Mandatory Training for Employees in the UK: The Legal List

In the UK, the law requires every employer to give staff the health and safety and fire safety training they need to work safely, when they start and whenever their risks change, in working hours and at no cost to them. Other training becomes mandatory because of your sector (money laundering rules, FCA rules, care or education standards) or because you need it to show you took reasonable steps (data protection, preventing sexual harassment and discrimination, anti-bribery and, in large organisations, fraud prevention). Everything else on a typical “mandatory” list is your own policy, which is fine, as long as you know which is which.

This guide sets out the legal list, with links to the legislation, and then covers pay and records. To get a list for your own organisation, use our free UK mandatory training checker.

What is the difference between statutory and mandatory training?

The two words are used loosely, so pin them down first.

• Statutory training is training an Act of Parliament or a regulation requires. If you skip it, you are in breach of the law.
• Mandatory training is training your organisation requires. It may be required because a regulator or sector standard expects it, because an insurer or client asks for it, or because your own risk assessment says staff need it.

All statutory training is mandatory, but not all mandatory training is statutory. The distinction matters when you set priorities, and when an employee asks why they have to do a course. Calling company policy “a legal requirement” undermines trust in the courses that really are.

What training is a legal requirement for all UK employers?

A small number of duties apply to almost every employer in Great Britain, whatever the sector.

Health and safety training

Section 2 of the Health and Safety at Work etc. Act 1974 requires employers to provide the information, instruction, training and supervision needed to ensure, so far as is reasonably practicable, the health and safety of employees.

Regulation 13 of the Management of Health and Safety at Work Regulations 1999 makes this more specific. Employees must receive adequate health and safety training:

• when they are recruited
• when they are exposed to new or increased risks, for example a transfer, a change of responsibilities, new equipment, new technology or a new system of work

The same regulation says the training must be repeated periodically where appropriate, adapted to new or changed risks, and take place during working hours.

HSE’s guidance on training adds that this covers everyone who works for you, including contractors and the self-employed, and it singles out new recruits, people changing jobs or taking on extra responsibilities, young employees and health and safety representatives as groups with particular needs.

The law does not name a course. Training has to be adequate for the risks your people face, so the content follows from your risk assessment. A recognised course such as IOSH Working Safely is one way to give a workforce a consistent grounding, but it is a choice, not a legal requirement.

Fire safety training

In England and Wales, article 21 of the Regulatory Reform (Fire Safety) Order 2005 requires the responsible person to give employees adequate safety training when they are first employed and when they are exposed to new or increased risks. The training must cover the precautions and actions each person should take to protect themselves and others on the premises, be repeated periodically where appropriate, match the risks in your fire risk assessment and take place during working hours. Scotland and Northern Ireland have near-identical duties in regulation 20 of the Fire Safety (Scotland) Regulations 2006 and the Fire Safety Regulations (Northern Ireland) 2010.

Generic fire awareness content is a start, but the precautions and actions are specific to your premises, so part of the training has to be too. Our guide to fire safety training for employees covers who needs what, fire marshals and how often to train.

Display screen equipment (DSE) training

If people use computers as a significant part of their job, regulation 6 of the Health and Safety (Display Screen Equipment) Regulations 1992 requires adequate health and safety training in the use of their workstation. For someone who is about to become a user, it must be given before they start, and again when their workstation is substantially changed.

What training depends on your sector or role?

Beyond the general duties, the legal list grows with what you do. Some common examples:

• Money laundering: businesses in the regulated sector must regularly train relevant employees to recognise and deal with transactions and situations that may involve money laundering or terrorist financing, and keep a written record of the measures taken, under regulation 24 of the Money Laundering Regulations 2017. Our guide to anti-money laundering training covers who counts as a relevant employee and what to cover.
• Financial services: FCA-regulated firms have competence and conduct obligations that make training a practical necessity. Our guide to Consumer Duty training covers what the FCA expects staff to know. Banks, building societies and insurers covered by the FCA’s whistleblowing rules must also train staff on raising concerns: see our guide to whistleblowing training.
• Specific hazards: work with particular equipment, substances or tasks brings its own training duties under the relevant regulations. Your risk assessment should identify them.
• Health, social care and education: these sectors have their own regulators and standards, which set expectations that go well beyond the general duties above.

If you are not sure what applies, our free mandatory training checker builds a list from your nation, sector, size and what your staff do, with a source for each item. Then check it against your risk assessments and your regulator’s rulebook.

Which training is good practice rather than a legal duty?

Some common items on a mandatory list are not named as training duties in law, but are hard to defend without training.

Data protection and UK GDPR

UK GDPR does not contain a single line that says “train all staff”. It does require you to keep personal data secure and to be able to demonstrate compliance. The accountability framework on training and awareness from the ICO (now formally the Information Commission) sets out what it expects in practice: induction training before staff access personal information and within one month of their start date, refresher training at appropriate intervals, an assessment at the end, and records of who was trained on what. The ICO notes this guidance is under review following the Data (Use and Access) Act, so check the current version. Our guide to GDPR training for employees covers what the training should include and how often to run it.

Preventing sexual harassment

Since 26 October 2024, section 40A of the Equality Act 2010 has required employers to take reasonable steps to prevent sexual harassment of their employees in the course of their employment. On 30 October 2026 the Employment Rights Act 2025 raised this to “all reasonable steps”, and employers can now also be liable when a third party, such as a customer, harasses an employee. The section does not mention training, but the EHRC lists training among the steps it expects. In our view it is difficult to show you took all reasonable steps if your staff and managers have never been told what the policy is, what counts as harassment and how to report it. Our guide to sexual harassment training for employees sets out what each group of staff needs.

Equality and discrimination

Under section 109 of the Equality Act 2010, an employer is liable for discrimination and harassment by its employees in the course of their work, unless it can show it took all reasonable steps to prevent it. Acas advises regular equality and diversity training, and in Allay (UK) Ltd v Gehlen the Employment Appeal Tribunal upheld a finding that stale training was not enough. Our guide to equality and diversity training explains what makes training count.

Preventing bribery

Under section 7 of the Bribery Act 2010, a company or partnership of any size is guilty of an offence if someone performing services for it pays a bribe to win or keep business, unless it can prove it had adequate procedures to prevent bribery. The Ministry of Justice guidance makes communication, including training, one of its six principles for those procedures. Our guide to anti-bribery training for employees explains who needs what.

Failure to prevent fraud (large organisations)

Since 1 September 2025, a large organisation can be prosecuted under section 199 of the Economic Crime and Corporate Transparency Act 2023 if an employee, agent or other associated person commits fraud intending to benefit it, unless it had reasonable fraud prevention procedures. Large means meeting two or more of: more than 250 employees, turnover over £36 million and a balance sheet total over £18 million. The Act does not mention training, but the Home Office guidance makes communication, including training, one of its six principles for those procedures. Our guide to failure to prevent fraud training explains who needs what.

Everything else

Cyber security awareness and code of conduct courses are often sensible choices, and clients and insurers sometimes expect them. Label them honestly as company policy and keep them short. Organisations with a turnover of £36 million or more should also say what modern slavery training they provide in their annual statement: see our guide to modern slavery training.

Do employers have to pay for mandatory training?

For health and safety and fire safety training, the regulations above say it must take place during working hours, and section 9 of the Health and Safety at Work etc. Act 1974 stops an employer charging employees for anything done or provided to meet a specific statutory requirement.

For minimum wage purposes, GOV.UK’s guidance on working hours for which the minimum wage must be paid lists time spent training as working time, along with travel from the workplace to a training venue. The guidance on salaried workers explains the narrow exception: training that the employer does not require and that does not take place when the worker would otherwise be working.

There is also a paperwork point that many employers miss. The written statement of employment particulars, due on the first day of employment, must include any training the employee has to complete and whether the employer pays for it.

Can an employer make me do training in my own time?

For statutory health and safety and fire training, no: the regulations say it must happen in working hours. For other required training, the minimum wage guidance means the time generally counts as working time and has to be paid as such. Asking staff to complete e-learning at home in the evening does not change that.

This is one reason short online modules suit mandatory training: they fit into a quiet part of a shift, on a desktop or a phone.

How do you keep mandatory training records that stand up?

When an auditor, insurer, client or inspector asks about training, they want evidence for a named person, not a slide deck. Good records show:

• who completed which course, and which version of the content
• when they completed it and when it is due again
• the assessment result, where there is one
• who is overdue, and what you did about it

The Money Laundering Regulations require a written record of training, and the ICO expects you to keep copies of training material and track who received it. For health and safety, records are how you show that training was adequate and repeated where appropriate.

Spreadsheets break down quickly once staff turnover starts. A learning management system records completions, scores and dates automatically and lets managers see who is overdue. The Capytech LMS does this under your own brand, with single sign-on, and works in the browser on any phone, so frontline staff can complete training on a phone. If you also run classroom courses with trainers and venues, our guide to LMS vs TMS explains when you need a training management system as well.

Off-the-shelf or custom mandatory training?

Most organisations end up with a mix. To decide which roles need what, our free training needs analysis template scores the gaps and priorities for you.

• Off-the-shelf courses suit topics where the content is the same for everyone: general health and safety awareness, DSE, data protection basics, cyber security awareness. The Capytech course library has around 9,000 ready-made courses, and IOSH Working Safely is available 100% online. Our guide to online health and safety training covers what still needs practical training.
• Custom modules suit anything that depends on your own premises, procedures or policies: fire procedures for your sites, your code of conduct, your data handling rules, your harassment policy and reporting routes. Custom e-learning built from your own documents makes the training specific, which is exactly what the fire safety order and a reasonable-steps defence call for.

If your policies already exist as PDFs or slide decks, they can usually be turned into interactive modules quickly. We cover how in our guide to turning PowerPoint and PDF training into SCORM e-learning.

Frequently asked questions