Mandatory training means instruction prescribed by law or regulation that companies must provide to their employees. Which obligations apply in practice depends on sector, activity and company size – not every obligation affects every company. What they have in common is that they rest on a clear legal basis and as a rule must be carried out on a recurring basis and in a verifiable way. This overview classifies the most important topics for companies in Germany and refers to the individual articles for details.
The purpose is comparable across all topics: employees should recognise risks, act in conformity with the rules and respond correctly in an emergency. From the company’s perspective, mandatory training is at the same time a building block with which the employer fulfils its organisational duties and duties of care – and can demonstrate this to supervisory authorities, auditors or insurers. If obligations are neglected, liability, supervisory and reputational risks may arise depending on the area of law; the specific legal consequences depend on the respective provision and the individual case.
The following topics are among the most common mandatory training in German companies. Each rests on its own legal basis, addresses a specific target group and has its own cycle – sometimes fixed by law, sometimes merely established in practice. Where the law contains no fixed interval, this is expressly marked below as common practice.
The most fundamental obligation affects almost every establishment with employees and serves to prevent work-related accidents and health hazards. Under Section 12 of the Occupational Safety and Health Act (ArbSchG) (in German), the employer must instruct its employees on safety and health protection at work – on recruitment, when their area of responsibility changes and thereafter on a recurring basis. This instruction obligation (Unterweisung) is specified further by DGUV Vorschrift 1 (in German) „Grundsätze der Prävention“ (principles of prevention).
A clean separation of the provisions matters here: Section 12 ArbSchG itself does not specify a fixed time interval. It is only § 4 DGUV Vorschrift 1 (in German) that stipulates that the instruction must be repeated as required, but at least once a year, and documented. Content and occasion are additionally determined by the risk assessment (Gefährdungsbeurteilung) for the respective workplace.
Wherever personal data is processed, raising employees’ awareness is one of the organisational fundamentals – which means practically all companies are affected. The General Data Protection Regulation (GDPR) expressly names the training and awareness-raising of staff in Art. 39 GDPR (in German) as a task of the data protection officer; Art. 32 GDPR requires appropriate technical and organisational measures, which can include training. The GDPR does not prescribe a fixed statutory repetition interval – in practice, recurring, frequently annual awareness training has become established (common practice, no interval fixed by law). Interval and scope are covered in detail in the article Data protection training: obligation and interval.
Companies must train a sufficient number of employees as fire protection assistants (Brandschutzhelfer) and instruct their workforce in correct behaviour in the event of fire; the aim is to protect employees and limit damage in the event of fire. The basis is the Technical Rule for Workplaces ASR A2.2 (in German) in conjunction with the ArbSchG, as well as DGUV Information 205-023 (in German). For refreshing the fire protection assistant training, DGUV Information 205-023 recommends an interval of three to five years; the general fire protection instruction for the workforce usually runs annually in practice as part of the occupational safety instruction. How often fire protection instruction is intended is shown in the article Fire protection instruction: obligation and frequency.
The security awareness of the workforce is gaining importance because human error is a frequent starting point for attacks. For regulated entities, the NIS 2 implementation (in German) – in force in Germany since 6 December 2025 – provides for training and awareness-raising measures; in addition, Art. 32 GDPR requires organisational protective measures. A particular feature is that § 38 of the German BSI Act (BSIG) personally obliges the management of affected entities to take part in information security training – this obligation cannot be delegated. Whether a company falls within the scope of NIS 2 at all depends on size and sector and is clarified in the article NIS 2: which companies are affected.
This obligation applies exclusively to obliged entities under the Anti-Money Laundering Act (GwG) – for instance parts of the financial sector, estate agents or certain dealers in goods. For them, § 6 Abs. 2 Nr. 6 GwG (in German) prescribes, as part of the internal safeguards, that employees be informed about typologies and current methods of money laundering and terrorist financing as well as about the relevant provisions and obligations. The GwG does not specify a fixed interval; the training is to be carried out regularly (common practice). Companies outside this circle of obliged entities are under no corresponding training obligation. How often training is required is covered in GwG training: the obligation under § 6 GwG.
A new addition is AI literacy: since 2 February 2025, Art. 4 of the Artificial Intelligence Act (AI Act), Regulation (EU) 2024/1689 (in German), has required providers and deployers of AI systems to provide for the AI literacy of their staff – including where purchased AI tools are merely used. The Digital Omnibus Regulation (Regulation (EU) 2026/1744) has been in force since 27 July 2026 and has recast Art. 4: providers and deployers must now take measures to support the development of AI literacy among their staff; they are not required to guarantee any specific level of AI literacy (Art. 4(1) AI Act as amended by Article 1(5) of Regulation (EU) 2026/1744); the date of application, 2 February 2025, is unchanged. Art. 4 does not specify a fixed repetition interval; what matters are continuous measures geared to role, systems used and risk situation. Classification and implementation are explained in Art. 4 AI literacy: the training obligation under the EU AI Act.
The General Act on Equal Treatment (AGG) aims to protect employees from discrimination. In § 12 AGG (in German) it expressly names training as a suitable measure: under § 12 Abs. 2 AGG, training that is demonstrably carried out in an appropriate manner is deemed to fulfil the employer’s duties of protection. The Act does not prescribe a fixed interval; training is provided preventively and as the occasion arises. In principle, all employers with employees are addressed.
Depending on the sector, further instruction is added – for example the training of company first aiders under § 26 DGUV Vorschrift 1 (in German), briefings for work in the food sector under § 43 of the Protection against Infection Act (IfSG) (in German), or dangerous goods instruction. This list is not exhaustive; what is always decisive is the specific activity and the legal basis relevant to it.
The following table assigns the most common mandatory topics to their legal basis, the roughly affected target group and the typical cycle. Where there is no statutory interval, the entry is marked as practice or recommendation. The table does not replace a review of the individual case but offers initial orientation.
| Topic | Legal basis | Who is typically affected | Typical frequency |
|---|---|---|---|
| Occupational safety instruction | § 12 ArbSchG, § 4 DGUV Vorschrift 1 | almost all companies with employees | at least annually (§ 4 DGUV Vorschrift 1) |
| Data protection | Art. 39, Art. 32 GDPR | all who process personal data | no fixed interval; regularly (practice) |
| Fire protection | ASR A2.2, DGUV Information 205-023 | companies with their own workplaces | instruction usually annually; assistant refresher every 3–5 years (recommendation) |
| Information security | NIS 2 implementation / § 38 BSIG, Art. 32 GDPR | regulated entities of certain sizes and sectors | regularly; management personally (§ 38 BSIG) |
| Anti-money laundering | § 6 Abs. 2 Nr. 6 GwG | obliged entities under the GwG only | no fixed interval; regularly (practice) |
| AI literacy | Art. 4 AI Act, Regulation (EU) 2024/1689 | providers and deployers of AI systems | continuously; no fixed interval |
| Anti-discrimination | § 12 AGG | employers in general | as the occasion arises; no fixed interval |
| First aider training | § 26 DGUV Vorschrift 1 | companies with employees | initial and recurring refresher training |
| Food hygiene | § 43 IfSG | employees in the food sector | initial and recurring follow-up briefing |
Not all obligations affect all companies. Occupational safety, data protection and fire protection topics concern almost every establishment with employees. Anti-money laundering applies only to obliged entities under the GwG, the NIS 2 requirements only to regulated entities above a certain size and in certain sectors, and AI literacy wherever AI systems are used or offered. The first step is therefore always a stocktake: which activities, data and systems exist in the company – and which obligations follow from them?
One particular feature concerns responsibility at the top: in several areas the management is expressly also under obligation and must itself be trained. In information security, for example, § 38 BSIG obliges the management level of affected entities personally and non-delegably to take part in training. Assigning obligations to roles is thus a planning step in its own right and not merely a question of the workforce as a whole. In practice, operational implementation is frequently delegated to specialist functions, such as the occupational safety specialist (Fachkraft für Arbeitssicherheit), the data protection officer or the anti-money laundering officer (Geldwäschebeauftragter); overall responsibility, however, remains with the employer.
How often training must be repeated, which evidence is required and what the consequences of an omission are differ considerably by area of law. Some intervals are fixed by statute or by subordinate rules – for instance the at least annual occupational safety instruction under § 4 DGUV Vorschrift 1 –, others merely follow established practice. Many instructions must also be repeated as the occasion arises, for example for new activities, changed procedures or after particular incidents. For this reason, this overview deliberately does not cite blanket administrative fines; legal consequences follow from the respective legal basis and depend on the individual case.
Across all topics, one common principle applies: training that is not documented is, in case of doubt, deemed not to have taken place. As a rule it should be traceable who completed which instruction, when, with which content, and how understanding was ensured. The linked articles set out the specific intervals and evidence requirements for each topic.
Because not every obligation affects every company, implementation starts with a stocktake rather than with the first course. A four-step approach has proved effective:
The last step in particular is often underestimated. A learning management system (LMS) takes much of the organisational effort off your hands by automatically assigning courses to the right roles, reminding of due dates and producing traceable evidence – ideally already during the onboarding of new employees. Assignment, repetition and documentation thus remain controllable in one place across all mandatory topics.
The practical effort lies less in the individual course than in the organisation: training the right people at the right time, keeping track of repetitions and documenting everything verifiably. A note on our own behalf: Bridgly provides ready-made, standardised mandatory training for the topics mentioned and rolls it out via the learning platform – so the mandatory topics can be rolled out centrally, kept up to date and participation documented, without having to create the content yourself. Further articles on mandatory training and professional development can be found in the HR & Learning topic hub.
Largely irrespective of sector, occupational safety instruction under § 12 ArbSchG, data protection awareness under the GDPR and fire protection affect almost every company with employees. Other obligations such as anti-money laundering under § 6 GwG or information security under NIS 2, by contrast, apply only to certain sectors, activities and company sizes.
In many areas, yes. Digital instruction is widespread, provided that content, verification of understanding and evidence meet the requirements of the respective legal basis. A learning management system helps to organise assignment, repetition and documentation traceably. Whether a particular training course may be delivered online depends on the topic and the requirements of the competent body.
There is no blanket answer, because the intervals are set for each area of law. Many instructions are recurring by design and must additionally be repeated as the occasion arises, for example for new activities or changed procedures. The specific frequency follows from the respective provision; the linked articles state it for each topic.
Overall responsibility lies in principle with the employer or the management. In practice, implementation is frequently delegated to specialist functions, such as the occupational safety specialist, the data protection officer or the anti-money laundering officer. In some areas, such as information security under NIS 2, the management level itself must additionally be trained.
As a rule, yes. Across all topics the principle applies that undocumented training is, in case of doubt, deemed not to have taken place. Participants, time, content and verification of understanding should usually be traceable. A learning management system produces such evidence automatically and keeps it ready for inspections or audits.
Yes. Since 2 February 2025, Art. 4 of the AI Act, Regulation (EU) 2024/1689, has obliged providers and deployers of AI systems to provide for the AI literacy of their staff. The Digital Omnibus Regulation (Regulation (EU) 2026/1744, in force since 27 July 2026) has recast Art. 4: what is now required are measures to support the development of AI literacy among staff; providers and deployers are expressly not required to guarantee any specific individual level of AI literacy.
Insights into the future of digital learning, with a focus on AI, compliance, and modern training solutions. Discover the latest posts and articles to gain practical insights into legally compliant, efficient, and automated corporate training.
Bridgly is the European training partner for audit-proof, tailored, and automated training and professional development.
We support the IHK initiative "Pack ma's digital" to help businesses in Upper Bavaria with digitalisation and secure the future of the region.Note: Some text, images, and videos on this website were generated using artificial intelligence.
All content is for informational purposes and has been carefully reviewed from a journalistic perspective, but does not claim to be exhaustive or legally binding.
