Prevention passport: what your training organization must report in 2026

If your training organization delivers SST (basic workplace first-aid), CACES®, electrical authorization (habilitation électrique), asbestos-risk prevention, or any other occupational health and safety action, a new line has been added to your administrative to-do list since 2026: reporting these trainings in each trainee’s prevention passport (passeport de prévention). The timeline was just revised by a decree dated 12 June 2026 — here’s what to report, by when, and what you risk if you forget.

An old mechanism, only just operational

The prevention passport isn’t a 2026 novelty as such: created by law n° 2021-1018 of 2 August 2021 to strengthen occupational health prevention, it gives each employee a digital space centralizing all the health and safety trainings, qualifications and certifications they have completed, viewable by themselves and by their employer throughout their career.

What had long been missing was the operational playbook for training organizations. That gap was filled by decree n° 2025-748 of 1 August 2025, which sets out the criteria for determining which SST trainings must be reported, the technical reporting process, and extends the system to the public sector. A year later, decree n° 2026-496 of 12 June 2026 adjusts an implementation timeline that both training organizations and employers found too tight.

Four categories of health and safety trainings, a phased scope

The 2025 decree distinguishes four categories of SST trainings by their level of regulatory oversight, with a staggered reporting start date.

Category 1, fully regulated trainings: objectives, content and evaluation methods set by a regulatory text, such as the radiation-protection competent person training or asbestos-risk prevention trainings (SS3 and SS4). Reportable since the system launched.

Category 2, trainings leading to an employer-issued authorization: only the objective is set by regulation, with the exact content left to the training organization or employer, who then issues the clearance. This covers CACES® and electrical authorization trainings — also part of the priority reporting scope.

Categories 3 and 4, less-regulated prevention trainings: their prevention objective isn’t strictly imposed by a text, but they lead to a certificate and build transferable skills — covering much of the broader field of regulatory SST trainings. Their inclusion in the reporting scope is more recent and gradual — precisely what the 12 June 2026 decree reschedules.

An official simulator lets you check, training by training, whether it falls within the prevention passport’s scope — a habit worth building into your process before each session rather than discovering the obligation after the fact.

Who reports: your organization, or the trainee’s employer?

Reporting doesn’t always fall to the training organization. Two scenarios apply:

• Training delivered to external trainees: the training organization reports the session in each participant’s prevention passport.
• Training delivered in-house by the employer (using an employed trainer, without an external provider): the employer reports it directly, and must also verify declarations made on its behalf whenever it hired an external provider.

This dual responsibility — reporting on one side, verifying on the other — helps explain why the original timeline proved too ambitious.

The new timeline set by the 12 June 2026 decree

The original regime placed a new obligation on employers starting 16 March 2026: report in-house SST trainings themselves, and verify declarations made on their behalf by training organizations, with a transitional regime initially limiting the obligation to categories 1 and 2. Faced with implementation difficulties reported from the field, decree n° 2026-496 of 12 June 2026 made several adjustments:

• 9 July 2026: launch of a bulk-import feature, letting an organization report trainings completed by several trainees in a single operation — a real time-saver for group sessions;
• 1 October 2026: new deadline for training organizations to report certain older trainings (notably those completed, or whose validity began, in September 2025);
• 1 January 2027: new deadline for employers to verify all declarations concerning them, whether for in-house or externally delivered trainings;
• 31 December 2026: the progressive regime applicable to employers, originally due to end on 30 September 2026, is extended by three months;
• 16 November 2026: date from which each passport holder can access their own prevention passport, view the data it contains, and add certificates and diplomas they obtained on their own initiative.

For a training organization, the practical takeaway is clear: the timeline was eased, not scrapped. Better to get into the habit of reporting each session as it happens than to let a backlog build up before the October deadline.

A passport now open to any CPF account holder

Law n° 2026-534 of 25 June 2026 on combating social and tax fraud — already known for its provisions on DGEFP fines and the sanctions registry — adds a further clarification, effective since 27 June 2026: the prevention passport is now open to any holder of a personal training account (CPF), not only employees currently in a job — consistent with its purpose of following a person throughout their career rather than remaining a purely internal company register.

Penalties for non-compliance

Failing to report is punished by an administrative fine, under the conditions set by the French Labor Code (Article L. 6356-1 et seq.):

• capped at €2,000 per breach found;
• doubled for a repeat offense of the same kind found within two years of a first fine being notified;
• increased by 50% if the organization had already received a warning for the same type of breach in the preceding year.

This regime adds to, without replacing, the broader panorama of sanctions a training organization faces for breaching its reporting obligations.

What research says about tracking safety trainings

The logic behind the prevention passport — precisely documenting who completed which training — echoes an issue studied in occupational health research. A landmark systematic review by Lynda S. Robson and coauthors, published in 2012 in the Scandinavian Journal of Work, Environment & Health, examined all available controlled trials on the effectiveness of occupational health and safety training: it found a measurable positive effect on worker behaviors, while noting weaker evidence on long-term health effects themselves (see the study) — a result that supports the case for the kind of traceability the passport represents.

This new reporting burden also fits a broader pattern studied in small-business research, a category most training organizations belong to. A study by John Kitching, Mark Hart and Nick Wilson, published in 2015 in the International Small Business Journal, shows that the relationship between regulatory obligations and small-business performance is more nuanced than a simple burden: regulation can both constrain and, in some cases, strengthen an activity’s credibility (see the study) — a point that echoes the spirit of the regulatory watch expected under Qualiopi indicator 23.

How to get compliant now

• Identify which of your trainings are covered using the official simulator: SST, CACES®, electrical authorization, asbestos SS3/SS4, and more broadly any action falling under regulatory SST trainings.
• Report each session as it happens, rather than waiting for the October 2026 deadline, using the bulk-import feature from 9 July 2026 for group sessions.
• Check the status of your older trainings, particularly those completed in autumn 2025, now subject to the new 1 October 2026 deadline.
• Inform your employer clients of their own obligation to verify declarations.
• Log this new obligation in your regulatory watch, alongside other recent changes to training regulations.

Take action

The Complete Kit Certif (€297, 14-day guarantee) provides the method and legal-watch tables to fold a new obligation like this into your quality system without losing time on every regulatory change. If you’re starting a training organization, especially one delivering regulated actions like SST or CACES®, the ebook Create Your Training Organization in 30 Days (€67) covers the administrative basics from the activity declaration onward, and the Complete Pack (€347) bundles both resources to handle each new obligation with confidence.