Mandatory Training Requirements for UK Businesses (2026–2027)

Introduction

Mandatory training has always been a grey area for UK businesses. There is no single rulebook, no centralised government checklist and no universal renewal cycle. Instead, employers are expected to navigate a patchwork of legislation, regulatory guidance and best-practice standards, many of which change annually.

For SMBs, this creates confusion. HR and Operations teams often find themselves asking the same questions: What training is actually required by law? How often does it need to be refreshed? What is the difference between "mandatory" and "recommended"? And how do we evidence all of this during an audit or investigation?

This guide cuts through that ambiguity. It explains, in practical terms, what mandatory training UK employers must deliver in 2026–2027, what regulators expect to see, and how businesses can stay compliant without relying on spreadsheets, emails or manual chasing. For a broader view of statutory and organisational requirements across your workforce, see our employee compliance training guide.

October 2026 brings significant changes to harassment obligations. See what's changed for 2026–2027 for the dated list.

What's Changed for 2026–2027

1. What Counts as "Mandatory Training" in the UK?

There is no single legal definition. Mandatory training is any training that an employer is required to provide to ensure employees can work safely, legally and competently.

You will also see the term statutory training. That means training required by specific legislation, such as fire safety or manual handling. Mandatory training is broader: it covers statutory training plus anything your regulator or your own risk assessment requires.

It falls into three categories:

2. Mandatory Training Required for All UK Businesses

These requirements apply across sectors, whatever your size. Some are set out in named legislation; others are what regulators expect to see. Each entry below says which.

The health and safety legislation named below applies in Great Britain, and the Fire Safety Order applies in England and Wales. Scotland has its own fire safety law, and Northern Ireland has its own health and safety and fire safety legislation.

Health & Safety Awareness

Required by: Health and Safety at Work etc. Act 1974; Management of Health and Safety at Work Regulations 1999, regulation 13
Who needs it: All employees

This forms the foundation of workplace competence. It covers hazard awareness, safe working practices, responsibilities and incident reporting. Training is required on recruitment and when exposure to risk changes, and should be repeated periodically where appropriate.

Fire Safety Training

Required by: Regulatory Reform (Fire Safety) Order 2005, article 21 (England and Wales)
Who needs it: All employees

Staff must know evacuation procedures, alarm points, routes, assembly locations and how to respond in an emergency. Fire wardens require additional instruction. Training is required at induction and when risks change, and should be repeated periodically where appropriate.

Sexual Harassment Prevention

Required by: Equality Act 2010 preventative duty (strengthened by the Employment Rights Act 2025 from 30 October 2026)
Who needs it: All workers, with additional training for managers (complaint handling) and customer-facing staff (third-party harassment)

The duty on employers to take reasonable steps to prevent sexual harassment of their workers has applied since 26 October 2024. From 30 October 2026, employers must take all reasonable steps. From the same date, employers are liable for harassment of their workers by third parties unless they have taken all reasonable steps to prevent it.

The Equality and Human Rights Commission (EHRC) can enforce the preventative duty. Where a tribunal finds sexual harassment and a breach of the duty, it can increase compensation by up to 25%. EHRC technical guidance says the duty is anticipatory, no employer is exempt, and risk assessment is central. The law does not list specific steps, but examples of reasonable steps include training for managers and staff on rights and policies, specific training for managers on handling complaints, and a timetable for refresher training.

Sexual harassment training is not a named statutory course. In practice it is very difficult to show compliance without training and records of it. Acas sets out the Employment Rights Act 2025 timeline.

GDPR / Data Protection Training

Required by: Expected by the ICO under UK GDPR accountability and the Data Protection Act 2018 (not named as a standalone training duty for all employees)
Who needs it: Anyone handling personal data, practically every modern employee

UK GDPR does not name staff training as a standalone requirement for all employees. The accountability principle, and the ICO's accountability framework, expect organisations to train staff appropriately and keep evidence. The ICO expects induction training before staff access personal data and within one month of their start date, with refresher training at appropriate intervals.

See our full GDPR Training Requirements Guide for the latest ICO expectations.

Display Screen Equipment (DSE) Training

Required by: Health and Safety (Display Screen Equipment) Regulations 1992
Who needs it: Workers who use screens daily for continuous periods of an hour or more (HSE's definition of a DSE user)

Topics include workstation setup, posture, eye strain, breaks and self-assessment.

Manual Handling Training (where relevant)

Required by: Manual Handling Operations Regulations 1992
Who needs it: Employees lifting, carrying or transporting loads

Not all employees require this, but those performing physical tasks do.

First Aid Awareness

Required by: Health and Safety (First-Aid) Regulations 1981
Who needs it: Determined by your risk assessment

Some workplaces legally require fully trained first aiders. Lower-risk environments may only need an appointed person responsible for first-aid arrangements. First Aid at Work and Emergency First Aid at Work certificates are valid for three years. HSE strongly recommends annual refresher training.

3. Sector-Specific Mandatory Training Requirements (2026–2027)

Some industries have additional training obligations because the risks are higher or more heavily regulated. Below is a practical breakdown by sector.

Retail & Multi-Site Stores

Retail roles often involve physical work, public interaction and legal compliance obligations.

Common requirements include:

• Health and safety
• Fire safety
• Manual handling
• GDPR
• Harassment prevention for customer-facing staff (third-party harassment from 30 October 2026)
• Age-restricted product training (alcohol, tobacco, knives)
• Stockroom and warehouse safety
• Lone working awareness

Retailers are regularly asked to evidence training following incidents or local authority inspections.

For premises where 200 or more people may be present, Martyn's Law is expected in spring 2027. The Security Industry Authority will regulate public protection procedures (evacuation, invacuation, lockdown and communication). Staff will need to know those procedures; the Act does not itself mandate a named training course.

Hospitality & Catering

Food businesses must meet food hygiene law, enforced by local authorities, with guidance from the Food Standards Agency (Food Standards Scotland in Scotland).

Typical mandatory training includes:

• Food safety / food hygiene appropriate to the role (Levels 1–3 are common practice, not statutory labels)
• Fire safety
• Health and safety
• Manual handling
• Allergens awareness
• Harassment prevention for customer-facing staff (third-party harassment from 30 October 2026; hospitality is high risk for customer harassment)
• Licensing law (where relevant)

Food business operators must ensure food handlers are supervised and instructed or trained in food hygiene appropriate to their work. There is no statutory refresh interval. Three years is a widely used industry convention, and many hospitality businesses refresh annually.

Learn more in our Food Safety Training Requirements Guide.

Venues where 200 or more people may be present should also prepare for Martyn's Law from spring 2027.

Education (Schools, Colleges & MATs)

Training requirements are shaped by Ofsted, local safeguarding partnerships and Department for Education guidance, including Keeping Children Safe in Education (KCSIE) 2026.

KCSIE is statutory guidance for schools and colleges in England, including maintained nursery schools. Standalone nurseries, childminders and other early years providers follow the EYFS safeguarding requirements, and Wales, Scotland and Northern Ireland have their own guidance.

KCSIE 2026 took effect on 1 September 2026. All staff should receive safeguarding and child protection training at induction, regularly updated, plus updates at least annually. All staff are expected to read Part One of KCSIE in full. Training includes online safety, covering filtering and monitoring roles and responsibilities.

Essential training includes:

• Safeguarding / child protection
• Online safety, including filtering and monitoring responsibilities
• Prevent Duty
• Fire safety
• First aid / paediatric first aid
• Health and safety
• GDPR and data handling
• Behaviour management (role-dependent)

The Designated Safeguarding Lead and deputies should have their training updated at least every two years. That DSL cycle is separate from the at-least-annual updates expected for all staff under KCSIE 2026.

Health & Social Care (CQC Regulated Services)

CQC-regulated services have one of the clearest mandatory training lists in the UK, and CQC expects staff to demonstrate competence, not just attendance.

Core requirements include:

• Safeguarding (adults and children)
• Learning disability and autism training (statutory for all CQC-registered providers)
• Infection prevention and control
• Moving and handling (people handling)
• Medication awareness
• Basic life support
• Fire safety
• Food hygiene
• Health and safety
• GDPR
• Complaints handling

Since 1 July 2022, under the Health and Care Act 2022, all CQC-registered providers must ensure staff receive learning disability and autism training appropriate to their role. The Oliver McGowan Code of Practice commenced on 6 September 2025. The Oliver McGowan Mandatory Training is the government's preferred and recommended training, but the law does not mandate a single course. The legal requirement does not itself set a refresh period.

CQC regulates services in England. Care services in Wales, Scotland and Northern Ireland have separate regulators.

CQC assesses staff training under Regulation 18 (Staffing), so providers need records showing the right training was completed.

Construction & Site-Based Work

Construction and maintenance work carries elevated physical and asbestos risks, plus site access controls set by principal contractors and clients.

Common requirements include:

• Site induction (CDM 2015, regulation 13: principal contractor must ensure a suitable site induction)
• Health and safety
• Working at height
• Manual handling
• Asbestos awareness (Control of Asbestos Regulations 2012, regulation 10, for workers liable to disturb asbestos). HSE says a full awareness course does not need repeating every year, but a suitable refresher should be given, which can form part of other health and safety updates
• Fire safety
• Harassment prevention (including towards and from contractors and visitors)
• CSCS cards (industry scheme required by most principal contractors and clients; not a legal requirement)

Site-based employers are routinely asked to evidence induction and competence training before workers access site. Keeping those records current and easy to retrieve is part of day-to-day site control, not only audit season.

Office-Based & Hybrid Workplaces

Often overlooked, but the core duties (health and safety, fire safety, DSE and data protection) still apply.

Key training includes:

• GDPR
• Sexual harassment prevention
• Cyber security awareness
• Fire safety
• Health and safety
• DSE self-assessments
• Phishing awareness training for employees
• Social engineering training for employees
• CEO fraud training
• Data breach training

The first six are core legal duties. The cyber security topics are good practice for most office environments rather than named legal requirements.

Remote employees must still complete mandatory training regardless of location.

4. How Often Mandatory Training Must Be Renewed (2026–2027)

There is no universal renewal standard. Most cycles in the table below are good practice, not statutory deadlines: the law usually requires training at induction, when risks change, and periodically. Regulators and insurers look for a consistent, evidenced cycle.

Most SMBs fall short not because they don't deliver training, but because they don't track renewal cycles reliably.

5. Penalties for Failing to Provide Mandatory Training

When incidents occur or regulators investigate, training evidence is often the first thing they request.

Consequences can include:

• Unlimited fines following HSE prosecution for health and safety failures
• ICO enforcement for GDPR failures
• Fire safety prosecutions
• CQC enforcement action, such as requirement or warning notices, and poor inspection outcomes
• EHRC enforcement action, and compensation uplifts of up to 25% in sexual harassment claims where the preventative duty was breached
• For incidents on or after 1 October 2026, most tribunal claims can be brought up to six months later, so gaps in records stay exposed for longer
• Difficulty defending insurance or liability claims without training records
• Civil liability following injuries
• Reputational damage

Many SMBs don't appreciate this until an investigation happens, at which point it's too late to rebuild training records.

6. Why UK SMBs Struggle With Mandatory Training

Mandatory training is rarely difficult to understand, but it is difficult to manage manually.

Most businesses still rely on a patchwork of:

• spreadsheets
• email chases
• outdated certificates
• inconsistent onboarding
• managers "remembering" to assign training

This creates missed renewals, inconsistent evidence and avoidable compliance failures.

The complexity grows rapidly with higher staff turnover, multiple sites or changing job roles.

Compliance doesn't fail because training is difficult. It fails because manual processes don't scale.

7. How UK SMBs Can Automate Mandatory Training (and Stay Audit-Ready Every Day)

The businesses that remain consistently compliant aren't the ones who work harder. They're the ones who automate.

Automation eliminates the two biggest root causes of compliance failure: human error and inconsistent process.

A modern SMB-focused LMS handles:

• automatic training assignment based on role, department or location
• automatic reassignment in the renewal window before certificates expire
• automatic reminders, overdue notifications and escalation
• instant manager visibility
• Microsoft 365 user sync (new starters added automatically, leavers removed)
• certificates and evidence stored centrally
• audit-ready reports
• tracking site inductions and external qualifications (such as CSCS cards) alongside in-platform training

With automation in place, mandatory training becomes predictable, consistent and audit-ready, without adding any admin burden to HR or Operations teams.

Learn more about How to Build a High-Performing Compliance Training Programme and how automation transforms training management.

Conclusion

From October 2026, the harassment preventative duty rises to all reasonable steps, employers become liable for third-party harassment, and most employment tribunal time limits move to six months. Those changes make documented prevention and retrievable training records harder to ignore.

Mandatory training isn't going away in 2026–2027, but the admin can. TrainMeUK assigns training by role, reassigns it in the renewal window before certificates expire, reminds staff automatically, and stores certificates and audit-ready reports in one place. See our Best LMS for Small Businesses UK (2026 Guide). For which platforms include the mandatory courses themselves, see LMS with built-in UK compliance courses.

Frequently Asked Questions: Mandatory Training Requirements for UK Businesses (2026–2027)

Common questions about mandatory training requirements, renewal cycles, and compliance for UK businesses. Click on any question to expand the answer.