Mandatory training that has been carried out but not documented is practically worthless vis-à-vis a supervisory authority. The reason is unspectacular: anyone who cannot prove that it was carried out has, in case of doubt, no evidence — and in some areas of law they additionally bear an express obligation to provide proof.
Three figures from 2025 show how many cases a year can trigger a need for proof. The German Social Accident Insurance (DGUV) registered 730,598 reportable occupational accidents, around 24,000 fewer than in the previous year (provisional figures, published on March 26, 2026). The Federal Commissioner for Data Protection and Freedom of Information (BfDI) recorded 11,824 submissions, 36 percent more than in the previous year (34th Activity Report, published on May 6, 2026). And the Financial Intelligence Unit reported 374,693 suspicious activity reports, around 41 percent more than in 2024 (Annual Report 2025, published on July 21, 2026). Each of these figures stands for cases in which someone asks: What did you do, and how can we see that?
This article answers only the question of proof. Which training a company needs in the first place is explained in the overview of mandatory training for companies.
There is no standard that conclusively prescribes the content of a training record. However, a core that holds up in all constellations can be derived from the proof and accountability obligations of the individual areas of law:
Points one to four are consensus across all areas of law considered. Point five is an addition from practice and not a general legal obligation.
The thrust can be seen in a related process. For the data protection commitment of employees — not for their training — the Datenschutzkonferenz (Data Protection Conference) states: "For reasons of proof within the scope of the accountability obligation under the GDPR, it is important to document the commitment sufficiently" (Short Paper No. 19, as of 29 May 2018). There is no comparable specification by the supervisory authorities for training records; the information listed above is therefore derived from the accountability obligation, not a requirement set by the authorities.
The documentation obligation for occupational health and safety instruction is found in Section 4 (1) DGUV Regulation 1, not in Section 12 of the Occupational Health and Safety Act (ArbSchG). According to it, instruction must "be repeated where necessary, but take place at least once a year; it must be documented". Under Section 15 SGB VII, accident prevention regulations are autonomous law of the accident insurance institutions and are therefore binding, not merely a recommendation.
The distinction is worthwhile because a widespread statement is misleading: Section 12 ArbSchG itself contains no documentation obligation. The provision governs that, when, and on what instruction must be given — it says nothing about documentation, written form, or signature; the documentation obligation under Section 6 ArbSchG concerns the documents on the risk assessment, not instruction.
The overview shows how differently densely the areas of law are regulated:
Two entries deserve a second look.
The obligation is set out in Section 12 (1) AGG: the employer must take "the necessary measures to protect against discrimination". Subsection 2 sentence 1 adds a should provision — the employer "should point out, in a suitable manner, in particular in the context of vocational training and continuing professional development, that such discrimination is impermissible". And sentence 2 attaches the much-cited legal fiction to it: "If the employer has trained its employees in a suitable manner for the purpose of preventing discrimination, this is deemed to fulfill its obligations under subsection 1." Sentence 2 thus expressly refers to the obligations under subsection 1. And it is tied to the word "suitable". Whether training was suitable is decided in a dispute, and that requires proof. The article on the protected characteristics of the AGG explains which characteristics the AGG protects.
Art. 4 EU AI Act was replaced by Regulation (EU) 2026/1744 and has applied in its new version since July 27, 2026: providers and deployers "take measures to support the development of the AI literacy" of their staff; a specific level of competence of individual persons is not owed. Anyone still working with the old wording is documenting against a standard that is no longer in force. The article on the Digital Omnibus puts into context what else has changed.
In general occupational health and safety, no standard requires a handwritten signature. Section 4 (1) DGUV Regulation 1 merely requires that instruction be "documented"; the provision contains no requirement as to form.
The situation is different in three special areas. Section 14 (2) GefStoffV and Section 14 (3) BioStoffV require content and time to be "recorded in writing" and confirmed "by signature" by those instructed; Section 63 (6) StrlSchV requires a signature by the person instructed.
Whether this confirmation can be given digitally has not been conclusively clarified. The legislature distinguishes between written form (Section 126 of the German Civil Code (BGB), handwritten signature, replaceable by a qualified electronic signature under Section 126a BGB) and text form (Section 126b BGB, legible declaration on a durable medium). Which of the two is meant in the GefStoffV, BioStoffV, and StrlSchV could not be answered unambiguously on the basis of the primary sources evaluated. For data protection, on the other hand, the Datenschutzkonferenz expressly permits "in writing or in an electronic format" in Short Paper No. 19 and does not require a signature.
Practical consequence: anyone who wants to document digitally in the area of hazardous substances, biological agents, or radiation protection should agree on the practice in advance with the competent accident insurance institution or the supervisory authority. In the other areas of law considered here, none of the standards evaluated contains a requirement as to form that stands in the way of digital record-keeping.
Expressly standardized periods for training records are rare. Essentially only one can be substantiated: Section 63 (6) StrlSchV requires records of instruction to be kept for five years in the cases of subsection 1 and for one year in the cases of subsection 4.
For all other areas of law considered here: no express period. This expressly also applies to anti-money laundering law. The much-cited five-year period under Section 8 (4) GwG refers to the records and supporting documents under Section 8 (1) to (3) GwG — i.e., to due diligence records, copies and documents, risk assessments, and evidence under Section 16a (2) GwG. Training records are not in this catalog. Anyone who keeps them "for five years under Section 8 GwG" is following a plausible practical rule, not a legal obligation.
In practice, this means: set a retention period, justify it in the deletion concept, and document the justification — instead of adopting a number of years from another area of law.
There is no general statutory rule on the burden of proof for carrying out instruction. In practice, the need for proof arises in three ways.
First, the supervisory authority or the accident insurance institution demands the documentation owed under Section 4 (1) DGUV Regulation 1. Second, under Art. 5 (2) GDPR, the controller under data protection law is subject to accountability: it "must be able to demonstrate compliance" with it; Art. 24 (1) GDPR repeats this for the measures taken. Third, Section 22 AGG governs the allocation of the burden of proof; under it, the other party bears the burden of proving that there was no violation of the provisions on protection against discrimination if, in the event of a dispute, one party proves circumstantial evidence suggesting discrimination on one of the grounds referred to in the AGG.
In all three constellations, documentation serves the same purpose: it records who was instructed, when, and with what content.
Most records do not fail because they do not exist but because of five recurring gaps.
Collective confirmation without names. A list that only says "Logistics department" does not prove which person was instructed. Section 4 (1) DGUV Regulation 1 ties the obligation to the insured persons, not to organizational units.
Missing course version. Without stating which version of the materials was taught, it cannot later be shown whether the content was up to date. Art. 4 EU AI Act shows how quickly this becomes relevant: anyone who trained according to the old version in July 2026 must be able to tell the difference.
Record without reference to the occasion. Section 12 (1) ArbSchG ties instruction to occasions — hiring, a change in the area of responsibility, new work equipment, new technology. A record that only bears a date leaves open whether the occasion was covered.
Absentees without a make-up note. Anyone who missed the instruction simply does not appear on the attendance list. What is then documented is the gap, not its closure — make-up dates belong in the same record.
Retention without a deletion concept. Training records are personal data. Anyone who keeps them without a defined period solves the proof problem and creates a problem with storage limitation under Art. 5 (1) lit. e GDPR.
A learning management system does one thing above all for the training record: the ongoing bookkeeping of due dates, participation status, and course versions. After all, the core of the problem is rarely the training but the bookkeeping about it: who is due, who is overdue, which version was delivered, and can this be proven in an audit within a few minutes. These are exactly the points that a learning management system maps systematically — participation status per person, time stamp, course version, follow-up. The article What is an LMS? gives an overview of the system category, and the article on LMS for mandatory training covers the selection criteria specifically for instruction.
Particularities apply to individual areas of law and must be taken into account in record-keeping: in anti-money laundering law, the training obligation is linked to customer due diligence obligations, whose basic concept is explained in the article on KYC. In occupational health and safety, proof depends on the occasion for instruction, which the article on the types of workplace fire protection puts into context using one example. And formal notifications on corruption prevention require that the term has been clarified — see the article What is corruption?.
No. Section 12 ArbSchG governs the occasion, content, and timing of instruction, not proof of it. The express documentation obligation is found in Section 4 (1) DGUV Regulation 1. Under Section 15 SGB VII, accident prevention regulations are autonomous law of the accident insurance institutions and are therefore binding.
Not in general occupational health and safety — Section 4 (1) DGUV Regulation 1 only requires that documentation takes place. A signature is expressly required by Section 14 (2) GefStoffV, Section 14 (3) BioStoffV, and Section 63 (6) StrlSchV. Whether it may be given digitally has not been conclusively clarified.
An express period exists only in radiation protection law: Section 63 (6) StrlSchV specifies five years for the cases of subsection 1 and one year for those of subsection 4. For occupational health and safety, data protection, money laundering prevention, the AGG, and the EU AI Act, there is no statutory period for training records.
No. Section 8 (4) GwG refers to the records and supporting documents under Section 8 (1) to (3) GwG — due diligence records, copies, risk assessments, and certain evidence. Training records are not in this catalog. Five years is a practical guideline here, not a legal obligation.
Section 12 (2) sentence 2 AGG provides that training carried out in a suitable manner is deemed to fulfill the obligations under subsection 1. The provision thus expressly refers to subsection 1. Whether training was suitable is decided on a case-by-case basis — and proof is needed for this.
There is no general rule on the burden of proof. In data protection, the controller is subject to an express obligation to provide proof under Art. 5 (2) GDPR. In the AGG, Section 22 AGG governs the allocation of the burden of proof if, in the event of a dispute, one party proves circumstantial evidence suggesting discrimination. In occupational health and safety, the supervisory authority demands the documentation owed.
Insights into the future of digital learning, with a focus on AI, compliance, and modern training solutions. Discover the latest posts and articles to gain practical insights into legally compliant, efficient, and automated corporate training.
Bridgly is the European training partner for audit-proof, tailored, and automated training and professional development.
We support the IHK initiative "Pack ma's digital" to help businesses in Upper Bavaria with digitalisation and secure the future of the region.Note: Some text, images, and videos on this website were generated using artificial intelligence.
All content is for informational purposes and has been carefully reviewed from a journalistic perspective, but does not claim to be exhaustive or legally binding.
.webp)