Proving mandatory training: what belongs in the documentation

Why proof is often more important than the training itself

Mandatory training that has been carried out but not documented is of little help vis-à-vis a supervisory authority. The reason is unspectacular: anyone who cannot prove that it was carried out has, in case of doubt, no evidence — and in some areas of law they additionally bear an express obligation to provide proof.

Three figures from 2025 show how many cases a year can trigger a need for proof. The German Social Accident Insurance (DGUV) registered 730,598 reportable occupational accidents, around 24,000 fewer than in the previous year (provisional figures, published on March 26, 2026). The Federal Commissioner for Data Protection and Freedom of Information (BfDI) recorded 11,824 submissions, 36 percent more than in the previous year (34th Activity Report, published on May 6, 2026). And the Financial Intelligence Unit reported 374,693 suspicious activity reports, around 41 percent more than in 2024 (Annual Report 2025, published on July 21, 2026). Each of these figures stands for cases in which someone asks: What did you do, and how can we see that?

This article answers only the question of proof. Which training a company needs in the first place is explained in the overview of mandatory training for companies.

What belongs in a training record

There is no standard that conclusively prescribes the content of a training record. However, a core that holds up in all constellations can be derived from the proof and accountability obligations of the individual areas of law:

1. Who was trained — by name, not just "the department".
2. When — date, and for workplace-related instruction also the link to the event (hiring, new work equipment, change in the area of responsibility).
3. What — topic and scope, ideally with a reference to the materials used or the course version.
4. Who gave the instruction — person or responsible body.
5. How it was checked — whether and how understanding was checked, where the area of law or the internal requirement calls for it.

Points one to four are consensus across all areas of law considered. Point five is an addition from practice and not a general legal obligation.

The thrust can be seen in a related process. For the data protection commitment of employees — not for their training — the Datenschutzkonferenz (Data Protection Conference) states: "For reasons of proof within the scope of the accountability obligation under the GDPR, it is important to document the commitment sufficiently" (Short Paper No. 19, as of 29 May 2018). There is no comparable specification by the supervisory authorities for training records in data protection; the information listed above is therefore derived from the accountability obligation, not a requirement set by the authorities. For AI literacy, by contrast, the Federal Network Agency recommends documenting the measures carried out, including their type, their scope in terms of content and time, and the persons taking part — as guidance, not as a binding requirement.

Where the documentation obligation is found: Section 4 DGUV Regulation 1

The documentation obligation for occupational health and safety instruction is found in Section 4 (1) DGUV Regulation 1, not in Section 12 of the Occupational Health and Safety Act (ArbSchG). According to it, instruction must "be repeated where necessary, but take place at least once a year; it must be documented". Under Section 15 SGB VII, accident prevention regulations are autonomous law of the accident insurance institutions and are therefore binding, not merely a recommendation.

The distinction is worthwhile because a widespread statement is misleading: Section 12 ArbSchG itself contains no documentation obligation. The provision governs that, when, and on what instruction must be given — it says nothing about documentation, written form, or signature; the documentation obligation under Section 6 ArbSchG concerns the documents on the risk assessment, not instruction. State ordinances also contain express documentation obligations for specific kinds of instruction, for example on work equipment: under Section 12 (1) sentence 4 of the Ordinance on Industrial Safety and Health (BetrSichV), the employer must record in writing the date of each instruction and the names of those instructed; the provision does not require a signature.

The overview shows how differently densely the areas of law are regulated:

• Occupational health and safety — Training or instruction obligation: Section 12 (1) ArbSchG. Express documentation obligation: Yes — in Section 4 (1) DGUV Regulation 1 and, for work equipment, in Section 12 (1) sentence 4 BetrSichV; not in the ArbSchG.
• Hazardous substances — Training or instruction obligation: Section 14 (2) GefStoffV. Express documentation obligation: Yes, expressly in writing and with signature.
• Biological agents — Training or instruction obligation: Section 14 (3) BioStoffV. Express documentation obligation: Yes, expressly in writing and with signature.
• Data protection — Training or instruction obligation: Art. 24, Art. 32 in conjunction with Art. 5 (2) GDPR. Express documentation obligation: No separate provision, but accountability ("be able to demonstrate").
• Money laundering prevention — Training or instruction obligation: Section 6 (2) no. 6 of the German Money Laundering Act (GwG). Express documentation obligation: No — proof follows indirectly from the obligation to monitor the safeguards.
• Equal treatment — Training or instruction obligation: Section 12 (1) of the General Act on Equal Treatment (AGG) (subsection 2 as a should provision). Express documentation obligation: No.
• Information security — Training or instruction obligation: Section 30 (2) sentence 2 no. 7 of the BSI Act (BSIG) (basic training and awareness-raising measures as a risk management measure) and Section 38 (3) BSIG (management of particularly important and important entities). Express documentation obligation: Yes for the risk management measures as a whole — under Section 30 (1) sentence 3 BSIG, the entity must document that it complies with its obligation to take these measures; the Act does not specify a record per training session. Section 38 BSIG contains no separate documentation provision for management training.
• Artificial intelligence — Training or instruction obligation: Art. 4 EU AI Act (EU) 2024/1689 as amended by Regulation (EU) 2026/1744. Express documentation obligation: No.

Two entries deserve a second look.

What the legal fiction of Section 12 (2) AGG covers

The obligation is set out in Section 12 (1) AGG: the employer must take "the necessary measures to protect against discrimination". Subsection 2 sentence 1 adds a should provision — the employer "should point out, in a suitable manner, in particular in the context of vocational training and continuing professional development, that such discrimination is impermissible". And sentence 2 attaches the much-cited legal fiction to it: "If the employer has trained its employees in a suitable manner for the purpose of preventing discrimination, this is deemed to fulfill its obligations under subsection 1." Sentence 2 thus expressly refers to the obligations under subsection 1. And it is tied to the word "suitable". Whether training was suitable is decided in a dispute, and that requires proof. The article on the protected characteristics of the AGG explains which characteristics the AGG protects.

The AI literacy obligation has been reworded

Art. 4 EU AI Act was replaced by Regulation (EU) 2026/1744 and has applied in its new version since July 27, 2026: providers and deployers "take measures to support the development of the AI literacy" of their staff; a specific level of competence of individual persons is not owed. Anyone still working with the old wording is documenting against a standard that is no longer in force. The article on the Digital Omnibus puts into context what else has changed.

Signature or digital?

In general occupational health and safety, no standard requires a handwritten signature. Section 4 (1) DGUV Regulation 1 merely requires that instruction be "documented"; the provision contains no requirement as to form.

The situation is different in three special areas. Section 14 (2) GefStoffV and Section 14 (3) BioStoffV require content and time to be "recorded in writing" and confirmed "by signature" by those instructed; Section 63 (6) StrlSchV requires a signature by the person instructed.

Whether this confirmation can be given digitally has not been conclusively clarified. The legislature distinguishes between written form (Section 126 of the German Civil Code (BGB), handwritten signature, replaceable by a qualified electronic signature under Section 126a BGB) and text form (Section 126b BGB, legible declaration on a durable medium). Which of the two is meant in the GefStoffV, BioStoffV, and StrlSchV could not be answered unambiguously on the basis of the primary sources evaluated. For the data protection commitment of employees — not for training records — the Datenschutzkonferenz, on the other hand, expressly permits "in writing or in an electronic format" in Short Paper No. 19; its sample for the written commitment provides signature fields.

Practical consequence: anyone who wants to document digitally in the area of hazardous substances, biological agents, or radiation protection should agree on the practice in advance with the competent accident insurance institution or the supervisory authority. In all three areas, the instruction itself is already tied to a form: it must be given orally (Section 14 (2) GefStoffV, Section 14 (2) BioStoffV, Section 63 (3) StrlSchV). Only the Radiation Protection Ordinance expressly provides that the competent authority may permit e-learning or audiovisual media if a check of learning success is carried out and questions can be asked (Section 63 (3) sentence 3 StrlSchV). In the other areas of law considered here, none of the standards evaluated requires a signature. Section 12 (1) sentence 4 BetrSichV does, however, require the date and names to be recorded "in writing"; whether this means written form could likewise not be answered unambiguously on the basis of the primary sources evaluated.

How long records must be kept

Expressly standardized periods for training records are rare and are found in special areas: Section 63 (6) StrlSchV requires records of instruction to be kept for five years in the cases of subsection 1 and for one year in the cases of subsection 4. For the carriage of dangerous goods by road, rail, and inland waterway, records of instruction must be kept for five years from the date they are made (Section 27 (3) no. 2 (b) and (5) no. 2 GGVSEB). In the food sector, Section 43 (5) IfSG specifies no period but requires the most recent documentation of the instruction to be kept by the employer.

For all other areas of law considered here: no express period. This expressly also applies to anti-money laundering law. The much-cited five-year period under Section 8 (4) GwG refers to the records and supporting documents under Section 8 (1) to (3) GwG — i.e., to due diligence records, copies and documents, risk assessments, and evidence under Section 16a (2) GwG. Training records are not in this catalog. Anyone who keeps them "for five years under Section 8 GwG" is following a plausible practical rule, not a legal obligation.

In practice, this means: set a retention period, justify it in the deletion concept, and document the justification — instead of adopting a number of years from another area of law.

Who has to prove what in the event of a dispute

There is no general statutory rule on the burden of proof for carrying out instruction. In practice, the need for proof arises in three ways.

First, the supervisory authority or the accident insurance institution demands the documentation owed under Section 4 (1) DGUV Regulation 1. Second, under Art. 5 (2) GDPR, the controller under data protection law is subject to accountability: it "must be able to demonstrate compliance" with it; Art. 24 (1) GDPR repeats this for the measures taken. Third, Section 22 AGG governs the allocation of the burden of proof; under it, the other party bears the burden of proving that there was no violation of the provisions on protection against discrimination if, in the event of a dispute, one party proves circumstantial evidence suggesting discrimination on one of the grounds referred to in the AGG.

In all three constellations, documentation serves the same purpose: it records who was instructed, when, and with what content.

Five gaps that make a record worthless

Most records do not fail because they do not exist but because of five recurring gaps.

Collective confirmation without names. A list that only says "Logistics department" does not prove which person was instructed. Section 4 (1) DGUV Regulation 1 ties the obligation to the insured persons, not to organizational units.

Missing course version. Without stating which version of the materials was taught, it cannot later be shown whether the content was up to date. Art. 4 EU AI Act shows how quickly this becomes relevant: anyone who trained according to the old version in July 2026 must be able to tell the difference.

Record without reference to the occasion. Section 12 (1) ArbSchG ties instruction to occasions — hiring, a change in the area of responsibility, new work equipment, new technology. A record that only bears a date leaves open whether the occasion was covered.

Absentees without a make-up note. Anyone who missed the instruction simply does not appear on the attendance list. What is then documented is the gap, not its closure — make-up dates belong in the same record.

Retention without a deletion concept. Training records are personal data. Anyone who keeps them without a defined period solves the proof problem and creates a problem with storage limitation under Art. 5 (1) lit. e GDPR.

What a learning management system does for the training record

A learning management system does one thing above all for the training record: the ongoing bookkeeping of due dates, participation status, and course versions. After all, the core of the problem is rarely the training but the bookkeeping about it: who is due, who is overdue, which version was delivered, and can this be proven in an audit within a few minutes. These are exactly the points that a learning management system maps systematically — participation status per person, time stamp, course version, follow-up. The article What is an LMS? gives an overview of the system category, and the article on LMS for mandatory training covers the selection criteria specifically for instruction.

Particularities apply to individual areas of law and must be taken into account in record-keeping: in anti-money laundering law, customer due diligence obligations are among the obligations on which employees must be informed; their basic concept is explained in the article on KYC. In occupational health and safety, proof depends on the occasion for instruction, which the article on the types of workplace fire protection puts into context using one example. And formal notifications on corruption prevention require that the term has been clarified — see the article What is corruption?.

Does the Occupational Health and Safety Act require instruction to be documented?

No. Section 12 ArbSchG governs the occasion, content, and timing of instruction, not proof of it. The express documentation obligation is found in Section 4 (1) DGUV Regulation 1; for instruction on work equipment, Section 12 (1) sentence 4 BetrSichV additionally requires the date and names to be recorded in writing. Under Section 15 SGB VII, accident prevention regulations are autonomous law of the accident insurance institutions and are therefore binding.

Does a training record have to be signed?

Not in general occupational health and safety — Section 4 (1) DGUV Regulation 1 only requires that documentation takes place. A signature is expressly required by Section 14 (2) GefStoffV, Section 14 (3) BioStoffV, and Section 63 (6) StrlSchV. Whether it may be given digitally has not been conclusively clarified.

How long must training records be kept?

Express periods exist only in a few special areas: Section 63 (6) StrlSchV specifies five years for the cases of subsection 1 and one year for those of subsection 4; for the carriage of dangerous goods by road, rail, and inland waterway, records of instruction must be kept for five years from the date they are made (Section 27 (5) no. 2 GGVSEB). Without specifying a number of years, Section 43 (5) IfSG provides that the most recent documentation of the instruction must be kept by the employer. For occupational health and safety, data protection, money laundering prevention, the AGG, and the EU AI Act, there is no statutory period for training records.

Does the five-year period of the German Money Laundering Act apply to training records?

No. Section 8 (4) GwG refers to the records and supporting documents under Section 8 (1) to (3) GwG — due diligence records, copies, risk assessments, and certain evidence. Training records are not in this catalog. Five years is a practical guideline here, not a legal obligation.

What does Section 12 (2) AGG provide for documented AGG training?

Section 12 (2) sentence 2 AGG provides that training carried out in a suitable manner is deemed to fulfill the obligations under subsection 1. The provision thus expressly refers to subsection 1. Whether training was suitable is decided on a case-by-case basis — and proof is needed for this.

Who has to prove in the event of a dispute that training took place?

There is no general rule on the burden of proof. In data protection, the controller is subject to an express obligation to provide proof under Art. 5 (2) GDPR. In the AGG, Section 22 AGG governs the allocation of the burden of proof if, in the event of a dispute, one party proves circumstantial evidence suggesting discrimination. In occupational health and safety, the supervisory authority demands the documentation owed.

• Section 12 Occupational Health and Safety Act – Instruction (accessed 14 Oct 2026)
• Section 6 Occupational Health and Safety Act – Documentation (accessed 14 Oct 2026)
• DGUV Regulation 1 „Grundsätze der Prävention“, Section 4 (1) – Instruction of insured persons, November 2013 edition (accessed 14 Oct 2026)
• Section 15 SGB VII – Accident prevention regulations as autonomous law (accessed 14 Oct 2026)
• Section 14 (2) GefStoffV – Instruction, in writing and with signature (version of 17 Dec 2025) (accessed 14 Oct 2026)
• Section 14 (3) BioStoffV – Instruction, in writing and with signature (accessed 14 Oct 2026)
• Section 63 (6) StrlSchV – Recording and retention of instruction (accessed 14 Oct 2026)
• Regulation (EU) 2016/679 (GDPR) – Art. 5 (1) lit. e, Art. 5 (2), Art. 24 (1), Art. 32 (accessed 14 Oct 2026)
• Datenschutzkonferenz, Short Paper No. 19 „Unterrichtung und Verpflichtung von Beschäftigten auf Beachtung der datenschutzrechtlichen Anforderungen nach der DS-GVO“, as of 29 May 2018 (accessed 14 Oct 2026)
• Section 6 (2) no. 6 German Money Laundering Act – Training of employees (accessed 14 Oct 2026)
• Section 8 German Money Laundering Act – Recording and retention obligation (accessed 14 Oct 2026)
• Section 12 General Act on Equal Treatment – Measures and obligations of the employer (accessed 14 Oct 2026)
• Section 22 General Act on Equal Treatment – Burden of proof (accessed 14 Oct 2026)
• Regulation (EU) 2024/1689 (EU AI Act) – Art. 4 AI literacy (accessed 14 Oct 2026)
• Regulation (EU) 2026/1744 – New version of Art. 4 EU AI Act, in force since 27 Jul 2026 (accessed 14 Oct 2026)
• Section 38 (3) BSIG – Implementation, monitoring, and training obligation for the management of particularly important and important entities (as amended by the NIS2UmsuCG, BGBl. 2025 I no. 301, in force since 6 Dec 2025) (accessed 14 Oct 2026)
• Section 30 (1) sentence 3 and (2) sentence 2 no. 7 BSIG – documentation of compliance with the risk management obligation; training and awareness-raising (accessed 14 Oct 2026)
• Section 12 (1) BetrSichV – instruction on work equipment, date and names in writing (accessed 14 Oct 2026)
• Section 27 (3) and (5) GGVSEB – retention of records of instruction for the carriage of dangerous goods (road, rail, inland waterway) (accessed 14 Oct 2026)
• Section 43 (4) and (5) IfSG – instruction and retention of the documentation (accessed 14 Oct 2026)
• Federal Network Agency, AI literacy – guidance on documenting the measures (accessed 14 Oct 2026)
• Section 126 BGB – Written form, Section 126a BGB – Electronic form, and Section 126b BGB – Text form (accessed 14 Oct 2026)
• DGUV, „Zahl der Arbeitsunfälle sinkt in 2025“, provisional figures, published 26 Mar 2026 (accessed 6 Aug 2026)
• BfDI, press release 6/2026 on the 34th Activity Report, reference year 2025, published 6 May 2026 (accessed 6 Aug 2026)
• Financial Intelligence Unit, Annual Report 2025, published 21 Jul 2026 (accessed 6 Aug 2026)