Procurement and Purchasing Compliance

FAQ

Frequently Asked Questions

Here you will find the most important answers.

Which mandatory training courses do public authorities and public administration bodies have to provide?

Federal, state, and local authorities as well as other public institutions are subject to largely the same training obligations as the private sector — with authority-specific additions. The general obligations include occupational health and safety under Section 12 of the Occupational Health and Safety Act (ArbSchG), fire protection under the Technical Rules for Workplaces (ASR A2.2), data protection under the GDPR and the state data protection acts, equal treatment under Section 12 of the General Act on Equal Treatment (AGG), and the information obligations under the Act for the Better Protection of Whistleblowers (HinSchG). In addition, there are topics that carry particular weight in a sovereign context: information security based on BSI Grundschutz, corruption prevention, handling classified information, and — for authorities that use AI systems — promoting AI literacy under Article 4 of the EU AI Act.

Does the AI literacy obligation under the EU AI Act also apply to public authorities?

Yes. Article 4 of the EU AI Act places obligations on providers and deployers of AI systems regardless of whether they are organized privately or publicly. As soon as an authority uses AI tools, the provision applies. What is required are measures that support the development of staff AI literacy. In the version applicable since July 27, 2026, the Regulation expressly clarifies that a specific level of competence does not have to be guaranteed. This carries particular weight in the public sector: here, sensitive data of citizens is processed, and decisions with sovereign effect are made that must meet requirements of transparency and equal treatment.

How do public authorities prove to supervisory bodies that mandatory training has been completed?

Through audit-ready documentation of every single participation. This requires three components: an unambiguous proof of participation with a timestamp, a learning assessment — usually a knowledge test — and storage with a complete audit trail. With digital training, this data is generated automatically and can be exported for audits, for example by courts of audit, data protection supervisory authorities, staff councils, or internal audit. The proof includes name, date, result, and completion. Deadline management and automatic reminders complement this: they prevent training from becoming overdue — the most common reason for objections in practice.

How do compliance training courses in public authorities differ from those in companies?

The legal bases are similar; the working context is not. Employees in public authorities work in an environment of citizen contact, sovereign acts, records management, and special confidentiality obligations. This has an impact on the content: data protection covers citizens' requests for information and the transfer of data between authorities; compliance topics cover corruption prevention in sovereign acts instead of antitrust or sales issues. In addition, there are separate legal bases — the state data protection acts, the BSI Act (BSIG), and the canon of duties under civil service law. A training course that focuses only on federal law and the private sector leaves out this level.

Which data protection requirements apply specifically to public administration?

In addition to the GDPR, the state data protection acts apply, which lay down separate rules for the public sector — for example on processing in the performance of sovereign tasks and on transfers between authorities. There is a key difference when it comes to sanctions: whether and to what extent fines can be imposed on authorities is governed by Section 43 (3) of the Federal Data Protection Act (BDSG) and the corresponding state regulations; several states exclude or limit fines against public bodies. Other consequences take the place of fines: objections by the data protection supervisory authority, supervisory orders, claims for damages by data subjects under Article 82 GDPR, consequences under public service law, and findings by courts of audit.

Are Bridgly's online training courses suitable for public authorities and municipalities?

Yes. The platform is operated in compliance with data protection law on servers in Germany and can be integrated into existing learning environments as a SCORM package — for example into a state's learning portal — or operated with your own branding. In terms of content, the catalog covers not only the general mandatory topics but also administration-specific areas: citizen contact and complaint management, public procurement and purchasing compliance, collaboration with external parties and volunteers, and information security. The Public Administration area comprises six training courses as a supplement to the general mandatory topics. The content is available in more than 30 languages, which can be relevant for communication with citizens in multilingual municipalities.

Contact

Train your employees in a legally compliant and verifiable way

Training and professional development for companies and public-sector clients – with audit-proof documentation and a practical focus.

Get in touch now

Bridgly learning platform

Frequently Asked Questions

Train your employees in a legally compliant and verifiable way