Refresher intervals for mandatory training: an overview

Many companies circulate lists of refresher intervals in which it is no longer clear what is in the law and what is an internal decision or a recommendation. That leads to two mistakes: recommendations are treated as obligations and resources are wasted, or genuine obligations are undercut with “we do it every two years”.

The overview below lists only intervals explicitly stated in the respective rule and marks where no fixed interval exists. It is deliberately short and focuses on German and EU law; sectors and special activities have further rules.

The overview reflects the date of this article. The current wording of the rule is always decisive.

A missing interval is not an invitation to train once. Obligations such as GDPR accountability or ensuring sufficient AI literacy are ongoing. A company that trains only once can hardly show that knowledge is still sufficient after systems change, new people join or new risks emerge.

A fixed, justified rhythm has proven itself. For data protection and information security many companies choose annually; for slower-moving topics, every two years. What matters is the justification — the speed of change of the topic, the risks in the company, lessons from incidents — and consistent adherence.

Write the justification down, for example in a short training policy: which topic, which target group, which rhythm, why. During an audit, such a document shows that the rhythm is a deliberate decision, not chance. When circumstances change — new systems, more incidents, new law — the rhythm is reviewed and shortened if necessary.

In addition to regular repetition, some events call for — or, in health and safety under Section 12 ArbSchG, require — training again.

In a learning system, intervals are mapped as the validity of the certificate: a course valid for twelve months produces a certificate that expires after twelve months. So that repetition does not start only after expiry, the refresher should be assigned in good time beforehand.

Universe's People Development area does it this way: mandatory courses have a validity in months, and 30 days before expiry a new cycle starts automatically. The included templates set 12 months for data protection, information security and health and safety, and 24 months for AI literacy and equal treatment. These values are suggestions: for young workers, for instance, the safety briefing must be repeated every six months, and for data protection or AI literacy each company sets its own rhythm.