Mandatory vs Statutory Training in the UK: How to Decide What Staff Need

Search for “mandatory training for employees in the UK” and you will find long course lists. Treat them carefully. UK employers share important duties, but there is no single course list that is automatically correct for every workplace and every role.

The reliable approach is to identify the applicable duty or standard, assess the work and its risks, decide what people must be able to do, and select training and supervision that address the need.

This article explains the language and gives you a repeatable decision method.

Statutory and mandatory are not the same thing

In everyday workplace use:

1. Statutory training describes learning required to meet a specific legal duty or a rule made under legislation.
2. Mandatory training is learning the organisation requires people to complete. The basis might be law, regulator expectations, a contract, an insurer's condition, accreditation, policy or an identified risk.
3. Essential role training covers knowledge and capability needed to perform the job, even where nobody has prescribed a named course.
4. Development learning supports future capability, progression or performance rather than a present compliance requirement.

These categories can overlap. Fire-safety instruction may respond to a legal duty and also be mandatory under company policy. A customer-service module may be mandatory internally but not statutory. A care provider may require learning because of its service, regulator expectations and assessed staff needs.

The label is less important than recording the basis accurately.

What UK law actually asks employers to do

Health and safety law provides the broadest example. The Health and Safety at Work etc. Act 1974 and supporting regulations create duties that include information, instruction, training and supervision in relevant circumstances. The Management of Health and Safety at Work Regulations 1999 require risk assessment and contain training provisions.

The HSE explains that employers need to provide clear instructions, information and adequate training. Its current guidance tells employers to consider who needs training, what is relevant and effective, and whether people have understood it.

This does not mean every person must take every health and safety course. It means the employer must make a competent, risk-led decision and ensure the resulting arrangements work.

Other duties can be more specific. For example, the Regulatory Reform (Fire Safety) Order 2005 includes employee training requirements for relevant premises in England and Wales. Sector and devolved-nation rules may differ, so check the correct jurisdiction.

The five-question decision test

Use this test for each role and activity.

1. What work will the person do?

List real activities, equipment, environments, systems and contact with other people. Do not rely only on the job title. Two people with the same title may face different risks at different sites.

2. What requirement or risk applies?

Check:

1. legislation and official regulator guidance;
2. the organisation's risk assessments;
3. sector regulations, standards and commissioner conditions;
4. professional or licence requirements;
5. customer contracts and insurance conditions;
6. internal policies and values.

Record the source or approved rationale. Avoid labelling every policy choice “the law”.

3. What must the person know or be able to do?

Write an outcome, not a course title. Examples include:

1. follow the site's evacuation arrangements;
2. use a named type of equipment safely;
3. recognise and escalate a safeguarding concern;
4. handle personal data using the organisation's process;
5. demonstrate a role-specific clinical or operational skill.

An outcome makes it easier to choose the right learning method and assessment.

4. What combination of instruction, training and supervision is appropriate?

An online module may efficiently introduce knowledge. It may need to be combined with a local briefing, practical exercise, supervised practice or observation. HSE guidance says training should be easy to understand and take account of workers whose first language is not English.

Consider literacy, accessibility, language, experience and work pattern. The aim is effective understanding, not just content availability.

5. What evidence and review rule will show the control is working?

Decide what to record: assignment, attendance, score, observation, sign-off, certificate, content version and any exception. Set review triggers such as role change, incident, new equipment, poor performance, expiry or changed guidance.

The HSE advises checking that training has worked. Completion alone does not always demonstrate safe or competent performance.

Common training areas and how to think about them

The following are examples, not a universal mandatory list.

Health and safety induction

Most employers need an effective way to explain relevant risks, controls, emergency arrangements and responsibilities. Content should reflect the work and site. A generic induction may need local additions.

Fire safety

Provide suitable information and training for the premises and arrangements that apply. Consider new starters, changed responsibilities, evacuation roles, visitors and people who may need assistance. Check the correct fire-safety regime for the nation and premises.

First aid

The employer should assess first-aid needs. HSE first-aid guidance explains factors such as hazards, workforce, work patterns and location. The assessment determines the provision and trained-person requirement, not a generic staff ratio copied from another workplace.

Data protection and information security

Training should reflect the personal data, systems, incidents and decisions relevant to each group. The ICO's accountability framework includes training and awareness as part of organisational accountability. High-risk roles may need deeper or more frequent learning than the general workforce.

Safeguarding

Requirements differ by sector, activity, role and contact with children or adults at risk. Use the relevant regulator and sector guidance. In charities, trustees retain oversight responsibilities; in regulated care, provider obligations and staff needs must be considered.

Equipment and role competence

Where work equipment is involved, HSE guidance on training and competence explains that users and relevant supervisors or managers need adequate training. The form and depth should match the equipment and risk.

Who pays for mandatory training?

If training is required by the employer, deal with time and pay correctly. ACAS guidance updated in May 2026 explains that whether training time must be paid can depend on the contract and minimum-wage rules. Check the worker's circumstances rather than assuming unpaid completion at home is acceptable.

Operationally, give people realistic time, access and support. A deadline without protected opportunity can turn a learning problem into a scheduling problem.

How often should mandatory training be refreshed?

Use a source-based or risk-based rule. A fixed expiry may be set by a certificate, regulator, professional body or internal standard. In other cases, event-led refreshers may be more defensible.

Consider refresher activity after:

1. a role, process, site or equipment change;
2. an incident, near miss or audit finding;
3. evidence that knowledge or performance has declined;
4. a material policy or legal update;
5. an extended period away from the activity;
6. a planned periodic review based on risk.

Record the basis. “Annual because it has always been annual” is not a strong rationale.

Turn the decision into a controlled plan

For each requirement, document:

1. source and jurisdiction;
2. roles, sites and activities covered;
3. learning outcome;
4. delivery and assessment method;
5. evidence required;
6. refresher or change trigger;
7. owner and escalation route;
8. retention rule.

That structure becomes your employee training matrix. A platform can automate assignments and reminders, but it should implement the logic rather than invent it.

Cademi currently provides 950+ courses in 41 languages and lets organisations combine ready-made learning with their own content. Use the course library to evaluate coverage only after your role and risk map is clear.

Frequently asked questions

Is GDPR training mandatory for every employee?

Organisations need appropriate data-protection awareness and controls, but the exact training should reflect roles and processing risk. Avoid assuming one identical module is sufficient for everyone.

Is equality and diversity training required by law?

Employers have legal responsibilities, but that does not automatically prescribe one named course for all staff. Training may form part of reasonable preventative and cultural measures. Seek employment-law advice for the organisation's circumstances.

Can we require staff to repeat a course?

An employer may set reasonable training requirements. Explain the basis, consider accessibility and competence evidence, and apply time and pay rules correctly.

Does a certificate make the organisation compliant?

No. A certificate records an event. Compliance depends on the wider arrangements, including risk decisions, suitable delivery, supervision, competence and ongoing control.