6 training duties across 4 instruments binding Professional Services, plus 10 that bind you whatever your sector — statute, rulebook, statutory guidance and licence conditions. Every one traced to its clause, its date and its published source, and each one labelled with what makes it a training duty.
Your AML training is probably fine. The written record it requires, and the agents it reaches, are usually the parts that are not.
Professional services carries fewer training duties than the industrial sectors, and they are drafted very differently. The binding ones do not tell you what to teach or how often — they tell you who must be covered, and in one case that you must be able to produce a record of it.
The other feature of this sector is duplication that is not duplication: the firm owes a corporate competence duty and every individual owes a personal one, in two separate rulebooks. One programme does not discharge both, and neither is evidenced by the same artefact.
Each clause carries a label saying why it is a training duty. Where the instrument does not use the word, we cite the guidance or the case that makes training the way you discharge it. Where we cannot cite anyone, it is not listed as a training duty at all.
| Clause | Who must be trained or assessed | What is required | Interval | Evidence required |
|---|---|---|---|---|
| Money Laundering Regulations 2017 | ||||
| Regulation 24(1)(a) and 24(1)(b), with regulation 8(2)(d) and regulation 12(1) says train | named role — 'relevant employees', defined at 24(2) as employees whose work is relevant to the firm's compliance with the Regulations, or otherwise capable of contributing to identifying or mitigating money laundering risk, or to preventing or detecting it. Extended by amendment to any AGENTS the firm uses whose work is of that kind. | Quoted, 24(1): a relevant person must "(a) take appropriate measures to ensure that its relevant employees [and any agents it uses...] are— (i) made aware of the law relating to money laundering, terrorist financing and proliferation financing, and to the requirements of data protection, which are relevant to the implementation of these Regulations; and (ii) regularly given training in how to recognise and deal with transactions and other activities or situations which may be related to money laundering, terrorist financing or proliferation financing; (b) maintain a record in writing of the measures taken under sub-paragraph (a), and in particular, of the training given to its relevant employees". | "Regularly" — no interval is stated. 24(3) requires the measures to be appropriate to the nature and size of the business and the risks it faces, and permits regard to be had to FCA guidance or to guidance issued by a supervisory authority and approved by the Treasury. | EXPRESS. 24(1)(b) requires a WRITTEN RECORD of the measures taken and, in particular, of the training given. This is one of the few UK training duties that expressly mandates a record. |
| Regulation 21(1)(b), with 21(2)(a) competence | named role — 'relevant employees', defined at 21(2)(b) by function, the same test as reg 24(2) | Quoted, 21(1)(b): a relevant person must "carry out screening of relevant employees appointed by the relevant person, BOTH BEFORE THE APPOINTMENT IS MADE AND DURING THE COURSE OF THE APPOINTMENT". And 21(2)(a) defines what screening is: "an assessment of— (i) the SKILLS, KNOWLEDGE AND EXPERTISE of the individual to carry out their functions effectively; (ii) the conduct and integrity of the individual." So the duty is a competence assessment, and it is a continuing one. | No interval, but expressly continuing — 'during the course of the appointment', not only at its start. | Not specified in reg 21 itself. |
| SRA Code of Conduct for Firms (SRA Standards and Regulations) | ||||
| Paragraph 4.3 (section 4, Service and competence) competence | all staff — expressly 'your managers and employees', not only solicitors or fee-earners | Quoted in full: "You ensure that your managers and employees are competent to carry out their role, and keep their professional knowledge and skills, as well as understanding of their legal, ethical and regulatory obligations, up to date." Three limbs, not one: competence for the role; professional knowledge and skills kept current; and understanding of legal, ethical and regulatory obligations kept current. | None. The SRA replaced the former 16-hour annual CPD requirement with an outcomes-based continuing competence regime; no minimum hours are specified in this paragraph. | Not specified in paragraph 4.3 itself. |
| SRA Code of Conduct for Solicitors, RELs, RFLs and RSLs (SRA Standards and Regulations) | ||||
| Paragraph 3.3, with 3.5 (section 3, Service and competence) competence | named role — each individual regulated person, in respect of themselves | Quoted, 3.3: "You maintain your competence to carry out your role and keep your professional knowledge and skills up to date." Paragraph 3.5 adds, for those supervising or managing others providing legal services, that "you remain accountable for the work carried out". | None. No minimum hours. | Not specified in paragraph 3.3 itself. |
| Paragraph 3.6, with 3.5 competence | the individuals that solicitor manages | Quoted, 3.6: "You ensure that the individuals you manage are competent to carry out their role, and keep their professional knowledge and skills, as well as understanding of their legal, ethical and regulatory obligations, up to date." Quoted, 3.5: "Where you supervise or manage others providing legal services: (a) you remain accountable for the work carried out through them; and (b) you effectively supervise work being done for clients." | None. No minimum hours. | Not specified in the paragraph. |
| Directive (EU) 2015/849 (the Fourth Anti-Money Laundering Directive) | ||||
| Article 46(1) says train | named population — the obliged entity's employees | Quoted, Article 46(1): "Member States shall require that obliged entities take measures PROPORTIONATE TO THEIR RISKS, NATURE AND SIZE so that their employees are aware of the provisions adopted pursuant to this Directive, INCLUDING RELEVANT DATA PROTECTION REQUIREMENTS. Those measures shall include participation of their employees in SPECIAL ONGOING TRAINING PROGRAMMES to help them recognise operations which may be related to money laundering or terrorist financing and to instruct them as to how to proceed in such cases." | No interval, but the wording is stronger than the UK's: 'special ongoing training programmes'. 'Ongoing' and 'programmes' describe a standing arrangement, where MLR 2017 reg 24(1)(a)(ii) says only 'regularly given training'. | Article 46(1) does NOT contain the express written-record duty that MLR 2017 reg 24(1)(b) imposes. That is a UK addition on top of the Directive. |
10 further obligations sit outside Professional Services regulation and bind you as an employer or as a deployer of AI. They are the ones a sector-by-sector review misses, because nobody who reads only their own rulebook ever reaches them.
| Clause | Who must be trained or assessed | What is required | Interval | Evidence required |
|---|---|---|---|---|
| EU AI Act (Reg (EU) 2024/1689) | ||||
| Article 4 (AI literacy) says train | defined population — quoted from the pre-amendment text: "their staff and other persons dealing with the operation and use of AI systems on their behalf" | AS ENACTED: providers and deployers were to take measures to ensure, to their best extent, a sufficient level of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account technical knowledge, experience, education and training, the context of use, and the persons on whom the systems are used. AS AMENDED from 2026-07-27 by the Digital Omnibus on AI: AI literacy remains an obligation on providers and deployers, but no specific or 'sufficient' level is mandated; the Commission and Member States take a stronger role in promoting AI literacy. The obligation on deployers of HIGH-RISK AI systems to ensure staff are trained for human oversight remains in place. | none specified | none specified |
| Article 26(2) says train | named population — the natural persons assigned to exercise human oversight | Quoted: "Deployers shall assign human oversight to natural persons who have the necessary competence, training and authority, as well as the necessary support." | none specified | none specified in this paragraph |
| Employment Rights Act 2025 | ||||
| Whole Act — training provisions at s.65 and related says train | named role — trade union equality representatives, not the general workforce | The Act's training provisions concern whether a trade union equality representative has undergone sufficient training to carry on those activities, with notice requirements on the union and reference to a relevant ACAS or Secretary of State Code of Practice. It is not a mandatory workforce training duty of the kind the rest of this map records. | none specified | Written notice from the trade union to the employer |
| Equality Act 2010 | ||||
| Section 109(4), with section 109(1) case law Allay (UK) Ltd v Gehlen [2021] UKEAT/0031/20 — stale or inadequate training defeats the s.109(4) 'all reasonable steps' defence, making training the operative discharge. | all staff — the defence turns on steps taken to prevent employees doing discriminatory acts | An employer is liable for anything done by a person in the course of their employment. Quoted from 109(4): "In proceedings against A's employer (B) in respect of anything alleged to have been done by A in the course of A's employment it is a defence for B to show that B took all reasonable steps to prevent A—(a) from doing that thing, or (b) from doing anything of that description." | none specified | The employer must SHOW the steps taken. The burden sits with the employer. |
| UK GDPR | ||||
| Article 24, read with Article 5(2) guidance UK GDPR Article 39(1)(b) — read at source 2026-08-12 — names staff training as an element of compliance with the Regulation: the data protection officer must "monitor compliance with this Regulation... including the assignment of responsibilities, awareness-raising and training of staff involved in processing operations, and the related audits". LIMIT OF THIS CITATION, stated plainly: Article 39 applies only where Article 37 requires a DPO to be appointed, so it does not by itself establish a training duty for every controller. It establishes that the Regulation treats staff training as part of compliance. The unconditional citation would be the ICO Accountability Framework, which has NOT been read — see not_yet_searched. | not specified — training is not expressly named in Article 24 | Quoted: "the controller shall implement appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with this Regulation." Those measures must be reviewed and updated where necessary, and are to include appropriate data protection policies where proportionate to the processing activities. Article 5(2) supplies the accountability principle itself: "The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1" — that is, with all six data protection principles: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; and integrity and confidentiality. | measures to be reviewed and updated where necessary — no interval | The controller must be able to DEMONSTRATE compliance. This is the accountability limb. |
| The Regulatory Reform (Fire Safety) Order 2005 | ||||
| Article 21, with articles 3 and 6 says train | all staff — quoted: "his employees" | Quoted, 21(1): the responsible person "must ensure that his employees are provided with adequate safety training (a) at the time when they are first employed; and (b) on their being exposed to new or increased risks because of" transfer or change of responsibilities, new or changed work equipment, new technology, or a new or changed system of work. 21(2): that training must "(a) include suitable and sufficient instruction and training on the appropriate precautions and actions to be taken by the employee in order to safeguard himself and other relevant persons on the premises; (b) be repeated periodically where appropriate; (c) be adapted to take account of any new or changed risks; (d) be provided in a manner appropriate to the risk identified by the risk assessment; and (e) TAKE PLACE DURING WORKING HOURS." | Trigger-based, not periodic: on first employment AND on each of four listed changes. "Repeated periodically where appropriate" — no interval stated. | none specified in the article |
| The Management of Health and Safety at Work Regulations 1999 | ||||
| Regulation 13(2), with 13(1) and 13(3) says train | all staff — every employee, on recruitment and again on each triggering change | Quoted, 13(2): "Every employer shall ensure that his employees are provided with adequate health and safety training— (a) on their being recruited into the employer's undertaking; and (b) on their being exposed to new or increased risks because of— (i) their being transferred or given a change of responsibilities within the employer's undertaking, (ii) the introduction of new work equipment into or a change respecting work equipment already in use within the employer's undertaking, (iii) the introduction of new technology into the employer's undertaking, or (iv) the introduction of a new system of work into or a change respecting a system of work already in use within the employer's undertaking." 13(1) separately requires the employer, "in entrusting tasks to his employees, [to] take into account their capabilities as regards health and safety." | No fixed interval. The duty is TRIGGER-BASED — on recruitment, and on each of the four changes listed in 13(2)(b). | Not specified in the regulation itself. |
| Health and Safety at Work etc. Act 1974 | ||||
| Section 2(2)(c), with section 2(1) says train | all staff — scoped by what is 'necessary to ensure' their health and safety | Quoted, s.2(2)(c): the employer's general duty extends in particular to "the provision of such information, instruction, training and supervision as is necessary to ensure, so far as is reasonably practicable, the health and safety at work of his employees." This is the primary-legislation parent of the MHSWR reg 13 duty. Note the double qualifier: training is owed only so far as it is BOTH 'necessary to ensure' health and safety AND 'reasonably practicable'. | None. The measure is necessity, not interval. | Not specified in the section. |
| Council Directive 89/391/EEC (the Framework Directive) on the introduction of measures to encourage improvements in the safety and health of workers at work | ||||
| Article 12(1) and 12(4) says train | all staff — 'each worker' | Quoted, 12(1): "The employer shall ensure that each worker receives adequate safety and health training, in particular in the form of information and instructions specific to his workstation or job: — on recruitment, — in the event of a transfer or a change of job, — in the event of the introduction of new work equipment or a change in equipment, — in the event of the introduction of any new technology. The training shall be: — adapted to take account of new or changed risks, and — repeated periodically if necessary." Quoted, 12(4): "The training referred to in paragraphs 1 and 3 MAY NOT BE AT THE WORKERS' EXPENSE... The training referred to in paragraph 1 MUST TAKE PLACE DURING WORKING HOURS." | No fixed interval. Trigger-based on four named events, PLUS two standing qualities the UK implementation does not spell out as clearly: adapted to new or changed risks, and "repeated periodically if necessary". | Not specified in Article 12. |
| Article 12(2) says train | named population — workers from OUTSIDE undertakings and/or establishments engaged in work in your undertaking. Contractors, agency staff, visiting engineers, maintenance crews. | Quoted in full: "The employer shall ensure that workers from outside undertakings and/or establishments engaged in work in his undertaking and/or establishment HAVE IN FACT RECEIVED appropriate instructions regarding health and safety risks during their activities in his undertaking and/or establishment." | None — triggered by the outside workers being engaged in work in your undertaking. | Not specified, but note the wording: the employer must ensure they "have in fact received" the instructions. That is a verification duty, not a provision duty — it is not discharged by having issued something. |
1 provisions that sit alongside the duties above without themselves requiring training. They are here because they are the ones most often mistaken for training duties, or most often missed when scoping them. We separate them rather than pad the count.
| Clause | Who it concerns | What is required | Interval | Evidence required |
|---|---|---|---|---|
| Money Laundering Regulations 2017 | ||||
| Regulation 19(1)(c)(iii) related | not applicable — this is a communication and record duty, not a training duty | Quoted, 19(1)(c): a relevant person must "maintain a record in writing of— (i) the policies, controls and procedures established under sub-paragraph (a); (ii) any changes to those policies, controls and procedures made as a result of the review and update required by sub-paragraph (b); and (iii) THE STEPS TAKEN TO COMMUNICATE THOSE POLICIES, CONTROLS AND PROCEDURES, OR ANY CHANGES TO THEM, WITHIN THE RELEVANT PERSON'S BUSINESS." READ AT SOURCE: regulation 19 does not use the word 'training' anywhere. This is recorded because it is the duty most often conflated with the reg 24 training duty, and it is a different one. | None, but tied to the review-and-update cycle in 19(1)(b). | EXPRESS — a written record of the communication steps. |
Regulation 24(1)(b) of the Money Laundering Regulations 2017 requires the firm to “maintain a record in writing of the measures taken… and in particular, of the training given to its relevant employees”.
This is one of very few UK training duties where the record is written into the obligation itself. A firm that trains well and records loosely is not weakly compliant — it is in breach of a limb of regulation 24 that most training matrices do not know exists.
Two scope surprises sit in the same regulation. The duty was extended by amendment to agents the firm uses whose work is of the relevant kind — people who are not on the staff list the training matrix was built from.
And the population is not ‘everyone’. Regulation 24(2) defines a relevant employee by function: work relevant to the firm’s compliance, or otherwise capable of contributing to identifying, mitigating, preventing or detecting money laundering. That test catches support roles nobody classes as fee-earners, and excludes some who are.
Regulation 8(2)(d) applies the Regulations to independent legal professionals — but regulation 12(1) defines that term narrowly. It bites only when the firm participates in one of five listed activities: buying and selling real property or business entities; managing client money, securities or other assets; opening or managing accounts; organising contributions for the creation, operation or management of companies; or the creation, operation or management of trusts, companies or foundations.
We record the limit rather than assert the duty universally. A firm doing none of those is outside regulation 24 on this route — and still inside SRA Code of Conduct for Firms 4.3, which has no such carve-out.
Code for Firms 4.3 makes the firm ensure that “your managers and employees are competent to carry out their role, and keep their professional knowledge and skills, as well as understanding of their legal, ethical and regulatory obligations, up to date.”
Code for Solicitors 3.3 separately makes each individual “maintain your competence to carry out your role and keep your professional knowledge and skills up to date.”
Note what 4.3 reaches that a CPD framework does not: it is owed to managers and employees generally, and its third limb is the compliance layer — so finance, HR, IT and business development are inside it.
And there is a third. Code for Solicitors 3.6 makes the individual who supervises or manages others personally responsible for ensuring “the individuals you manage are competent to carry out their role”. A firm-wide programme discharges 4.3 and can still leave a named supervisor exposed on 3.6, because 3.6 attaches to the person doing the managing.
Regulation 21(1)(b) of the Money Laundering Regulations requires screening of relevant employees “both before the appointment is made and during the course of the appointment”.
And 21(2)(a) says what screening is: “an assessment of— (i) the skills, knowledge and expertise of the individual to carry out their functions effectively; (ii) the conduct and integrity of the individual.”
So it is a continuing competence assessment, not a hiring check. It is run almost everywhere as pre-employment vetting — references, a DBS check, a conflicts search — and then closed. It sits with HR, which is precisely why nobody reads it as a competence obligation.
Regulation 24(1)(b) requires a written record of the training given.
Regulation 19(1)(c)(iii) separately requires a written record of “the steps taken to communicate those policies, controls and procedures, or any changes to them, within the relevant person’s business”. Regulation 19 does not use the word training anywhere — we read all of it.
Rolling out a policy change by email and logging it in the LMS satisfies neither cleanly. The first is not training; the second is not a communication record.
This map states what it did not check as well as what it did. A map that quietly omits its own gaps is worth less than one that marks them.
6 obligations across 4 instruments, each read directly from the published source on 2026-08-12.
Recorded because “we searched and found nothing” is a different fact from “we did not search”.
Their absence is not evidence that they contain no training duty.
Ten minutes on where your obligations actually sit. Fifteen watching a module built live from your own source documents. Five on whether there is a next step. Nothing to prepare and nothing to send beforehand.