Regulations and standards
What regulations and international standards require of training, competence, and evidence, grouped by jurisdiction, with links to the primary sources.
United States
- What AML training does the Bank Secrecy Act require of US financial institutions?
What the Bank Secrecy Act and FinCEN program rules require for AML/CFT training, who must be trained, and the 2026 rule proposal, as at September 2026.
- What are FINRA's continuing education requirements?
FINRA Rule 1240 explained: the annual Regulatory Element, the Firm Element training plan, and the Maintaining Qualifications Program, as at September 2026.
- What does FDA's GMP rule (21 CFR 211.25) require for personnel training?
What 21 CFR 211.25 requires for US drug manufacturing staff training: CGMP and job training, frequency, qualified trainers, as at September 2026.
- What does NIST SP 800-50 say about security awareness and training programs?
What NIST SP 800-50 Rev. 1 (September 2024) says about building a cybersecurity and privacy learning program, and how it links to SP 800-53 AT controls.
- What does the DOJ expect of compliance training in a corporate compliance program?
What the US Department of Justice's Evaluation of Corporate Compliance Programs expects of compliance training and how to evidence it, as at September 2026.
- What hazmat employee training does US DOT require (49 CFR 172.704)?
What 49 CFR 172.704 requires for hazmat employee training: content, the 90-day and three-year rules, testing, records and penalties, as at September 2026.
- What security awareness training does CMMC require of defense contractors?
What CMMC Levels 1, 2 and 3 require for security awareness, role-based and insider threat training, how it is assessed, and the phase-in as at September 2026.
- What sexual harassment training do California and New York require?
California and New York sexual harassment training rules compared: who must train, hours, frequency, content, and records, as at September 2026.
- What training does HIPAA require for the workforce?
What the HIPAA Privacy and Security Rules require for workforce training, timing and records, plus the pending Security Rule update, as at September 2026.
- What training does OSHA require employers to provide?
What US federal OSHA standards require for workplace safety training: triggers, refresher cycles, language, records and penalties, as at September 2026.
United Arab Emirates
- What AML/CFT training does UAE law require?
What Federal Decree-Law No. 10 of 2025 and Cabinet Resolution No. 134 of 2025 require for AML/CFT training, and what the Central Bank expects as evidence.
- What does Abu Dhabi's OSHAD framework (now ADOSH-SF) require for health and safety training?
What Element 5 of Abu Dhabi's OSH System Framework (ADOSH-SF, formerly OSHAD-SF) requires for training, awareness and competency, and how to evidence it.
- What does ADGM's data protection regime expect for staff training?
How the ADGM Data Protection Regulations 2021 treat staff training: DPO duties, security of processing, BCR training terms, and how to evidence it to the ODP.
- What does the DIFC Data Protection Law require for training and awareness?
How the DIFC Data Protection Law 2020 (as amended in 2025) links staff training and awareness to accountability, DPO duties, and evidence for the regulator.
- What does the UAE Information Assurance Regulation require for security awareness training?
What the UAE Information Assurance Regulation's M3 controls require for security awareness and training, who must comply, and how to evidence it.
- What does the UAE Personal Data Protection Law mean for staff training?
What UAE Federal Decree-Law No. 45 of 2021 requires of controllers and processors, why it implies staff training, and who is outside its scope.
- What training and competence rules does the DFSA apply?
How the DFSA Rulebook governs staff competence, 15 hour CPD, AML and cyber training in the DIFC, including the July 2026 fitness and propriety changes.
Japan
- What do Japan's AI Guidelines for Business expect for AI literacy and training?
What Japan's AI Guidelines for Business (Ver1.2) and AI Promotion Act expect for AI literacy and staff education, why it is soft law, and how to evidence it.
- What does Japan's APPI require for employee supervision and training?
What Japan's APPI and the PPC General Rules Guidelines require for employee supervision and education under Articles 23 and 24, and how to evidence it.
- What does Japan's FSA expect for AML/CFT training?
What Japan's Criminal Proceeds Act and the FSA's AML/CFT Guidelines, revised March 2026, require for staff training, and how to evidence it to supervisors.
- What does Japan's GMP ordinance require for personnel training?
What Japan's GMP ordinance (MHLW Ordinance No. 179 of 2004) requires for personnel training under Article 19, including records and effectiveness checks.
- What does Japan's Whistleblower Protection Act require of employers?
What Japan's Whistleblower Protection Act requires of employers: Article 11 systems, designated persons, training, and the changes from December 1, 2026.
- What must employers in Japan do to prevent power harassment?
Japan's power harassment prevention duty from October 1, 2026: Article 31 measures, the MHLW Guideline, training, and new customer harassment duties.
- What safety and health education does Japan's Industrial Safety and Health Act require?
What Japan's Industrial Safety and Health Act requires: hiring and change of work education, special education, foreman education, records and penalties.
European Union
- What does DORA require for ICT security awareness and training?
What DORA Articles 5(4) and 13(6) require for ICT security awareness and resilience training for staff, senior management and the management body.
- What does GDPR require for staff training and awareness?
Where staff training sits in the GDPR: accountability, security, the DPO's monitoring role and binding corporate rules, and how to evidence it.
- What does the EU AI Act require for AI literacy (Article 4)?
What Article 4 of the EU AI Act requires for AI literacy, how the 2026 Digital Omnibus changed it, who enforces it, and how to evidence staff training.
- What does the EU Whistleblower Directive require of organizations?
What Directive (EU) 2019/1937 requires of employers: internal reporting channels, deadlines, confidentiality, anti-retaliation and supporting training.
- What training does NIS2 require of management bodies and staff?
What NIS2 Article 20(2) and Article 21(2)(g) require for management body cybersecurity training and staff awareness, and how Portugal transposed it.
- What training does the EU OSH Framework Directive require?
What Article 12 of EU Directive 89/391/EEC requires for worker safety and health training, who pays, when it must happen, and how to evidence it.
- What training will the EU Anti-Money Laundering Regulation require?
What Regulation (EU) 2024/1624 requires for AML/CFT awareness, ongoing training, and staff assessment from July 10, 2027, and how to prepare evidence.
Portugal
- How many hours of training must employers provide under Portugal's Labor Code?
Portugal's Labor Code gives each worker 40 hours of continuous training a year. How Articles 131 to 134 work: proration, carryover, hour credits, and fines.
- What AML training does Portugal's Law 83/2017 require?
What Article 55 of Portugal's Law 83/2017 requires for AML/CFT training, what Banco de Portugal Notice 1/2022 adds, and how the 2027 EU rules will change it.
- What occupational health and safety training does Portuguese law require?
What Portugal's Labor Code and Law 102/2009 require for occupational safety and health training, information, consultation, and special roles, and the fines.
- What training does Portugal's anti-corruption regime (RGPC) require?
What Article 9 of Portugal's General Regime for the Prevention of Corruption (RGPC) requires for training, who it covers, and what MENAC guidance expects.
Australia
- What AML/CTF training does AUSTRAC require?
What the reformed AML/CTF Act and 2025 Rules require of personnel training, the 2026 commencement dates, and how to evidence training to AUSTRAC.
- What are the AQF levels and how do learning outcomes differ between them?
The 10 AQF levels explained: qualification types, level criteria for knowledge, skills and application, volume of learning, and the new Vocational Degree.
- What do the 2025 Standards for RTOs require of training and assessment?
What the 2025 Standards for RTOs require of training, assessment, validation, RPL and trainer credentials, with clause references and evidence to keep.
- What do the NSQHS Standards require for workforce training?
What the NSQHS Standards (second edition) require for workforce training: Actions 1.19 to 1.25, standard specific actions, and accreditation evidence.
- What do the strengthened Aged Care Quality Standards require for workforce training?
What Outcome 2.9 of the strengthened Aged Care Quality Standards requires for worker training, core topics, competency and records, as at September 2026.
- What does GMP (PIC/S) require for personnel training in Australia?
What the PIC/S Guide to GMP, as adopted by the TGA, requires for personnel training: who must be trained, approved programs, effectiveness checks and records.
- What does the Higher Education Standards Framework require of course design and learning outcomes?
What the HESF Threshold Standards 2021 require of course design, learning outcomes, assessment and course review, with the evidence TEQSA looks for.
- What does the WHS Act require employers to provide in training?
What the model WHS Act and Regulations require of workplace training, how officers must verify it, how Victoria differs, and what evidence shows compliance.
- What privacy training does the Privacy Act and the APPs expect?
What the Privacy Act 1988 and the Australian Privacy Principles expect of staff privacy training, including the 2024 reforms and the agency APP Code.
- What training do Australian whistleblower laws expect?
What Part 9.4AAA of the Corporations Act and ASIC RG 270 expect of whistleblower training for staff, managers and eligible recipients, and how to evidence it.
- What training do NDIS workers need?
What the NDIS Practice Standards, Code of Conduct and 2026 SIL standards require for worker orientation, training, screening and evidence.
- What training does Chain of Responsibility under the HVNL expect?
What the HVNL primary duty and executive due diligence duty mean for Chain of Responsibility training, who needs it, and the evidence the NHVR expects to see.
Bring a subject. Leave with a framework.
A 45-minute working session with our team on a real subject or program you own. You see the system operate on your material, and you keep the framework it produces.
We reply within one business day.