CNAPS and Qualiopi: What It Takes to Train Private-Security Agents in France

In most sectors, the question “Is Qualiopi mandatory?” calls for a nuanced answer: mandatory for public and pooled funding, optional otherwise — the topic of our article Is Qualiopi mandatory?. Training for private-security activities is the exception: here, Qualiopi has become a legal condition of doing business, embedded in a wider scheme run by the CNAPS (the French national council for private-security activities). Here is how this uniquely layered system works.

Two different logics, one provider

The CNAPS — a public body supervised by the Interior Ministry — controls access to the private-security market: who may operate, who may train, who may enter training. Its logic is administrative policing: integrity, aptitude, traceability.

Qualiopi certifies the quality of a training provider’s processes against the national quality framework (RNQ) and its 32 indicators. Its logic is quality: public information, course design, resources, continuous improvement.

Until 2025 these two worlds sat side by side without touching: the right to train private-security agents came from a sector-specific certification (in force since 2018), and Qualiopi was added on top to unlock funding. The reform carried by ordinance no. 2023-374 of 16 May 2023 and decree no. 2024-311 of 4 April 2024 merged them on one decisive point.

What changed on 1 March 2025

Since 1 March 2025, the operating authorisation issued by the CNAPS to training providers rests on three conditions:

Condition	Issued by	Validity
Activity declaration — the NDA (registered activity number)	DREETS (regional labour authority)	Until it lapses
Qualiopi certification	Accredited certification body	3 years (with a surveillance audit)
Director approval (agrément)	CNAPS	5 years

The sector-specific certification is gone: Qualiopi is now the required quality certification for private-security training. On top come the operating authorisation itself, the professional trainer card (5 years) for every instructor, the declaration of each session to the CNAPS at least 15 days before it opens, and the individual prior authorisation of trainees. The full pathway is described in our guide to the CNAPS authorisation.

In practice: what each building block gives you

• Without the NDA: you are not a training provider under the labour code — nothing else is possible.
• Without Qualiopi: no standard operating authorisation (at best a six-month provisional authorisation while you obtain it), and no access to CPF, OPCO or France Travail funding.
• Without director approval: no authorisation at all, and criminal exposure of up to three years’ imprisonment and a €45,000 fine for whoever runs the business anyway.
• Without the operating authorisation: a ban on delivering any private-security training, even free of charge, even with Qualiopi.
• Without a trainer card: the instructor cannot teach, and the provider using them faces CNAPS sanctions.

Read it as a funnel: the labour code qualifies the organisation, Qualiopi qualifies its processes, and the CNAPS qualifies the people — director, trainers, trainees — while keeping its hand on the right to operate.

Why such layering?

Regulating through training is the preferred lever European states use to professionalise private security. Rick van Steden and Rick Sarre’s 2007 study in Security Journal (“The Growth of Private Security: Trends in the European Union”) documents the sector’s massive growth — over a million employees in the EU by the mid-2000s — and argues that professionalism and public accountability become central as security is privatised (see the study). Likewise, Mark Button shows that the most demanding European regimes make mandatory training the primary quality criterion for the sector (“Assessing the Regulation of Private Security across Europe”, European Journal of Criminology, 2007 — see).

By switching the quality condition to Qualiopi, France aligned the sector with the framework common to all vocational training — while keeping, through the CNAPS, a market-access control that Qualiopi alone does not provide.

The practical consequences for your quality system

For a private-security training provider, the Qualiopi audit is no longer just a funding ticket: it is a link in your right to operate. Three consequences:

1. Treat the 3-year cycle as a regulatory deadline, not a commercial one: losing the certification can lead to suspension or withdrawal of the CNAPS authorisation.
2. Make your evidence converge: the material and pedagogical requirements checked by professional branches and by the certifiers of the CQPs and titles you prepare overlap heavily with the national quality framework indicators (human and technical resources, course adaptation, trainer monitoring). One documentation system can feed both inspections.
3. Budget both lines: the Qualiopi certifier’s fees on one side (see our review of Qualiopi certification pricing), CNAPS procedures and background-check lead times on the other.

Take action

If you are building a private-security training offer, treat CNAPS and Qualiopi as one project with two tracks, not two successive projects. Our page CNAPS authorisation for private-security training providers sums up the conditions, procedures and pitfalls — with a free ebook to build your reverse schedule.