Employee training: what does the law require?
Six sets of rules that require employee training in the EU: the AI Act, GDPR, NIS2, health and safety, anti money laundering, and food hygiene. Who they cover, how often, and how to prove it.
Several laws require your employees to learn the rules. Some say so directly. Others require you to manage a risk, and training is the most common way to do it. What they all have in common is that you must be able to show what you have done.
Here are the six sets of rules most companies in the EU meet. At the end there is a plan in five steps. If you first want to know what the term covers, read what is compliance training.
Status as of November 2026. This article describes EU rules and is not legal advice. National rules can add more.
Quick overview
- AI Act: everyone who uses AI for the company.
- GDPR: everyone who works with personal data.
- NIS2: management in companies covered by NIS2, and other staff should be trained too.
- Health and safety: all employees, and managers must know the rules on risk assessment.
- Money laundering: staff in banks, accounting firms, law firms, and estate agencies, for example.
- Food hygiene: staff who handle unpacked food.
AI Act: AI literacy for everyone who uses AI
Article 4 of the AI Act has applied since 2 February 2025. If you use AI at work, you must support your staff in building AI literacy. The level must fit the role. Management needs to know more than someone who uses a chatbot to write emails.
You do not have to prove a set level. But you must be able to show what you have done, for whom, and when. Read more in AI regulation in Denmark.
GDPR: training as part of your measures
GDPR does not say word for word that everyone must take a course. But you must have suitable measures to keep personal data safe (Article 32). And you must be able to show that you follow the rules (Article 5(2)).
Most breaches happen by mistake. An email to the wrong person, a file in an open folder. That is why training is the measure most companies choose. If you have a data protection officer, making sure staff are trained is part of that role.
NIS2: a course for management
Under NIS2, management in covered companies must take part in training on cybersecurity. Other employees should be offered similar training. Basic cyber hygiene is one of the measures you must have in place.
If you supply a company covered by NIS2, you will often get the same questions in the contract. See the details in NIS2 requirements: how to document the training.
Health and safety: instruction and risk assessment
EU rules on health and safety at work require employers to give staff the information and training they need to work safely. This includes the mental work environment, such as stress, bullying, and harassment.
Employers must also assess the risks at work. In Denmark, this is a written workplace assessment at least every three years. Managers should know the rules and how to turn the assessment into an action plan.
Money laundering: training in exposed sectors
The rules against money laundering cover banks, accountants, lawyers, and estate agents, among others. Here, staff must be trained in the rules, so they can spot and report suspicious activity. The training should fit the risk each person works with.
Food hygiene: training for those who handle food
EU food hygiene rules require that staff who handle food are trained in hygiene to a level that fits their work. This covers kitchens, canteens, and shops that make their own food. Check the national rules for your type of business.
A plan in five steps
- List the rules. Which of the six apply to you? Remember demands from customers and your own policies.
- Split staff into groups. Management, IT, HR, and everyone else need different things.
- Choose short courses with a test. 15 to 20 minutes is enough for the essentials. The test shows whether it has been learned.
- Keep proof for each employee. Who, which course, which version, when, and with what result.
- Set a fixed rhythm. Every year for IT security and AI for management. Every two years for the rest. And always when someone new starts.
How Skillflow helps
Skillflow has finished compliance courses for the AI Act, GDPR, IT security, NIS2, workplace assessment, and wellbeing. Each course ends with a test, and those who pass get proof with a date. The platform sends renewal reminders itself, and you can see who is missing.
If you have rules that no finished course covers, such as money laundering or food hygiene, you build your own course. You can also do it with help from AI.
Want to see how it works?
Book a demo, and we will show you the courses, the test, and the overview of certificates.
Sources