9 training duties across 9 instruments binding Government & Public Sector, plus 10 that bind you whatever your sector — statute, rulebook, statutory guidance and licence conditions. Every one traced to its clause, its date and its published source, and each one labelled with what makes it a training duty.
Most of the duties that bind you do not use the word training, and the ones that do are not in the statute book.
Section 149 requires “due regard”. Section 40A requires “reasonable steps”. Section 7 of the Bribery Act offers a defence of “adequate procedures” — a term the Act expressly declines to define.
The training expectation lives in the guidance beneath them, and in functional standards that sit outside legislation entirely. A team that searches the legislation and finds nothing has searched correctly and reached the wrong conclusion.
Each clause carries a label saying why it is a training duty. Where the instrument does not use the word, we cite the guidance or the case that makes training the way you discharge it. Where we cannot cite anyone, it is not listed as a training duty at all.
| Clause | Who must be trained or assessed | What is required | Interval | Evidence required |
|---|---|---|---|---|
| UK GDPR | ||||
| Article 39(1)(b) says train | defined population — quoted: "staff involved in processing operations" | The data protection officer's tasks include monitoring compliance with the Regulation and with the controller's or processor's own data protection policies, including the assignment of responsibilities, awareness-raising and training of staff involved in processing operations, and the related audits. | none specified | none specified in this Article; the related audits are named as part of the monitoring task |
| Equality Act 2010 | ||||
| Section 149 (Public sector equality duty) case law R (Brown) v Secretary of State for Work and Pensions [2008] EWHC 3158 (Admin), paragraph 90 — read at source 2026-08-12 from caselaw.nationalarchives.gov.uk (179,834 characters of judgment text). Setting out the general principles for discharging a 'due regard' equality duty, the Divisional Court held: "First, those in the public authority who have to take decisions that do or might affect disabled people MUST BE MADE AWARE OF THEIR DUTY to have 'due regard' to the identified goals... Thus, AN INCOMPLETE OR ERRONEOUS APPRECIATION OF THE DUTIES WILL MEAN THAT 'DUE REGARD' HAS NOT BEEN GIVEN TO THEM." Awareness and correct understanding are therefore a precondition of compliance, not an optional aid to it — which is what makes equipping decision-makers (in practice, training them) the way the duty is discharged. ⚠️ PROVENANCE, STATED PLAINLY: Brown concerned section 49A of the Disability Discrimination Act 1995, the PREDECESSOR duty, not Equality Act 2010 s.149 itself. The principles are routinely applied to s.149 and were restated for it by the Court of Appeal in Bracking v Secretary of State for Work and Pensions [2013] EWCA Civ 1345 — BRACKING HAS NOT BEEN READ and is named in not_yet_searched. This citation is therefore sound on the principle and one step removed on the provision. ⚠️ The EHRC technical guidance, which would be the direct regulator source, is BOT-BLOCKED: equalityhumanrights.com returns HTTP 403 to a fully-headed browser request on both URL forms tried on 2026-08-12, and the SiteBridge browser route was unavailable (LiteLLM virtual key unauthorized, MAG-489). That is a real block, not a wrong URL. | not specified — training is NOT expressly mentioned in section 149 | A public authority must, in the exercise of its functions, have due regard to the need to eliminate discrimination, harassment, victimisation and other prohibited conduct; to advance equality of opportunity between persons who share a relevant protected characteristic and those who do not; and to foster good relations between them. | none specified — the duty is continuous and applies in the exercise of functions | none specified in this section |
| Worker Protection (Amendment of Equality Act 2010) Act 2023 | ||||
| Equality Act 2010 s.40A, inserted by Worker Protection Act 2023 s.1 and AMENDED by Employment Rights Act 2025 s.20 guidance EHRC technical guidance on sexual harassment and harassment at work, paras 3.47, 3.54, 3.56, 3.57 — held as its own record in this map. | not specified — training is not expressly named | An employer must take reasonable steps to prevent sexual harassment of its employees in the course of their employment. 🔴 AMENDED: Employment Rights Act 2025 section 20 amends section 40A to insert the word "ALL" before "reasonable steps" — raising the standard to ALL reasonable steps. Sexual harassment takes the meaning in section 26(2) of the Equality Act 2010. | none specified | none specified in the section; breach is enforceable as an unlawful act under Part 1 of the Equality Act 2006, and a compensation uplift is available in employee sexual harassment cases |
| Bribery Act 2010 | ||||
| Section 7 (Failure of commercial organisations to prevent bribery), with guidance published under section 9 guidance MoJ guidance published under Bribery Act 2010 s.9, Principle 5 (Communication, including training), commentary 5.5-5.8 — held as its own record in this map. | not specified in the section — the associated persons whose conduct creates liability are wider than employees | An organisation is guilty of an offence if a person associated with it bribes another person intending to obtain or retain business or a business advantage for it. It is a defence for the organisation to prove that it had in place adequate procedures designed to prevent persons associated with it from undertaking such conduct. | none specified | The organisation bears the burden of PROVING adequate procedures were in place. The evidential burden sits with the defendant. |
| The Bribery Act 2010 — Guidance about procedures which relevant commercial organisations can put into place to prevent persons associated with them from bribing (Ministry of Justice, published under s.9) | ||||
| Principle 5 (Communication, including training), with commentary 5.5 to 5.8 says train | defined population, wider than employees — new employees and AGENTS on a weighted risk basis; holders of specific posts; those involved in 'speak up' procedures; higher risk functions including purchasing, contracting, distribution and marketing, and those working in high risk countries; and, where appropriate, ASSOCIATED PERSONS | Quoted: "The commercial organisation seeks to ensure that its bribery prevention policies and procedures are embedded and understood throughout the organisation through internal and external communication, including training, that is proportionate to the risks it faces." Training should be proportionate to risk, but some training is likely to be effective whatever the level of risk (5.5). General training could be mandatory for new employees or agents as part of induction, but should also be tailored to the specific risks of specific posts (5.6). It may be appropriate to require associated persons to undergo training, particularly high risk associated persons (5.7). Whatever the format, the training ought to ensure participants develop a firm understanding of what the policies mean in practice for them (5.8). | quoted: "Effective training is continuous, and regularly monitored and evaluated" — no interval stated | Not specified, but the organisation bears the burden of proving adequate procedures under s.7(2) |
| Government Functional Standard GovS 013: Counter Fraud (Cabinet Office) | ||||
| Section 5.7 (Awareness training), with section 4.7.8 (Employees and contractors), version 2.0 says train | all staff, as appropriate to their role — and expressly CONTRACTORS as well as employees (4.7.8) | Quoted from 5.7: "Organisations should ensure staff have access to and undertake fraud, bribery and corruption training as appropriate to their role." Individual staff members should ensure completion of the training as set by the organisation. The senior officer accountable for counter fraud within the organisation is responsible for the provision of the training AND for the decision on what training is appropriate. Section 4.7.8 places a parallel expectation on employees and contractors to undertake fraud, bribery and corruption training as defined and required by their organisation. | NONE STATED in section 5.7 — see the verification note | none identified in the sections read |
| Government Functional Standard GovS 007: Security (Cabinet Office) | ||||
| Section 6.10 (Security culture, education and awareness), version 2.0 says train | all new joiners; employees and, where appropriate, CONTRACTORS for ongoing awareness | Quoted: "Organisations shall ensure that new joiners have immediate access to induction material and core learning on security responsibilities and obligations." Induction should include the necessary policies and processes to be followed and the availability of facilities and tools appropriate to the role. Security education and awareness activity should include a combination of induction material and programmes for employees and contractors, and periodic education and awareness events and campaigns for employees and, where appropriate, contractors. Organisations shall also have a security culture publicised and led by example from the top, with the Accounting Officer and executive board following the relevant processes. | immediate access on joining; periodic education and awareness thereafter — no interval stated | none identified in the section read |
| EHRC technical guidance: Sexual harassment and harassment at work (Equality and Human Rights Commission) | ||||
| Paragraphs 3.47, 3.54, 3.56 and 3.57 says train | all staff, and MANAGERS specifically and separately — the guidance repeatedly treats manager training on handling complaints as a distinct requirement from all-staff awareness training | Training is treated throughout as a core reasonable step. Paragraph 3.56 is the operative one: "It is important to consider the impact of any steps that have been taken to prevent harassment and whether they have been effective. Case law has found that the fact that workers have attended anti-harassment training but have not understood it, or have chosen to ignore it, may be relevant in determining whether the reasonable steps defence has been met (Allay (UK) Ltd v Mr S Gehlen: UKEAT/0031/20/AT)." The worked example that follows holds that training which was "very brief and took place two years ago" may have "become stale" and insufficiently detailed for managers, so the defence is unlikely to be met — with refresher training and sufficient manager-level detail named as the further reasonable steps available. Paragraph 3.54 records a tribunal finding that training would have been an effective means of prevention and that it was reasonable for the employer to incur the cost and lost working day given its size and resources. Paragraph 3.57 confirms the preventative duty in s.40A(1) is a SEPARATE POSITIVE LEGAL DUTY, distinct from the s.109(4) reasonable steps defence. | no interval stated, but training two years old is given as an example of training that may have gone STALE; refresher training and a timetable for it appear throughout the worked examples | Evidence that training was effective — not merely delivered or attended. The guidance also contemplates a documented process for reviewing the effectiveness of policies and training, and a timetable for refreshers. |
| The Civil Service Code (Cabinet Office) | ||||
| The Civil Service Code — core values and the departmental awareness duty says train | all staff — every civil servant in the department or agency | Quoted: "Your department or agency has a duty to make you aware of this Code and its values." The four core values are integrity (putting the obligations of public service above your own personal interests), honesty (being truthful and open), objectivity (basing your advice and decisions on rigorous analysis of the evidence) and impartiality (acting solely according to the merits of the case and serving equally well governments of different political persuasions). Departments must also ensure staff understand the standards of behaviour expected and the procedures for raising concerns about potential breaches. | none specified | none specified |
10 further obligations sit outside Government & Public Sector regulation and bind you as an employer or as a deployer of AI. They are the ones a sector-by-sector review misses, because nobody who reads only their own rulebook ever reaches them.
| Clause | Who must be trained or assessed | What is required | Interval | Evidence required |
|---|---|---|---|---|
| EU AI Act (Reg (EU) 2024/1689) | ||||
| Article 4 (AI literacy) says train | defined population — quoted from the pre-amendment text: "their staff and other persons dealing with the operation and use of AI systems on their behalf" | AS ENACTED: providers and deployers were to take measures to ensure, to their best extent, a sufficient level of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account technical knowledge, experience, education and training, the context of use, and the persons on whom the systems are used. AS AMENDED from 2026-07-27 by the Digital Omnibus on AI: AI literacy remains an obligation on providers and deployers, but no specific or 'sufficient' level is mandated; the Commission and Member States take a stronger role in promoting AI literacy. The obligation on deployers of HIGH-RISK AI systems to ensure staff are trained for human oversight remains in place. | none specified | none specified |
| Article 26(2) says train | named population — the natural persons assigned to exercise human oversight | Quoted: "Deployers shall assign human oversight to natural persons who have the necessary competence, training and authority, as well as the necessary support." | none specified | none specified in this paragraph |
| Employment Rights Act 2025 | ||||
| Whole Act — training provisions at s.65 and related says train | named role — trade union equality representatives, not the general workforce | The Act's training provisions concern whether a trade union equality representative has undergone sufficient training to carry on those activities, with notice requirements on the union and reference to a relevant ACAS or Secretary of State Code of Practice. It is not a mandatory workforce training duty of the kind the rest of this map records. | none specified | Written notice from the trade union to the employer |
| Equality Act 2010 | ||||
| Section 109(4), with section 109(1) case law Allay (UK) Ltd v Gehlen [2021] UKEAT/0031/20 — stale or inadequate training defeats the s.109(4) 'all reasonable steps' defence, making training the operative discharge. | all staff — the defence turns on steps taken to prevent employees doing discriminatory acts | An employer is liable for anything done by a person in the course of their employment. Quoted from 109(4): "In proceedings against A's employer (B) in respect of anything alleged to have been done by A in the course of A's employment it is a defence for B to show that B took all reasonable steps to prevent A—(a) from doing that thing, or (b) from doing anything of that description." | none specified | The employer must SHOW the steps taken. The burden sits with the employer. |
| UK GDPR | ||||
| Article 24, read with Article 5(2) guidance UK GDPR Article 39(1)(b) — read at source 2026-08-12 — names staff training as an element of compliance with the Regulation: the data protection officer must "monitor compliance with this Regulation... including the assignment of responsibilities, awareness-raising and training of staff involved in processing operations, and the related audits". LIMIT OF THIS CITATION, stated plainly: Article 39 applies only where Article 37 requires a DPO to be appointed, so it does not by itself establish a training duty for every controller. It establishes that the Regulation treats staff training as part of compliance. The unconditional citation would be the ICO Accountability Framework, which has NOT been read — see not_yet_searched. | not specified — training is not expressly named in Article 24 | Quoted: "the controller shall implement appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with this Regulation." Those measures must be reviewed and updated where necessary, and are to include appropriate data protection policies where proportionate to the processing activities. Article 5(2) supplies the accountability principle itself: "The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1" — that is, with all six data protection principles: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; and integrity and confidentiality. | measures to be reviewed and updated where necessary — no interval | The controller must be able to DEMONSTRATE compliance. This is the accountability limb. |
| The Regulatory Reform (Fire Safety) Order 2005 | ||||
| Article 21, with articles 3 and 6 says train | all staff — quoted: "his employees" | Quoted, 21(1): the responsible person "must ensure that his employees are provided with adequate safety training (a) at the time when they are first employed; and (b) on their being exposed to new or increased risks because of" transfer or change of responsibilities, new or changed work equipment, new technology, or a new or changed system of work. 21(2): that training must "(a) include suitable and sufficient instruction and training on the appropriate precautions and actions to be taken by the employee in order to safeguard himself and other relevant persons on the premises; (b) be repeated periodically where appropriate; (c) be adapted to take account of any new or changed risks; (d) be provided in a manner appropriate to the risk identified by the risk assessment; and (e) TAKE PLACE DURING WORKING HOURS." | Trigger-based, not periodic: on first employment AND on each of four listed changes. "Repeated periodically where appropriate" — no interval stated. | none specified in the article |
| The Management of Health and Safety at Work Regulations 1999 | ||||
| Regulation 13(2), with 13(1) and 13(3) says train | all staff — every employee, on recruitment and again on each triggering change | Quoted, 13(2): "Every employer shall ensure that his employees are provided with adequate health and safety training— (a) on their being recruited into the employer's undertaking; and (b) on their being exposed to new or increased risks because of— (i) their being transferred or given a change of responsibilities within the employer's undertaking, (ii) the introduction of new work equipment into or a change respecting work equipment already in use within the employer's undertaking, (iii) the introduction of new technology into the employer's undertaking, or (iv) the introduction of a new system of work into or a change respecting a system of work already in use within the employer's undertaking." 13(1) separately requires the employer, "in entrusting tasks to his employees, [to] take into account their capabilities as regards health and safety." | No fixed interval. The duty is TRIGGER-BASED — on recruitment, and on each of the four changes listed in 13(2)(b). | Not specified in the regulation itself. |
| Health and Safety at Work etc. Act 1974 | ||||
| Section 2(2)(c), with section 2(1) says train | all staff — scoped by what is 'necessary to ensure' their health and safety | Quoted, s.2(2)(c): the employer's general duty extends in particular to "the provision of such information, instruction, training and supervision as is necessary to ensure, so far as is reasonably practicable, the health and safety at work of his employees." This is the primary-legislation parent of the MHSWR reg 13 duty. Note the double qualifier: training is owed only so far as it is BOTH 'necessary to ensure' health and safety AND 'reasonably practicable'. | None. The measure is necessity, not interval. | Not specified in the section. |
| Council Directive 89/391/EEC (the Framework Directive) on the introduction of measures to encourage improvements in the safety and health of workers at work | ||||
| Article 12(1) and 12(4) says train | all staff — 'each worker' | Quoted, 12(1): "The employer shall ensure that each worker receives adequate safety and health training, in particular in the form of information and instructions specific to his workstation or job: — on recruitment, — in the event of a transfer or a change of job, — in the event of the introduction of new work equipment or a change in equipment, — in the event of the introduction of any new technology. The training shall be: — adapted to take account of new or changed risks, and — repeated periodically if necessary." Quoted, 12(4): "The training referred to in paragraphs 1 and 3 MAY NOT BE AT THE WORKERS' EXPENSE... The training referred to in paragraph 1 MUST TAKE PLACE DURING WORKING HOURS." | No fixed interval. Trigger-based on four named events, PLUS two standing qualities the UK implementation does not spell out as clearly: adapted to new or changed risks, and "repeated periodically if necessary". | Not specified in Article 12. |
| Article 12(2) says train | named population — workers from OUTSIDE undertakings and/or establishments engaged in work in your undertaking. Contractors, agency staff, visiting engineers, maintenance crews. | Quoted in full: "The employer shall ensure that workers from outside undertakings and/or establishments engaged in work in his undertaking and/or establishment HAVE IN FACT RECEIVED appropriate instructions regarding health and safety risks during their activities in his undertaking and/or establishment." | None — triggered by the outside workers being engaged in work in your undertaking. | Not specified, but note the wording: the employer must ensure they "have in fact received" the instructions. That is a verification duty, not a provision duty — it is not discharged by having issued something. |
Section 7(4) of the Bribery Act requires the Secretary of State to publish guidance, and it is there — not in the statute — that training appears. Principle 5 requires policies to be embedded and understood through internal and external communication, including training, proportionate to the risks faced.
Whatever the format, the training ought to ensure participants develop a firm understanding of what the policies mean in practice for them.
That is a comprehension standard, and an attendance record cannot evidence it.
Section 7 attaches liability to the conduct of associated persons — agents, intermediaries and in some cases suppliers. Principle 5 follows through: general training could be mandatory for new employees or for agents, and it may be appropriate to require associated persons themselves to undergo training, particularly high-risk ones.
GovS 007 does the same for contractors in its awareness activity.
GovS 007 §6.10 splits mandatory from advisory inside a single section: organisations shall ensure new joiners have immediate access to induction material and core learning on security; what that induction contains, and periodic awareness activity, are “should”.
A body running an annual security module and nothing at the point of joining has inverted the standard — done the advisory part, missed the mandatory one. GovS 013 §5.7 is weaker than it is often reported to be: it states no interval at all, and names the senior officer accountable for counter fraud as owner of both the provision of training and the decision on what training is appropriate. Its population expressly includes contractors.
Section 7(2) is a defence: the organisation must prove adequate procedures were in place. The evidential burden sits with the defendant. The preventative duty in section 40A works the same way in substance — assessed backwards, after an incident, against what the employer did before it.
This map states what it did not check as well as what it did. A map that quietly omits its own gaps is worth less than one that marks them.
9 obligations across 9 instruments, each read directly from the published source on 2026-08-10.
Recorded because “we searched and found nothing” is a different fact from “we did not search”.
Their absence is not evidence that they contain no training duty.
Ten minutes on where your obligations actually sit. Fifteen watching a module built live from your own source documents. Five on whether there is a next step. Nothing to prepare and nothing to send beforehand.