cmi5 Explained for Training Providers Moving Online

cmi5 is a rulebook for how a learning platform launches online content and records the result using xAPI. It says who starts a session, how the content gets permission to report, which statements it must send, and when a learner counts as finished. For a training provider moving classroom courses online, it decides whether your content and your platform can work together without custom integration.

Most explainers stop at “cmi5 is the successor to SCORM.” This guide covers what the published specification requires and applies it to a provider’s situation: blended programs, clients with their own LMSs, and vendor checks. It does not re-explain xAPI. It shows how cmi5 narrows it.

Key takeaways

• cmi5 is an xAPI profile that adds launch, authorization, session and completion rules for content played from an LMS.
• Content can live on any domain or in a mobile app, which SCORM does not support in the same way.
• Each course unit carries a moveOn rule that tells the LMS what counts as done.
• Pure classroom delivery does not need cmi5. Online content sold across different client LMSs often does.
• Support is uneven, so verify any vendor with a conformance test and a real package.

What is cmi5 and how does it relate to xAPI and SCORM?

cmi5 is an xAPI profile for content launched from an LMS. xAPI describes how to record learning activity but not how a system starts that activity. cmi5 adds the missing launch, authorization, session and completion rules, the job SCORM does with a browser-based JavaScript API. Its published release is Quartz, 1st Edition, dated June 1, 2016.

The cmi5 specification states the gap plainly: “xAPI does not specify launch mechanisms” (section 8.3). It names xAPI 1.0.3 as its reference (section 2.0) and requires the LMS to include a Learning Record Store, or LRS (sections 4.2 and 6.0). In the spec, “LMS” means the LMS and LRS together.

How does cmi5 differ from SCORM in practice?

The main differences are where content can live and how it reports. SCORM content finds a JavaScript API in the browser window and usually sits on the LMS’s own domain. cmi5 content receives a web address with parameters and talks to the LMS over HTTP, so it can be hosted elsewhere, run in a mobile app or sit on a local device.

The cmi5 project publishes its own SCORM versus cmi5 comparison. It is written from the cmi5 side, so treat it as claims to test. The table condenses it.

Topic	SCORM, per the cmi5 project	cmi5
Launch and communication	Content searches the browser window tree for a JavaScript API	Launch URL with query parameters, then web service calls
Where content lives	Typically on the same domain as the LMS	Any domain or local device
Mobile apps	Cannot be tracked	Not tied to a browser, so apps can be launched and tracked
Data and reporting	Fixed data elements, no standard bulk access	xAPI data, extensible, with standard retrieval
Sequencing and remediation	Rules built on simple sequencing	No sequencing rules by design, left to the LMS

The last row cuts both ways. If your SCORM courses depend on built-in sequencing, moving to cmi5 means your LMS must supply that logic.

What are the parts of a cmi5 course?

A cmi5 course has a course structure file, one or more Assignable Units (AUs), optional blocks that group them, and a registration for each learner enrollment. The AU is the launchable content and the unit of tracking. A learner who retakes the course gets a new registration. A session is one launch of one AU.

The package is an XML file named cmi5.xml, standalone or at the root of a ZIP. AUs can be bundled with relative URLs or referenced by fully qualified URLs, which is what lets content sit on another server (section 14.1).

For a provider, map carefully. A classroom day is not an AU, because there is nothing to launch. Only the online parts of a catalog course become AUs.

How does a cmi5 launch work, step by step?

The LMS records a launched statement, then opens the AU at a URL carrying five parameters. The AU makes one POST to the fetch URL to get a token that lasts for the session, reads its launch data from the LMS, and sends an initialized statement. Every later call uses the endpoint and token the LMS supplied.

1. Enroll. The enrollment creates a registration ID, a UUID, for this learner and course.
2. Prepare. Before launch, the LMS writes a State document named LMS.LaunchData holding the context template (including the session ID), launchMode, moveOn, masteryScore and an optional returnURL (section 10). It also records the launched statement.
3. Launch. The LMS opens the AU with the URL below. The AU must accept the parameters in any order (section 8.1).
4. Get a token. The AU POSTs to the fetch URL. A GET is not allowed. The response carries an auth-token, which the AU sends in the Authorization header from then on. The fetch URL is one-time use, and a repeat call should return an error (section 8.2).
5. Initialize. The AU sends initialized as the first statement of the session.
6. Report. As the learner works, the AU sends completed, passed or failed where relevant, each built from the context template.
7. Terminate. The AU sends terminated last, with a duration, then redirects to the returnURL if one was given. The LMS waits a set period and then rejects further statements for that session.

https://content.example.com/au1/start.html
  ?endpoint=https://lrs.example.com/xapi/
  &fetch=https://lms.example.com/token?k=abc123
  &actor={"objectType":"Agent","account":{"homePage":"https://lms.example.com","name":"learner-481"}}
  &registration=760e3480-ba55-4991-94b0-01820dbd23a2
  &activityId=https://lms.example.com/activities/au1

Each value is URL-encoded in a real launch. The spec adds that the LMS should build the actor from an LMS-specific account that does not include sensitive personal data (section 8.1.3), a useful default for providers handling learner records.

Pro tip: Test the abandoned path. In a pilot, close a browser tab mid-quiz, then relaunch the same enrollment. Section 9.3.6 says the LMS must record an abandoned statement for the first session and accept nothing more for it. Check that your reports show one abandoned and one clean session, because learners on weak connections will do this often.

Which statements does cmi5 require, and who sends them?

cmi5 defines nine verbs, and each belongs to one side. The content sends initialized, terminated and, depending on how it is built, completed, passed or failed. The LMS sends launched, abandoned, waived and satisfied. Order rules apply: initialized comes first, terminated last, and no verb repeats within a session. This is the narrowing of xAPI that makes reports comparable.

Verb	Sent by	Key rule (section 9.3)
launched	LMS	Recorded before the AU is launched, once per session
initialized	AU	First statement of the session
completed	AU	At most once per registration, with a duration
passed	AU	At most once per registration; any scaled score must meet masteryScore
failed	AU	Any scaled score must be below masteryScore; cannot follow passed
terminated	AU	Last statement of the session, with a duration
abandoned	LMS	Abnormal end, or a new launch while a session is active
waived	LMS	Requirement met another way; must include a reason
satisfied	LMS	All moveOn criteria in a block or course are met

Scores appear only in passed and failed statements (section 9.5.1). Content may also send “cmi5 allowed” statements with any verb, between initialized and terminated, so richer xAPI data still has a home (section 7.1.3).

How does moveOn decide whether a learner has finished?

Each AU in the course structure carries a moveOn value that tells the LMS what counts as done: Passed, Completed, CompletedAndPassed, CompletedOrPassed or NotApplicable. The default is NotApplicable, which means the AU counts as satisfied without any statement. A block is satisfied when its AUs are, and a course when everything inside it is (section 13.1.4).

That default has a trap. The LMS evaluates moveOn at registration (section 9.6.1), so a course whose AUs all use NotApplicable is satisfied the moment a learner enrolls. Set moveOn explicitly on every AU.

What does a blended provider course look like in cmi5?

Take a hypothetical two-day safety program with an online video, an online knowledge check and a classroom day. Only the first two are AUs. The video uses moveOn Completed. The check uses Passed with a masteryScore of 0.8. The classroom day stays in your scheduling system. The table traces one learner through the check.

Step	Sender	Statement	What it means
Earlier	AU 1 (video)	completed	Video AU satisfied under moveOn Completed
1	LMS	launched	Carries moveOn Passed and masteryScore 0.8
2	AU 2 (check)	initialized	Content ready for the learner
3	AU 2	passed, scaled 0.85	0.85 is at least 0.8, so the check is satisfied
4	AU 2	terminated	Session over, duration recorded
5	LMS	satisfied (course)	Both AUs have met their moveOn rules

If a learner is exempt, for example after testing out, the LMS can record waived with a reason such as Tested Out or Administrative (section 9.5.5.2).

Do training providers moving online need cmi5?

Not always. If your online content is simple SCORM that your LMS plays well, cmi5 adds little today. You need it when content and platform come from different vendors, when content must be hosted elsewhere or used in a mobile app, or when a client names it in a requirement. Pure classroom delivery does not need it.

Your situation	Does cmi5 matter?	Why
Mostly instructor-led, a few PDFs and videos	No	There is no launched content to track; scheduling and attendance live in your training system
Self-paced pre-work played in one LMS	Maybe	SCORM usually works; cmi5 helps if you want content hosted off the LMS or richer data
Selling the same e-learning to clients with their own LMSs	Yes, check each client	A cmi5 package only plays where the client LMS supports it, so keep a SCORM export too
Defense or government clients	Possibly	ADL built its cmi5 tools to ease the defense move to xAPI; read the contract
Building your own platform	Scope it	An LMS must run an LRS, import cmi5.xml and write launch data, which is real work

The last row is a scope question. Standards support is one line item among many in a custom build, and Mundrisoft’s post on why enterprises move to custom LMS platforms covers the wider decision.

What does cmi5 not do, and what should you watch for?

cmi5 does not define sequencing or remediation, does not log learners in, and needs an LRS behind the LMS. It covers launched online content, not classroom attendance. Support also varies by vendor, so a cmi5 package works only where the receiving system implements the specification.

• Login stays with the platform. The spec’s model assumes the learner authenticates with the LMS or a related system (section 5.0).
• The edition is old. The repository lists Quartz, 1st Edition (2016) as the current release as of November 2026, so ask vendors which edition they implement.

How do you check a vendor’s cmi5 support?

Ask for evidence, not a checkbox. Check the project’s adoption list, ask whether the product has run the ADL conformance tools, and test a real package end to end. The adoption list is undated and the working group has not tested the products on it, so a listing is a starting point rather than proof of conformance.

The cmi5 adoption page lists authoring tools and LMS products and says the working group has not tested or certified them. For testing, ADL’s cmi5 CATAPULT project provides an open-source cmi5 player and a conformance test suite for content and software systems.

Put these questions to each vendor:

• Can you show a conformance test result for the edition you implement?
• Do you include an LRS, or connect to one, and can we export the raw statements?
• How do you handle abandoned sessions and waived AUs in reports?
• Can content be hosted outside your platform, and which launch modes do you support?

Pro tip: Send one bad statement. Set a masteryScore of 0.9 and send a passed statement with a scaled score of 0.85. Under sections 6.3 and 9.3.4, a conforming LMS should reject it, or void it if it was stored. A platform that accepts it silently will misreport results.

What should you do next?

List your online content by source: which authoring tool built it, which platform plays it, and which clients receive it. For each line, ask the tool and platform vendors the questions above. Keep a SCORM export for any client whose LMS you cannot verify.

If you run instructor-led programs and are comparing training platforms, see how SimpliTrain for professional training companies handles client portals and course delivery. Its pages describe SCORM and xAPI content support but do not mention cmi5, so ask any vendor, SimpliTrain included, before you plan around it.

Frequently asked questions

Is cmi5 replacing SCORM?

cmi5 was designed to do what SCORM does with xAPI as its data layer, but the specification does not mention SCORM at all. Whether it replaces SCORM for you depends on your authoring tools, your LMS and your clients. For now, most providers will want SCORM export available alongside cmi5.

Is cmi5 the same as xAPI?

No. xAPI is the general data format and transport for learning records. cmi5 is a profile on top of it that fixes the launch process, the nine verbs, their order and the completion rules. Content that sends valid xAPI is not automatically cmi5 content, but cmi5 content always sends xAPI.

Does cmi5 require a Learning Record Store?

Yes. The specification requires the LMS to implement an LRS, and it treats the LMS and LRS as one combined system. A platform can build the LRS in or connect to a separate one. Either way, the content writes its statements to the endpoint the LMS gives it at launch.

Does cmi5 track classroom attendance?

Not by itself. cmi5 covers content launched from an LMS, and a classroom session has no AU to launch. Attendance still belongs in your scheduling or training management system. The spec allows xAPI use outside its scope without affecting conformance, so you can record attendance separately.

Is cmi5 an official standard?

It is an open specification published on GitHub, and its repository lists Quartz, 1st Edition (June 1, 2016) as the current release as of November 2026. This post relies only on that published text. Check the repository for newer editions before you plan around a version.