Mandatory Compliance Training in the UK: The 2026 Guide

A compliance audit lands on your desk. Completion rate: 94%. On paper, you're covered. Six months later there's a data breach, a harassment claim or an HSE visit after an incident, and the first question isn't "did people complete the training?" It's "was it right for the risk, and can you show it?"

Training that only records completion won't protect you when something goes wrong. This guide is for HR, L&D and compliance teams who need to know which training is legally required, which is expected, which sectors carry extra duties, and how to build a program that stands up to scrutiny.

The legal framework: where UK training duties come from

The Health and Safety at Work etc. Act 1974 requires employers to provide the information, instruction, training and supervision needed to keep employees safe (section 2). The Management of Health and Safety at Work Regulations 1999 add specific duties on when training must happen. These apply to almost every employer in Great Britain. Northern Ireland has its own equivalent legislation.

Other laws work differently. UK GDPR, the Equality Act 2010 and the Bribery Act 2010 don't say "train your staff." They say take appropriate measures, take all reasonable steps, or have adequate procedures. Training is how you show you did. The Money Laundering Regulations 2017 are different again: they require regulated firms to train relevant staff in terms.

Legally required vs expected: the distinction that matters

HR teams use "statutory" and "mandatory" interchangeably. They aren't the same, and the difference changes your risk.

Both matter. A gap in the first column is a breach. A gap in the second removes the evidence you'd rely on when something goes wrong. Separately, employers also set their own mandatory training through risk assessments and policy, such as conflict resolution or customer service. That's a business decision, not a legal one.

Key regulators and what they can do

• Health and Safety Executive (HSE): enforces health and safety law in Great Britain through improvement and prohibition notices, prosecution and unlimited fines. In April 2025 Cambridgeshire County Council was fined £6 million over safety failures on its Guided Busway, where three people died between 2015 and 2021.
• Information Commissioner's Office (ICO): enforces UK GDPR and the Data Protection Act 2018. The maximum penalty is £17.5 million or 4% of worldwide annual turnover, whichever is higher. In October 2025 it fined Capita £14 million over a 2023 cyber attack that exposed the data of 6.6 million people.
• Financial Conduct Authority (FCA): regulates financial services firms. Its fines for 2024 totaled about £176 million, up from about £53 million in 2023.
• Care Quality Commission (CQC) and Ofsted: inspect health, social care and education providers and can impose conditions or act on registration.
• Home Office and Counter Terrorism Policing: oversee the Prevent duty for specified public bodies.

Core compliance training across UK workplaces

These duties reach most employers whatever their sector. For each, the box shows the legal basis, and the text says plainly whether training itself is required or whether it's the evidence.

Health and safety training

Training has to match the risks in your risk assessment. A desk-based worker, a warehouse operative and a care worker need different content. The law doesn't set a universal refresh cycle: regulation 13 says "periodically where appropriate." Annual refreshers are common practice, and higher-risk roles need them more often.

Two related duties show how specific the rules get. Under the Health and Safety (First-Aid) Regulations 1981, employers must provide enough suitable first-aid personnel, and "suitable" means appropriately trained and qualified. Under the Manual Handling Operations Regulations 1992, employers must avoid hazardous manual handling where reasonably practicable and assess and reduce the risk where they can't. The manual handling regulations don't impose a standalone training duty, but an employee's knowledge and training is one of the factors the assessment must consider, so training is how most employers meet them.

Fire safety training

The responsible person is usually the employer or whoever controls the premises. Good fire training covers evacuation routes, alarms, extinguisher locations and assembly points, and designated fire wardens need more. New starters should be trained before they begin work. Scotland and Northern Ireland have their own fire safety legislation.

GDPR and data protection training

Anyone who handles personal data should be trained on the lawful bases for processing, data subject rights, subject access requests, secure handling and how to spot and report a breach. A personal data breach that's likely to risk people's rights must be reported to the ICO within 72 hours of becoming aware of it (Article 33), so staff need to know who to tell, fast.

Equality, diversity and harassment training

The Equality Act doesn't require equality training by name. But the vicarious liability defense depends on showing all reasonable steps, and training is the step tribunals look for first. The sexual harassment duty came in through the Worker Protection (Amendment of Equality Act 2010) Act 2023 and has applied since 26 October 2024.

From 30 October 2026, the Employment Rights Act 2025 raises that duty from "reasonable steps" to "all reasonable steps" and reintroduces employer liability for harassment of staff by third parties such as customers and clients. What counts as reasonable will depend on factors like your size, sector and resources. The Equality and Human Rights Commission (EHRC) can enforce the duty without a complaint being made first.

Tribunal exposure has grown too. Since 1 October 2026 the time limit for most employment tribunal claims has doubled from three months to six, for claims where the relevant date is on or after that day.

Anti-bribery training

The Act doesn't mandate training, but the guidance makes it part of the defense. Organizations face unlimited fines, and individuals can face up to 10 years in prison for bribery offenses. Training should cover what counts as a bribe (including gifts, hospitality and facilitation payments), your policy, how to report concerns and scenarios from your own sector.

Cybersecurity training

No UK law requires "cybersecurity training" by name. But under UK GDPR Article 32 you must secure personal data, and staff behavior is part of that. The National Cyber Security Centre (NCSC) recommends staff awareness training as a baseline control. Cover phishing, password hygiene, safe handling of data, personal devices and how to report an incident. Treat it as expected, not required.

Sector-specific mandatory compliance training

These duties apply to regulated sectors, each with its own regulator, record-keeping expectations and refresh rhythm.

Anti-money laundering (AML) training

The regulations apply to firms in the regulated sector, including banks and other financial institutions, legal practices, accountants and tax advisers, estate agents, certain letting agents and high-value dealers. Supervisors include the FCA, HMRC and professional bodies.

The regulation says "regularly" and sets no interval. You'll often see "every 24 months" quoted as a rule. It isn't in the regulations. Many firms refresh annually or every two years, but the standard is that training is regular, role-appropriate and recorded.

Enforcement shows what happens when controls fail. In November 2024 the FCA fined Metro Bank about £16.7 million after its transaction monitoring system failed to monitor over 60 million transactions worth more than £51 billion between 2016 and 2020. In October 2024 it fined Starling Bank about £29 million over failings in its financial sanctions screening controls.

Safeguarding training

Safeguarding duties come from the Children Act 1989 and 2004, the Care Act 2014 and sector regulators, plus statutory guidance such as Keeping Children Safe in Education (KCSIE) for schools and colleges in England. The training rules are set mostly by that guidance and by regulators like Ofsted and the CQC, rather than by one general law. Training is normally tiered:

• All relevant staff: awareness of the signs of abuse and neglect, and how and when to report.
• Designated safeguarding leads: advanced training, which statutory guidance for schools expects to be refreshed every two years.
• Regulated providers: Ofsted- and CQC-regulated settings must meet their regulator's standards, and gaps can lead to conditions, lower ratings or action on registration.

Prevent duty training

Section 26 of the Counter-Terrorism and Security Act 2015 requires specified authorities to have "due regard to the need to prevent people from being drawn into terrorism." The list in Schedule 6 includes schools, colleges and universities, local authorities, NHS bodies, prisons and probation, and some police bodies. The Act itself doesn't mention training, but statutory Prevent guidance expects relevant staff to understand the signs of radicalization and how to make a referral. Many NHS organizations set their own refresher interval.

Infection prevention and control

The Health and Social Care Act 2008 Code of Practice on the prevention and control of infections applies to NHS bodies and to providers of independent healthcare and adult social care in England. It was last updated in December 2022. The CQC uses it when assessing providers, and staff training in hand hygiene, protective equipment, waste and decontamination is how providers show they meet it.

Compliance training refresh frequency at a glance

There's no single refresh cycle. The table separates what the law says from what's common practice, because mixing the two is how "requirements" that don't exist end up in policies.

Treat these as starting points. Regulators expect extra training after a change in the law, after an incident, or when someone changes role.

Why traditional compliance training fails the standard

The problem is the delivery, not the content. A single long annual module is easy to click through and easy to forget. Memory research dating back to Hermann Ebbinghaus in the 1880s shows that people lose new information quickly unless it's reinforced, and a once-a-year course gives no reinforcement at all. Long sessions also tank completion, and annual updates mean staff may be working from outdated guidance for months.

A completion record shows someone clicked through. It doesn't show they'd know what to do when it happens.

How microlearning helps you meet the standard

Microlearning delivers training in short, focused sessions. Microlessons of about 5 minutes fit between meetings and shifts, so people finish them. The 5Mins compliance library includes 500+ accredited compliance courses, with content kept up to date as regulations change.

Completion: the problem short lessons fix

Traditional LMS platforms often see compliance completion under 5%. 5Mins delivers 95%+ completion. The difference is format: a lesson that takes about 5 minutes on a phone gets done, and a 45-minute desktop module often doesn't.

Retention: spacing and reinforcement

Revisiting a topic at intervals, rather than once, is one of the best-established ways to hold onto what you've learned. Short lessons suit this. You can schedule refreshers to match your refresh cycle and turn an annual event into a habit, without making people repeat a whole course.

Records you can show an auditor

When the FCA asks for proof of AML training, or the ICO looks at your controls after a breach, a spreadsheet won't be convincing. They want who was trained, when, on what and what their role was at the time. 5Mins tracks compliance completion for every learner (100% compliance tracking), so that evidence is ready without end-of-quarter data pulls.

A practical framework for HR, L&D and compliance teams

Whether you're building from scratch or auditing what you have, work through these steps.

1. Map your legal obligations by role

   Not every duty applies to everyone. AML applies to specific roles in regulated firms, safeguarding is tiered, and health and safety content depends on workplace risk. Build a training needs matrix that links each duty to the roles it covers and the level required.

2. Separate "required" from "expected"

   Mark each item as written into law or as evidence of compliance. It tells you where a gap is a breach and where it's a weaker defense, and it stops you inventing refresh rules that don't exist.

3. Set documented refresh schedules

   Use the table above as a baseline and adjust for risk. Automate reminders, because manual tracking slips when teams are busy.

4. Build training for the "all reasonable steps" standard

   From 30 October 2026, harassment prevention needs to be demonstrably real: role-appropriate content, realistic scenarios, regular reinforcement, and manager training on how to respond to a disclosure.

5. Keep content current and records complete

   When the law changes or a relevant enforcement case lands, review your content. For every delivery, record what was covered, who completed it, when, the score and their role at the time.

Staying compliant in 2026

The question has moved from "what training is required?" to "how do we make it effective, evidence it and keep it current?" A law that raises the harassment standard in days, tribunals with twice the time to bring a claim, and regulators handing out multimillion-pound fines all point the same way.

Start with the map: what's required, what's expected, and who needs which. Then see the 5Mins compliance training library, or start a free trial.

This article gives general information on UK compliance training duties as of 28 October 2026. It isn't legal advice; check your own obligations with a qualified professional.