Mandatory training
Health and safety, data protection, information security, AI literacy, equal treatment: companies must brief or train their employees on a growing number of topics — and, if it comes to it, prove who learned what and when.
The articles in this section explain which obligations exist and where they come from, which refresher intervals are actually written in law, how briefings work digitally, and what makes a training record audit-proof.
All legal statements refer to official sources, with a focus on German and EU law. They do not replace legal advice: which obligations apply to a particular company depends on industry, activity and size and should be checked case by case.
Mandatory training at work: overview and organisation
Mandatory training covers the briefings and courses a company must provide because of laws, accident prevention regulations or contracts — on health and safety, data protection or AI literacy, for instance. Which of them apply depends on activity, industry and size. Organisationally, three things matter: assigning the right people in time, repeating on schedule and recording every completion verifiably.
ReadDelivering health and safety briefings digitally
Under Section 12 of the German Occupational Safety and Health Act, employers must brief employees sufficiently and appropriately on health and safety, on hiring and on changes before the work starts; DGUV Regulation 1 requires repetition at least once a year and documentation. Digital briefings are possible if they are workplace-specific, understanding is checked and questions can be answered at any time. For certain hazards, an on-site briefing remains indispensable.
ReadOrganising data protection training for employees
The GDPR does not set a general training duty for all employees, but it requires companies to demonstrate compliance and to ensure that staff process data only on instruction. Data protection training is the usual way to do this. It is well organised when each role gets the content relevant to it, training is repeated regularly, and participation and results are recorded verifiably.
ReadPhishing and information security training for staff
Information security training teaches employees how to recognise phishing, social engineering and other attacks and what to do if they suspect one. Short, regular units with realistic examples and a culture in which reporting is rewarded rather than punished work best. Whether there is a legal duty depends on the NIS2 transposition, contracts and standards, among other things; it makes sense in every company.
ReadAudit-proof training records: what an auditor wants to see
An audit-proof training record shows unambiguously who completed which course in which version, when, with which result and until when it is valid. It is protected against later changes and traceable for an auditor, ideally digitally signed and verifiable. Just as important is a report that shows the completion status of an entire workforce at a glance.
ReadRefresher intervals for mandatory training: an overview
Fixed refresher intervals are rarer than many assume: DGUV Regulation 1 requires health and safety briefings at least once a year, the Youth Employment Protection Act at least every six months for young workers, the Hazardous Substances Ordinance at least annually. For data protection, AI literacy or protection against discrimination there is no fixed interval; the company sets a justified rhythm itself. On top of that, almost everywhere: train again when things change.
ReadCompliance training: topics, structure and effectiveness
Compliance training teaches employees the rules that apply to their company — from anti-corruption and competition law through data protection and information security to equal treatment and whistleblower protection. It is effective when built on a risk basis: people who deal with public officials, competitors or sensitive data are trained more deeply than others. The aim is the right behaviour in a grey area, not just a certificate.
Read