Which mandatory training courses must companies carry out?

What mandatory training for companies is

Mandatory training is legally or regulatorily required instruction that companies must offer their employees. Which training specifically applies depends on industry, activity, and company size – not every obligation applies to every company. What these training courses have in common is that they are based on a clear legal basis and, as a rule, must be carried out on a recurring and verifiable basis. This overview classifies the most important topics for companies in Germany and refers to the respective specialist articles for details.

The purpose is comparable across all topics: employees should recognize risks, act in compliance with the rules, and respond correctly in an emergency. From the company's perspective, mandatory training is also a building block with which the employer fulfills its organizational and due diligence obligations – and can prove this to supervisory authorities, auditors, or insurers. If obligations are neglected, liability, supervisory, and reputational risks may arise depending on the area of law; the specific legal consequences depend on the respective provision and the individual case.

The most important mandatory training at a glance

The following topics are among the most common mandatory training topics in German companies. Each is based on its own legal basis, is aimed at a specific target group, and has its own cycle – sometimes laid down by law, sometimes only established in practice. Where the law does not set a fixed deadline, this is expressly marked below as common practice.

Occupational health and safety instruction

The most fundamental obligation affects almost every business with employees and serves to prevent work-related accidents and health hazards. Under Section 12 of the Occupational Health and Safety Act (ArbSchG), the employer must instruct its employees on safety and health protection at work – upon hiring, when their area of responsibility changes, and on a recurring basis thereafter. This duty to provide instruction is specified in more detail by DGUV Regulation 1 „Grundsätze der Prävention“.

It is important to keep the provisions clearly apart: Section 12 ArbSchG itself does not specify a fixed time interval. Only Section 4 DGUV Regulation 1 stipulates that the instruction must be repeated as required, but at least once a year, and documented. Content and occasion are also based on the risk assessment of the respective workplace.

Data protection (GDPR)

Wherever personal data is processed, raising employees' awareness is one of the organizational fundamentals – which means practically all companies are affected. The General Data Protection Regulation, in Art. 39 GDPR, expressly names the training and awareness-raising of employees as a task of the data protection officer; Art. 32 GDPR requires appropriate technical and organisational measures, which can include training. The GDPR does not specify a fixed statutory repetition interval – in practice, recurring, often annual awareness-raising has become established (common practice, not a statutory cycle). Details on interval and scope are covered in the article Data protection training: obligation and interval.

Fire safety

Companies must train a sufficient number of employees as fire wardens and instruct their workforce in the correct behavior in the event of a fire; the aim is to protect employees and to limit damage in the event of a fire. The basis is the Technical Rule for Workplaces ASR A2.2 in conjunction with the ArbSchG and DGUV Information 205-023. For refreshing fire warden training, DGUV Information 205-023 recommends an interval of three to five years; in practice, the general fire safety instruction of the workforce usually runs annually as part of the occupational health and safety instruction. How often fire safety instruction is intended is shown in the article Fire safety instruction: obligation and frequency.

Information security / IT security

The security awareness of the workforce ("Security Awareness") is gaining in importance because human error is a frequent starting point for attacks. For regulated entities, the NIS-2 implementation – in force in Germany since December 6, 2025 – provides for training and awareness-raising measures; in addition, Art. 32 GDPR requires organizational protective measures. A special feature is that Section 38 of the BSI Act (BSIG) personally obliges the management of affected entities to participate in information security training – this obligation cannot be delegated. Whether a company falls within the scope of NIS-2 at all depends on size and industry and is clarified in the article NIS-2: Which companies are affected.

Anti-money laundering

This obligation applies exclusively to the obliged entities under the German Money Laundering Act (GwG) – for example, parts of the financial sector, real estate agents, or certain traders in goods. For them, Section 6 (2) no. 6 GwG requires, as part of the internal safeguards, that employees be informed about typologies and current methods of money laundering and terrorist financing as well as about the relevant regulations and obligations. The GwG does not specify a fixed interval; employees must be informed regularly (common practice). For companies outside this group of obliged entities, there is no corresponding training obligation. How often training must be provided is covered in GwG training: obligation under Section 6 GwG.

AI literacy (EU AI Act)

A new addition is AI literacy: since February 2, 2025, Art. 4 of the EU AI Act (Regulation (EU) 2024/1689) has required providers and deployers of AI systems to ensure the AI literacy of their staff – even when merely using purchased AI tools. The Digital Omnibus Regulation (Regulation (EU) 2026/1744) has been in force since July 27, 2026, and has reworded Art. 4: since then, providers and deployers must take measures to support the development of their staff's AI literacy; they do not have to guarantee a specific level of competence (Art. 4 (1) EU AI Act as amended by Art. 1 no. 5 Regulation (EU) 2026/1744); the application date of February 2, 2025, remains unchanged. Art. 4 does not specify a fixed repetition interval; what matters are ongoing measures geared to the role, the systems used, and the risk situation. Classification and implementation are explained in Art. 4 AI literacy: the training obligation of the EU AI Act.

Anti-discrimination (AGG)

The General Act on Equal Treatment (AGG) aims to protect employees from discrimination. In Section 12 AGG, it expressly names training as a suitable measure: under Section 12 (2) AGG, training that has demonstrably been carried out in a suitable manner is deemed to fulfill the employer's protective obligations. The law does not specify a fixed interval; training is provided preventively and as occasion requires. In principle, all employers with employees are addressed.

Industry-specific additional obligations

Depending on the industry, further instruction is added – for example, the training of company first aiders under Section 26 DGUV Regulation 1, instruction for activities in the food sector under Section 43 IfSG, or hazardous goods instruction. This list is not exhaustive; what is decisive is always the specific activity and the relevant legal basis for it.

Mandatory training and its legal bases at a glance

The following table assigns the most common mandatory topics to their legal basis, the broadly affected target group, and the typical cycle. Where there is no statutory interval, the information is marked as practice or recommendation. The table does not replace an individual assessment but offers initial guidance.

Who has to provide which training?

Not all obligations apply to all companies. Occupational health and safety, data protection, and fire safety topics affect almost every business with employees. Anti-money laundering applies only to GwG obliged entities, the NIS-2 requirements only to regulated entities of a certain size and industry, and AI literacy wherever AI systems are used or offered. The first step is therefore always an inventory: which activities, data, and systems exist in the company – and which obligations follow from them?

A special feature concerns responsibility at the top: in several areas, management is also expressly obliged and must itself be trained. In information security, for example, Section 38 BSIG personally obliges the management level of affected entities to participate in training, and this cannot be delegated. Assigning obligations to roles is therefore a separate planning step and not just a question of the workforce as a whole. In practice, operational implementation is often delegated to specialist functions, such as the occupational safety specialist, the data protection officer, or the AML officer; overall responsibility, however, remains with the employer.

Cycle, proof, and documentation

How often training must be repeated, what proof is required, and what the consequences of a failure are differ considerably depending on the area of law. Some intervals are laid down by law or sub-statutory regulations – such as the at least annual occupational health and safety instruction under Section 4 DGUV Regulation 1 – while others only follow established practice. Many types of instruction must also be repeated as occasion requires, for example in the case of new activities, changed procedures, or after special incidents. For this reason, this overview deliberately does not name any flat-rate fines; legal consequences arise from the respective legal basis and depend on the individual case.

A common principle applies across the topics: training that is not documented is, in case of doubt, deemed not to have been carried out. As a rule, it should be traceable who completed which instruction with which content and when, and how understanding was ensured. The linked specialist articles set out the specific intervals and proof requirements for each topic.

How companies organize mandatory training

Because not every obligation applies to every company, implementation begins with an inventory rather than with the first course. A four-step approach has proven effective:

1. Determine which activities, data, systems, and industry obligations are relevant in the first place – for occupational health and safety and fire safety, the risk assessment under Sections 5 and 6 ArbSchG provides the basis.
2. Assign roles: who has to learn what, and who has separate obligations – for example, management in the area of information security?
3. Plan and carry out, including the necessary repetitions and the inclusion of new employees.
4. Document, so that in the event of an inspection or audit it can be proven who completed which instruction and when.

The last step in particular is often underestimated. A learning management system (LMS) takes a lot of organizational effort off your hands here by automatically assigning courses to the right roles, sending reminders about due dates, and generating traceable proof – ideally as early as the onboarding of new employees. This keeps assignment, repetition, and documentation manageable in one place across all mandatory topics.

Implementing mandatory training efficiently

The practical effort lies less in the individual course than in the organization: training the right people at the right time, keeping track of repetitions, and documenting everything in a verifiable way. A note on our own behalf: Bridgly provides ready-made, standardized mandatory training for the topics mentioned and rolls it out via the digital training platform – this way, the mandatory topics can be rolled out centrally and kept up to date, and participation can be documented without having to create the content yourself. You can find more articles on mandatory training and professional development in the topic hub HR & Learning.

Which mandatory training applies to almost every company?

Largely regardless of the industry, occupational health and safety instruction under Section 12 ArbSchG, data protection awareness-raising under the GDPR, and fire safety affect almost every company with employees. Other obligations, such as anti-money laundering under Section 6 GwG or information security under NIS-2, on the other hand, only apply to certain industries, activities, and company sizes.

Can mandatory training be carried out online?

In many areas, yes. Digital instruction is widespread, provided that the content, the check of understanding, and the proof meet the requirements of the respective legal basis. A learning management system helps to organize assignment, repetition, and documentation in a traceable way. Whether a particular training course is permissible online depends on the topic and the requirements of the competent body.

How often does mandatory training have to be repeated?

There is no blanket answer to this, because the intervals are set for each area of law. Many types of instruction are designed to recur and must also be repeated as occasion requires, for example in the case of new activities or changed procedures. The specific frequency results from the respective provision; the linked specialist articles state it for each topic.

Who in the company is responsible for mandatory training?

Overall responsibility lies in principle with the employer or management. In practice, implementation is often delegated to specialist functions, such as the occupational safety specialist, the data protection officer, or the AML officer. In some areas, such as information security under NIS-2, the management level itself must also be trained.

Does mandatory training have to be documented?

As a rule, yes. Across the topics, the principle applies that undocumented training is, in case of doubt, deemed not to have been carried out. The group of participants, time, content, and check of understanding should usually be traceable. A learning management system generates such proof automatically and keeps it ready for inspections or audits.

Does AI literacy under the EU AI Act count as mandatory training?

Yes. Since February 2, 2025, Art. 4 of the EU AI Act (Regulation (EU) 2024/1689) has obliged providers and deployers of AI systems to ensure the AI literacy of their staff. The Digital Omnibus Regulation (Regulation (EU) 2026/1744, in force since July 27, 2026) has reworded Art. 4: since then, measures to support the development of the staff's AI literacy have been required; a specific individual level of competence expressly does not have to be guaranteed.

• Section 12 ArbSchG – Instruction: gesetze-im-internet.de (as of 30 May 2026)
• Sections 5 and 6 ArbSchG – Risk assessment/documentation: gesetze-im-internet.de (as of 30 May 2026)
• Section 4 & Section 26 DGUV Regulation 1 „Grundsätze der Prävention“ (instruction at least annually; first aiders): publikationen.dguv.de (as of 30 May 2026)
• GDPR Art. 39 & Art. 32: eur-lex.europa.eu (as of 30 May 2026)
• ASR A2.2 „Maßnahmen gegen Brände“: baua.de (as of 30 May 2026)
• DGUV Information 205-023 (fire wardens; refresher every 3–5 years recommended): publikationen.dguv.de (as of 30 May 2026)
• Section 6 (2) no. 6 GwG – internal safeguards (informing employees): gesetze-im-internet.de (as of 30 May 2026)
• Art. 4 EU AI Act (Regulation (EU) 2024/1689) (applicable since 2 Feb 2025): eur-lex.europa.eu (as of 30 May 2026)
• Section 12 AGG – Measures and obligations of the employer: gesetze-im-internet.de (as of 30 May 2026)
• Section 43 IfSG – Instruction in the food sector: gesetze-im-internet.de (as of 30 May 2026)
• BSI – NIS-2 / Section 38 BSIG (training obligation of management; in force in Germany since 6 Dec 2025): bsi.bund.de (as of 30 May 2026)
• Regulation (EU) 2026/1744 („Digital Omnibus", OJ L of 24 Jul 2026, in force since 27 Jul 2026), Art. 1 no. 5 – rewording of Art. 4 EU AI Act: eur-lex.europa.eu (accessed 3 Sep 2026)
• Featured image: AI-generated; labeled "Created with AI" as an overlay in line with Art. 50 EU AI Act. License/creation record will be added during image production (provider/date).