’t exempt the organisation from properly filing and documenting its own archives inside that tool.

In practice, a training organisation doesn’t need to obtain the certification itself: it simply chooses, where relevant, a provider that is already certified — the same way it would choose a hosting provider or a management software vendor.

Do you actually need a certified solution?

For most small and mid-sized organisations, the answer is no — as the article on document retention periods points out: a digital folder organised by session, backed up regularly and time-stamped on export, comfortably covers the requirements of a surveillance or renewal audit.

Certified archiving becomes relevant in specific situations:

• high volume of sessions across several different funders (CPF, OPCO, regional councils, European funds), with retention periods reaching up to 10 years for FSE+ funding;
• cascading subcontracting, where several organisations must produce consistent evidence and a shared, tamper-proof deposit limits disputes;
• an explicit contractual clause from a funder or client requiring archiving with probative value;
• multi-site organisations looking to centralise evidence produced by several teams without depending on a single workstation.

Outside these cases, investing in a certified EAS before internal processes have stabilised often ends up dressing up an organisational problem rather than solving it.

Timestamping and probative value: what eIDAS changes

The European eIDAS regulation (No 910/2014) governs the legal value of electronic timestamping across the European Union. A qualified timestamp benefits from a legal presumption of accuracy for the date and time it certifies, enforceable in court without having to prove anything further. A simple timestamp — for instance, that of a PDF export or an email — remains admissible as evidence, but an opposing party can more easily challenge its reliability.

For a training organisation, the practical consequence is straightforward: time-stamping evidence at the close of each session (rather than after the fact, just before an audit) considerably strengthens its value in a dispute with a funder or an administrative check.

What long-term archiving research shows

The hard part isn’t storing a file, but guaranteeing that it stays intact, authentic and verifiably dated years after it was created — a problem the academic literature on digital archiving has documented for some time. A reference study by Vigil, Buchmann, Cabarcas, Weinert and Wiesmaier, published in 2015 in the journal Computers & Security (“Integrity, authenticity, non-repudiation, and proof of existence for long-term archiving: A survey”), shows that the cryptographic mechanisms used to guarantee a document’s integrity (signatures, hashes, timestamps) themselves have a limited lifespan: an algorithm considered secure today can become vulnerable in ten or fifteen years, which means the oldest archives must periodically be re-signed or re-timestamped to preserve their probative value.

That conclusion applies directly to training organisations subject to the longest retention periods — ten years for an FSE+ co-funded action: a single export, time-stamped once and for all, doesn’t offer the same guarantee over time as an archiving process that periodically refreshes its integrity evidence, which is exactly what NF461-certified solutions provide.

Setting up reliable archiving without overengineering it

A handful of principles cover almost every situation encountered at audit:

1. One folder per session, sorted by date, bringing together the agreement, programme, attendance sheets and certificat de réalisation — never scattered across several tools.
2. A time-stamped export at the close of the session, not at the time of the check: it’s the document’s actual creation date that must be demonstrable.
3. Regular, tested backups, kept off a single person’s workstation, to avoid an employee’s departure or a hardware failure wiping out evidence — a risk of the same kind described in the article on ransomware attacks against training organisations.
4. A minimal access-and-change log, even a basic one (file name, date, author), to be able to trace who produced or modified a document.
5. An annual check, before each surveillance or renewal audit, that evidence from past sessions remains readable and accessible — an obsolete file format is just as much a problem as a lost folder.

Take action

The Complete Kit Certif provides a ready-to-use archiving template, organised indicator by indicator, with every document template expected under the framework (€297, 14-day guarantee). If you’re starting your organisation, the ebook Create your training organisation in 30 days builds good filing and archiving habits in from day one, or choose the full pack — kit plus ebook.