How often must compliance training be repeated?

How often is compliance training required by law?

Not at all — at least not in general. German law contains no provision that prescribes an interval for compliance training. The relevant provisions either name occasions instead of periods or expressly leave the timing to the company. For the anti-money laundering area, BaFin writes in its Interpretation and Application Guidance (as of July 2025, chapter 3.6) that obliged entities can "decide independently, on a risk-oriented basis, on the types of training used, their design and scope, and the timing of their implementation". For the anti-money laundering area, the cycle is therefore a matter of justification, not a calendar entry: it must fit the risk and take into account the occasions named by the supervisory authority. For the other mandatory topics, the same mechanism applies, albeit without an explicit supervisory requirement.

This applies to the umbrella term compliance. Individual mandatory topics that are part of almost every program do carry a fixed period. The period that shapes the widespread annual rhythm comes from occupational health and safety law; in addition, individual special regimes prescribe their own intervals, for example Section 43 (4) IfSG prescribes instruction for activities in the food sector "after taking up their activity and thereafter every two years". None of these periods comes from compliance law itself.

The one-year period comes from occupational health and safety

In occupational health and safety, "annual" is a given, but not because of the Occupational Health and Safety Act (ArbSchG). Section 12 (1) ArbSchG requires instruction upon hiring, upon changes in the area of responsibility, and upon the introduction of new work equipment or technologies, in each case before the activity begins, and stipulates that it be repeated regularly "if necessary" — it does not give a number. The one-year period is set out in the accident prevention regulation: Section 4 (1) DGUV Regulation 1 requires repetition "but at least once a year" and its documentation.

One detail determines how robust this period is: DGUV Regulation 1 is a model regulation. It only becomes binding once the competent accident insurance institution issues it — the version of the Unfallkasse Nordrhein-Westfalen linked here entered into force on October 1, 2014. In practice, this means: where a topic is handled as instruction under occupational health and safety law, for example fire safety instruction, the annual rhythm is the minimum. Where a topic only appears in the compliance program, it does not automatically apply as well.

Topics without an interval: money laundering, data protection, AGG, AI

Four central mandatory topics have no period at all. Section 6 (2) no. 6 of the German Money Laundering Act (GwG) requires the "initial and ongoing training" of employees without specifying an interval; how often GwG training takes place follows from the obliged entity's risk analysis. Art. 39 (1) lit. b GDPR counts the "awareness-raising and training of staff involved in processing operations" among what the data protection officer covers as part of their monitoring task — here, too, without a cycle, which is why the interval for data protection training cannot be derived from the statutory text.

Section 12 (2) of the General Act on Equal Treatment (AGG) frames the notice that discrimination is impermissible as a should provision and provides that training carried out in a suitable manner for the purpose of preventing discrimination is deemed to fulfill the obligations under subsection 1. And Art. 4 of the EU AI Act, which addresses AI literacy, has applied since February 2, 2025; its current version goes back to the Digital Omnibus Regulation (EU) 2026/1744 of July 24, 2026. Since this revision, providers and deployers take measures "to support the development of AI literacy of their staff …"; they are expressly not required to guarantee a specific level of competence for individual persons. Official enforcement has applied since August 2, 2026. Art. 4 does not specify a repetition interval in any of its versions; the European Commission provides interpretive material and a collection of practical examples on this.

At a glance: which mandatory topic has a fixed period?

The five topics that appear in almost every program, compared directly:

• Occupational safety instruction: fixed period, yes — at least once a year under Section 4 (1) DGUV Regulation 1, as a minimum.
• Money laundering prevention: fixed period, no — Section 6 (2) no. 6 GwG requires initial and ongoing training; the interval is determined by the risk analysis.
• Data protection: fixed period, no — Art. 39 (1) lit. b GDPR counts awareness-raising and training among the data protection officer's monitoring tasks, without a cycle.
• AGG prevention: fixed period, no — Section 12 (2) AGG is a should provision; training carried out in a suitable manner is deemed to fulfill the prevention obligation under subsection 1.
• AI literacy: fixed period, no — Art. 4 EU AI Act does not specify a repetition interval.

What the cycle is derived from instead

When the law is silent, the risk analysis decides. The yardstick is provided by the frameworks for compliance management: IDW Auditing Standard 980 in its revised version, adopted by the Main Technical Committee on September 28, 2022, and published in December 2022, and the standard DIN ISO 37301 (edition 2021-11, amended by A1:2024-10) describe compliance as a system of risks, objectives, program, and monitoring. Training frequency is part of this program and follows the risk. This is linked to the law through Section 130 OWiG: anyone who, as the owner of a business or company, fails to take the necessary supervisory measures commits a regulatory offense if a violation is committed that proper supervision would have prevented or made significantly more difficult. The necessary supervisory measures expressly include the appointment, careful selection, and monitoring of supervisory personnel.

Three factors determine the cycle in practice: the probability of occurrence and the extent of damage of a rule violation, the exposure of the role — purchasing, sales, or customer acceptance are in a different position than production — and how dynamically the area of law changes. Anyone who plans mandatory training across several areas of law therefore does better to combine it in a matrix of topic, target group, and occasion than in a uniform annual rhythm for everyone.

An example makes the difference tangible: in the production area of an industrial company, the annual occupational safety instruction remains the pacesetter, while the same workforce practically never comes into contact with public procurement law. In the purchasing department of the same company, it is the other way around — there, the highest risk lies in corruption prevention and supplier selection, and an interval of several years may be too long for that. A matrix forces this distinction; a blanket annual rhythm for everyone conceals it and ties up capacity where there is little risk.

Occasions that trigger training regardless of the cycle

Four triggers apply regardless of when training last took place. For occupational health and safety, Section 12 (1) ArbSchG names hiring, changes in the area of responsibility, and the introduction of new work equipment or technologies. For the anti-money laundering area, BaFin sets out the same logic and lists new statutory regulations, significant changes in administrative practice, findings on new methods of committing offenses, new employees joining, and the frequency of incidents or increased error rates.

Generalized, this results in four occasions:

• New employees: training before they start work, not at the next scheduled date in the cycle.
• Change of role: anyone who moves into a more exposed function needs its topics, even if the last training was only a short time ago.
• Change in the law: new regulations or a changed administrative practice are a trigger regardless of the calendar.
• Incident: a rule violation, an increased error rate, or a near miss is an occasion in its own right.

They are the reason why a purely calendar-based cycle is not sufficient — a change in the law in March does not wait for the annual training in November.

What companies actually do

No official statistics on the frequency of compliance training have been published for Germany; only related surveys are reliable. The digital association Bitkom asked 1,002 companies about IT security training in a 2023 survey: of those that provide training, 24% do so at least once a year, 37% regularly but less often than once a year, 70% as needed, and 23% when employees join the company; 15% do not provide training at all. The figures expressly concern IT security and cannot be applied to compliance as a whole.

The Federal Statistical Office shows for the reference year 2020 that 77% of companies with ten or more employees provided professional development and that 37% of participation hours were accounted for by "health and occupational safety", compared with 20% in 2015. The IW professional development survey of the German Economic Institute reports, for the reference year 2022, a share of 93% of companies active in professional development, with an average of 20.3 hours and 1,347 euros per employee — figures on in-company professional development as a whole, limited neither to the topic area of health and occupational safety nor to compliance.

The pattern behind these surveys is the same: the annual rhythm is widespread, but it is a convention and not a standard that should be adopted without justification. Anyone who chooses it should be able to say why it is appropriate for this topic and this target group — and why something different applies to other groups.

Cycle, format, and evidence belong together

The cycle is not decided in isolation, but together with format and evidence. Short, recurring units can be scheduled more frequently than a full-day classroom format; where classroom attendance remains necessary for subject-matter reasons, blended learning combines both. What matters is that every run can be documented: Section 4 (1) DGUV Regulation 1 expressly requires the instruction to be documented, and in both the anti-money laundering and the data protection area, evidence is the basis of every supervisory inquiry. Anyone who rolls out the mandatory topics as ready-made courses and documents participation and completion in the system can also prove the chosen cycle if in doubt — for the typical topics of the private sector, Bridgly bundles them in compliance basics training courses.

How often does compliance training have to be repeated?

There is no general statutory interval. Occupational health and safety law sets a fixed period: Section 4 (1) DGUV Regulation 1 requires instruction at least once a year. Individual special regimes have their own intervals, for example Section 43 (4) IfSG every two years. For the other mandatory topics, the cycle is derived from the risk analysis.

Does the annual instruction also apply to data protection and money laundering?

Not automatically. The one-year period belongs to instruction under occupational health and safety law. Section 6 (2) no. 6 GwG requires initial and ongoing training without an interval; Art. 39 (1) lit. b GDPR counts awareness-raising and training among what the data protection officer covers as part of their monitoring task — likewise without a cycle. Many companies nevertheless choose an annual rhythm.

Which occasions trigger training outside the cycle?

Four occasions: new employees, a change of role, a change in the law, and a specific incident. For occupational health and safety, Section 12 (1) ArbSchG names hiring, changes in the area of responsibility, and new work equipment or technologies; for the anti-money laundering area, BaFin lists new statutory regulations, changes in administrative practice, new hires, and increased error rates. A change in the law does not wait for the next scheduled date in the cycle.

How can the chosen cycle be justified?

Through the risk analysis. The probability of occurrence and the extent of damage of a violation, the exposure of the respective role, and how dynamically the area of law changes determine the interval. The revised IDW PS 980 and DIN ISO 37301 describe this structure as a system of risks, objectives, program, and monitoring; Section 130 OWiG links to the failure to take the necessary supervisory measures.

• BaFin – Interpretation and Application Guidance on the German Money Laundering Act, chapter 3.6 (as of July 2025)
• DGUV Regulation 1 „Grundsätze der Prävention“ – Section 4 (1), version of the Unfallkasse Nordrhein-Westfalen (in force since 1 Oct 2014)
• Section 12 ArbSchG – Instruction (version of 22 Dec 2025)
• Section 6 GwG – Internal safeguards, subsection 2, number 6 (version of 29 Jun 2026)
• Art. 39 (1) lit. b GDPR – Tasks of the data protection officer (legal status: 3 Sep 2026, unofficial mirror)
• Section 12 (2) AGG – Measures and obligations of the employer (version of 14 Aug 2006)
• Section 130 OWiG – Violation of the duty of supervision (version of 22 Dec 2025)
• Section 43 (4) IfSG – Instruction for activities in the food sector (version of 20 Jul 2000)
• Art. 4 EU AI Act – AI literacy, version of Regulation (EU) 2026/1744 (legal status: 3 Sep 2026, unofficial mirror)
• European Commission – Navigating the AI Act, questions and answers (page as of 7 Aug 2026)
• IDW PS 980 (revised) – Audit of compliance management systems (as of Sep 2022)
• DIN ISO 37301:2021-11 – Compliance management systems (amended by A1:2024-10)
• Federal Statistical Office – Continuing vocational training in companies 2020 (CVTS 6) (of 17 Aug 2022, reference year 2020)
• Bitkom – IT security: 8 out of 10 companies train employees (of 12 Sep 2023, reference year 2023)
• Seyda, S. et al. – IW professional development survey 2023, IW-Trends 2/2024 (reference year 2022)
• Image license: AI-generated image (Bridgly), labeled "Created with AI" as an overlay; prompt in the field „Bild-Prompt (KI-Bild)“.

All sources accessed on 3 Sep 2026 unless otherwise stated in the entry. Legal texts carry their legal status in the entry; statistics carry their reference year.