Regulation and mandatory training
Many laws require people to know what they are doing: the AI Act demands AI literacy, NIS2 and DORA require training up to board level, and Germany's Money Laundering Act requires ongoing information of employees. The law rarely says exactly how to train — which makes knowing the wording all the more important.
The articles in this section explain each duty from the legal text: who is obliged, what is required, since when it applies and how compliance can be evidenced. Every legal statement links to the official source so you can read it yourself.
All articles are general information and not legal advice. The law changes; the current official text is decisive.
EU AI Act: what companies need to know now
The EU AI Act (Regulation (EU) 2024/1689) entered into force on 1 August 2024 and applies in stages: prohibitions and the AI literacy duty since 2 February 2025, obligations for general-purpose AI models since 2 August 2025, and most remaining rules from 2 August 2026. Which obligations a company has depends on its role (provider or deployer) and on the risk tier of the AI system.
ReadAI literacy under Article 4 AI Act: duty and practice
Since 2 February 2025, providers and deployers of AI systems must take measures under Article 4 of the AI Act to ensure, to their best extent, a sufficient level of AI literacy among their staff and other persons operating or using AI systems on their behalf. The regulation prescribes no particular certificate or course format; the required level depends on prior knowledge, role and the context of use.
ReadEvidencing AI literacy: documentation that holds up
AI literacy is evidenced with documentation showing which people in which role were trained when, on what content, and how learning was checked. The AI Act prescribes no format; convincing evidence combines a reasoned training plan, participation and assessment records, and a justified link between content and the AI systems in use.
ReadArticle 50 AI Act: labelling AI avatars and synthetic content
Article 50 of the AI Act requires that people are told when they interact with an AI system, that synthetic audio, image, video and text content is marked in a machine-readable way as AI-generated, and that deep fakes are disclosed. Under Article 113 the duties apply from 2 August 2026 and fall partly on providers and partly on deployers.
ReadGDPR data protection training: duty, content, frequency
The GDPR has no single article titled training duty, but it requires appropriate technical and organisational measures (Articles 24 and 32) and that staff process data only on instructions (Article 32(4)). The data protection officer's tasks expressly include awareness-raising and training of staff (Article 39(1)(b)). Documented data protection training is therefore the usual way to meet the accountability duty under Article 5(2).
ReadNIS2: mandatory training for management bodies
Under Article 20(2) of the NIS2 Directive (EU) 2022/2555, members of the management bodies of essential and important entities are required to follow cybersecurity training, and entities are encouraged to offer similar training to all employees on a regular basis. In Germany, section 38(3) of the BSI Act implements this: the management of particularly important and important entities must regularly attend training.
ReadDORA: training requirements in the financial sector
DORA, Regulation (EU) 2022/2554 on digital operational resilience for the financial sector, has applied since 17 January 2025. It requires members of the management body to keep their knowledge of ICT risk up to date, including through regular specific training (Article 5(4)), and financial entities to run ICT security awareness programmes and digital operational resilience training as compulsory modules for all employees and senior management (Article 13(6)).
ReadGerman Whistleblower Protection Act: who to train, and how
Germany's Whistleblower Protection Act (HinSchG) requires employers with, as a rule, at least 50 employees to set up an internal reporting office (section 12) and requires the people working there to have the necessary expertise (section 15(2)). It contains no express training duty for all staff; but for reporting channels to be used and retaliation avoided, informing and training staff and managers is practically indispensable.
ReadAML training under section 6 GwG: what is required
Obliged entities under the German Money Laundering Act (GwG) must, as an internal safeguard, inform their employees initially and on an ongoing basis about typologies and current methods of money laundering and terrorist financing and about the relevant rules and duties, including data protection (section 6(2) no. 6 GwG). Form and scope follow the risk of the business; the training should be documented.
ReadGerman Accessibility Act (BFSG): what applies to e-learning?
Germany's Accessibility Strengthening Act (BFSG) has applied since 28 June 2025 to certain products and services offered to consumers, including e-commerce services. An online course that consumers book via a website or app may fall within it; internal training for employees usually does not. Public bodies such as state universities are subject to separate rules on digital accessibility.
ReadData protection for learning platforms: DPA and transfers
An organisation using a provider's learning platform is usually the controller and the provider a processor, which requires a contract under Article 28 GDPR with the minimum content listed there. If data are transferred to countries outside the EEA, including by sub-processors, Articles 44 ff. GDPR apply as well. Learning and assessment data are sensitive enough that purpose, access and retention should be defined up front.
ReadWorks councils and learning platforms: co-determination
A learning platform is usually a technical system objectively capable of monitoring employees' conduct or performance; its introduction and use are then subject to co-determination under section 87(1) no. 6 of the German Works Constitution Act (BetrVG). On top come participation rights in vocational training, in particular co-determination over how in-house training is carried out under section 98 BetrVG. A works agreement before launch is therefore standard practice.
Read