URSSAF vigilance certificate for a French training organisation: when and how?

An OPCO holding back a payment while waiting for “your vigilance certificate”, a freelance trainer asking you for one before signing, or the other way round: this little-known document keeps resurfacing in a training organisation’s administrative life, in both directions. Many founders discover it exists the day a funder freezes a transfer — yet the obligation is old, precise, and easy to plan for.

What the vigilance certificate is, and why it concerns you

The vigilance certificate (attestation de vigilance) is a document issued by URSSAF (or MSA) certifying that a company is up to date with its social-security obligations: declarations and payment of contributions. It gives concrete form to the “duty of vigilance” imposed by articles L.8222-1 to L.8222-5 of the French Labour Code on any client contracting with a service provider, as a tool against undeclared work.

A training organisation runs into this obligation from both sides:

• as a client, when it hires a freelance trainer, another organisation as a subcontractor, a communications agency or an IT provider;
• as a service provider, when an OPCO, a client company, France Travail or a public body commissions a training course and asks for the certificate before paying.

The €5,000 excluding-tax threshold and the six-month check

The obligation kicks in once the total amount of the service reaches €5,000 excluding tax, a threshold set by article R.8222-1 of the Labour Code. Below that, there is no legal obligation — but many OPCOs and large accounts require the certificate systematically as a precaution, regardless of the contract’s amount, to secure their own chain of vigilance.

Once the threshold is crossed, the client must check its counterparty’s status when the contract is signed, then every six months until it ends — not just once for the whole contract. This is the point most often missed: a training organisation subcontracting to the same trainer for a full year must collect two certificates, not one.

Getting your own vigilance certificate as a training organisation

If you are the service provider (an OPCO or client is asking you for one), the certificate is generated from your personal account on urssaf.fr — or autoentrepreneur.urssaf.fr if you operate as a micro-entrepreneur — provided your contributions are up to date. It is issued almost instantly as a downloadable PDF, showing:

• your identification details (company name, SIRET, registered office and establishment addresses);
• confirmation that you are up to date with your social-security obligations;
• a unique 16-character security code, letting whoever receives it verify its authenticity online in under a minute on urssaf.fr, with no need to contact you directly.

Always keep a certificate less than six months old in your admin files, and attach it proactively to quotes and invoices for contracts over €5,000 excluding tax — it noticeably speeds up OPCO payment releases.

Collecting the certificate from your subcontractors and trainers

The other way round, as soon as a freelance trainer or a subcontracted organisation bills you more than €5,000 excluding tax over the life of the assignment, you must ask for their vigilance certificate, check its authenticity via the security code, and keep a dated record. This check is separate from the Qualiopi certification requirement for subcontractors that applies to CPF-funded courses: one covers social-security compliance, the other teaching quality, and an auditor can ask for both under indicator 27 on subcontracting and umbrella employment.

In practice, keep a simple tracking table: subcontractor name, cumulative amount for the period, date of the last certificate collected, date of the next six-month check. That document is what reassures an auditor or an OPCO during a review.

What you risk if you skip the check

If you fail to check your subcontractor’s status and they are later fined for undeclared work, you become jointly liable under article L.8222-2 of the Labour Code: for the evaded social-security contributions, unpaid taxes, and wages owed to undeclared employees. Conversely, a client who has properly collected and verified the authenticity of the certificates received is deemed to have met its duty of vigilance and cannot be held liable on that basis, even if the subcontractor later turns out to be at fault.

The law of 25 June 2026 tightens the framework

Law n° 2026-534 of 25 June 2026 on combating social and tax fraud, enacted after agreement in a joint parliamentary committee, strengthens this duty of vigilance for clients towards their subcontractors and toughens joint financial liability where undeclared work is found. It also clarifies, the other way round, that a client who obtained the documents certifying its subcontractor’s compliance and checked their authenticity is protected on that point. Several implementing decrees are expected by the end of 2026, notably on the subcontracting thresholds that trigger enhanced vigilance and on the exact content of the documents required — worth watching in the coming months if you subcontract regularly, alongside the legal and regulatory watch required under indicator 23.

A study by Kleven, Knudsen, Kreiner, Pedersen and Saez published in 2011 in Econometrica (“Unwilling or Unable to Cheat? Evidence from a Tax Audit Experiment in Denmark”, see on Google Scholar) finds that third-party verification mechanisms — like the certificate cross-checking imposed here on the client — cut declarative fraud far more effectively than after-the-fact audits, which illustrates the logic behind this shared-vigilance system between service provider and client.

Quick checklist for a training organisation

1. As a service provider: generate a vigilance certificate as soon as a contract reaches or could reach €5,000 excluding tax (in-house training for a company, an OPCO contract, a public tender) and attach it to your invoicing.
2. As a client: list the subcontractors and trainers billing you more than €5,000 excluding tax over the assignment, request their certificate at signature, and check the security code on urssaf.fr.
3. Renew every six months for as long as the contractual relationship continues — set a calendar reminder, as forgetting it is the most common cause of losing the protection.
4. Archive every certificate collected or issued, dated, in your quality file — it’s a simple document to produce during a URSSAF inspection or a Qualiopi audit.
5. Track the implementing decrees of the 25 June 2026 law over the rest of the year, especially if you subcontract a significant share of your activity.

Take action

The vigilance certificate joins the list of admin formalities to secure alongside your subcontracting obligations and your legal watch. The Complete Kit Certif (€297) covers indicator 27 with ready-to-use subcontracting contract and tracking templates, and the guide “Créer son organisme de formation en 30 jours” (€67) sequences all your administrative steps in the right order — or pick the Kit + Ebook bundle (€347) to cover both at once.