Mandatory training at work: overview and organisation

Mandatory training refers to all briefings and courses a company is obliged to provide. The obligation can come from a statute (such as the German Occupational Safety and Health Act), from an ordinance (such as the Hazardous Substances Ordinance), from an accident prevention regulation of the statutory accident insurance, from EU law (such as the GDPR or the AI Act), or from contracts and standards the company wants to meet.

The term is not defined by law. In practice it also includes training that is not explicitly prescribed but follows from a general obligation — data protection training, for example, without which a company can hardly show that it meets its GDPR obligations.

The overview below lists common topics and their basis under German and EU law. It is not exhaustive; sectors such as healthcare, finance, food or energy have many further obligations.

Only a few rules name a fixed interval. DGUV Regulation 1 requires health and safety briefings to be repeated as necessary, but at least once a year; the Youth Employment Protection Act requires at least every six months for young workers. Other rules say “regularly” or “at appropriate intervals” without a period.

Where no interval is given, a fixed rhythm that the company sets and justifies itself works well — for example annually or every two years, plus event-driven training for new risks, new systems or incidents. A fixed rhythm makes organisation easier and shows an auditor that the topic is taken seriously.

Many companies still organise mandatory training with spreadsheets, circulating folders and signature lists. That works while the company is small and one person keeps track. With several sites, shift work or frequent joiners and leavers it becomes error-prone: new hires are forgotten, deadlines pass, records sit in different folders.

Digital organisation solves this with a few core functions: create courses with a target group and validity, assign them automatically to new employees in the target group, reassign them in good time before expiry, send reminders, record completion with a certificate, and produce a report at the push of a button showing who completed what and when.

Mandatory training is part of the job. For health and safety, Section 12 ArbSchG explicitly states that the briefing takes place during working time. More generally, under Section 111 of the German Trade Regulation Act: if an employer is obliged by law or collective agreement to provide training, it may not charge the costs to employees, and the training should generally take place during working hours. This overview is not legal advice.

In practice this means learning time for mandatory training must be planned. Short, well-made units respect that time — and get more attention than long compulsory videos.

Universe's People Development area runs mandatory training as learning paths of the type “Mandatory training”, with validity in months and the legal basis recorded. Templates are included for data protection, information security and health and safety (each valid for 12 months) as well as AI literacy and equal treatment (each 24 months) — the template intervals and legal bases are suggestions and should be checked for your own organisation.

On completion a signed training certificate with an expiry date is issued. Thirty days before expiry a new cycle starts automatically. A daily job sends reminders one week before the deadline and weekly afterwards, and also notifies the manager when overdue. The mandatory training table shows completion status per employee; the audit report as CSV contains every cycle with its certificate code and the reminders sent.