Compliance training for employees in every language

A safety instruction in Germany counts only if the employee understood it. The accident insurers’ rule DGUV Regel 100-001, in its June 2025 edition, says instruction must come in an understandable form and language. Handing out the rules is not enough. The employer has to make sure the content was understood, and where words fail, the rule names sketches, photos or videos.

The United States says the same in its own vocabulary. OSHA’s 2010 training policy statement requires instruction in a language and vocabulary employees can understand. The Justice Department asks prosecutors whether compliance training was offered “in the form and language appropriate for the audience”.

That is the part most compliance training for employees leaves out. By the end you will know which topics are mandatory where, how often each one comes back and what an auditor will ask to see. You will also know how to deliver one module to a workforce that speaks several languages, with the proof held in the right system.

Key takeaways

• German accident insurers’ DGUV Vorschrift 1 requires documented safety instruction at least once a year. It must come in a form and language the employee understands, and understanding must be checked.
• OSHA has required training in a language and vocabulary employees understand since its 2010 policy statement. New York wants harassment materials in each employee’s primary language where a state template exists.
• The GDPR contains no clause that says “train every employee annually”. The duty follows from Art. 39(1)(b), Art. 32(4) and the accountability rule in Art. 5(2).
• Deadlines differ by topic. Harassment prevention comes every 2 years in California and every year in New York. German hazardous-substance instruction comes before work starts, then annually, signed.
• In June 2025, 16.7 percent of employees subject to social insurance in Germany had no German citizenship, per Federal Employment Agency data. Citizenship is not language, but it signals a multilingual workforce.
• One module can carry every language of your workforce behind one link. AI-powered translation covers 200+ languages, and each track can stay private until a person has reviewed it.

Compliance training for employees, defined

Compliance training for employees is structured instruction on the laws, regulations and internal policies that apply to a person’s job. It runs on a schedule the law or the company sets, comes in a form the employee can understand, and is documented so the employer can show it happened.

Two kinds of rule feed it. Regulatory compliance covers the duties a statute or a regulator imposes, such as safety instruction or anti-money-laundering training. Corporate compliance covers your own code of conduct and policies. Those often go further than the law.

Every program has three jobs. It has to reach every employee in a language they understand. It has to prove who completed which version. And it has to meet the deadline, whether the law sets it or you do. Most programs are built around the second and third job. The first is where they quietly fail.

The US Sentencing Guidelines have carried this structure since 2004: §8B2.1(b)(4) counts effective training programs, matched to each person’s role, as one element of an effective compliance program. Training is not the whole program, but it is one load-bearing part.

One thing is missing from the map below on purpose. Diversity, equity and inclusion programs are a policy choice in most jurisdictions, not a legal training duty. They belong with corporate compliance, so they do not appear in the legal overview.

In short: a compliance program reaches people, proves who was trained on what, and meets its deadlines. Training is one required element of that program, and language decides whether it works.

Which compliance trainings are mandatory

The core topics are the same on both sides of the Atlantic. The anchors differ, and so do the clocks.

Health and safety instruction

The EU framework directive of 1989 is the root of every national rule. Art. 12 of Directive 89/391/EEC requires training on recruitment, on a transfer or change of job, on new work equipment and on new technology. It is repeated periodically if necessary. Germany turns that into §12 ArbSchG, with one detail that matters for agency staff: for temporary agency workers, the hirer instructs, not the agency.

§12 also asks for instruction that is sufficient and appropriate, given during working time. A slide deck to read at home on a Sunday is hard to square with either. DGUV Vorschrift 1 adds the floor of once a year. The UK’s 1999 regulations ask for comprehensible and relevant information. In the US, OSHA’s Hazard Communication standard requires training at initial assignment and whenever a new chemical hazard arrives.

Data protection and information security

The GDPR has no literal annual-training clause, so the duty is assembled from three articles. Art. 39(1)(b) makes training of staff a task the data protection officer monitors. Art. 32(4) requires that anyone with access to personal data processes it only on instructions. Art. 5(2) makes you answerable for demonstrating all of it.

Security rules are more direct. NIS2 requires management bodies to follow training and encourages the same for employees. Its Art. 21(2)(g) lists cybersecurity training among the required risk measures. Germany’s NIS2 law has applied since 6 December 2025 and covers about 29,500 entities, according to the BSI. Its §38 obliges management to train regularly and does not name employees. DORA goes furthest: since 17 January 2025, security awareness is a compulsory module for all staff of EU financial entities.

Harassment and discrimination

California requires employers with five or more employees to train supervisors for at least two hours and other staff for at least one hour, every two years (Gov. Code §12950.1). The law asks for “classroom or other effective interactive training”. For e-learning, the state’s regulation 2 CCR §11024 adds a practical condition: a trainer must answer learners’ questions within two business days. New York requires annual, interactive training for every employee under Labor Law §201-g. At the federal level, the EEOC rescinded its 2024 harassment guidance in January 2026, which leaves the state rules as the firm reference for content and rhythm.

In Germany, AGG §12(2) works the other way round. An employer who has trained staff suitably to prevent discrimination is treated as having met its duty to take preventive measures.

Financial crime, whistleblowing and AI literacy

Germany’s Money Laundering Act requires obliged entities to train staff initially and on an ongoing basis, on typologies and current methods of money laundering and terrorist financing (§6(2) no. 6 GwG). In the US, prosecutors read your code-of-conduct training against the Sentencing Guidelines and the DOJ’s 2024 evaluation questions. In the UK, the failure to prevent fraud offence has applied to large organisations since 1 September 2025. The Home Office guidance lists communication, including training, among its six principles.

Germany’s Whistleblower Protection Act does not require you to train every employee. Employers with 50 or more staff must run an internal reporting office, and the people staffing it need the necessary expertise (§§12 and 15 HinSchG). For everyone else, whistleblowing is communication. Where do I report, and how?

The AI Act’s literacy duty in Art. 4 has applied since 2 February 2025. Since the Digital Omnibus amendment of July 2026, it asks for measures that support the AI literacy of your staff, without guaranteeing a specific level for each person.

In short: safety instruction, data protection, harassment prevention, financial crime and security form the core. The law names some cycles, the GDPR names none, and sector rules such as HIPAA and DORA add to the map.

How often employees need compliance training

Most rules start with an event, not a date, and the calendar comes second.

The events that start the clock

The EU framework directive names four events: recruitment, a transfer or change of job, new work equipment and new technology. The UK’s Management of Health and Safety at Work Regulations 1999 say the same in reg. 13, on recruitment and on exposure to new or increased risks, repeated periodically where appropriate. OSHA’s Hazard Communication standard trains at initial assignment. It trains again whenever a new chemical hazard enters the work area. Germany’s Hazardous Substances Ordinance, GefStoffV §14, asks for instruction before work starts.

Your own company adds three events the law rarely names. Onboarding. A policy change. An incident, or a near miss that shows the last module did not land. Each deserves a short module, not a full rerun of the annual course.

Annual compliance training for employees: rule or habit?

Both, depending on the topic. Annual is the law for German safety instruction under DGUV Vorschrift 1, which must be documented. It is the law for hazardous substances under GefStoffV, confirmed by signature, and for work equipment under BetrSichV, with names and dates. New York sets the same rhythm for harassment prevention. California sets two years instead, plus training within six months of hire or of becoming a supervisor.

Elsewhere, annual is habit. HIPAA requires training new workforce members within a reasonable period and names no yearly cycle. Annual refreshers are common practice there, not rule text. NIS2 and the German BSIG say “regularly” and stop.

The habit is a good one. An annual calendar is the sensible default wherever the law is silent. Just know which dates are yours and which are the regulator’s.

One more rule shapes the format. In the EU, training the law requires is free for the employee and counts as working time (Directive 2019/1152 Art. 13, in Germany §111 GewO). The 1989 framework directive already placed safety training inside working hours. Short modules that fit into a shift are not a convenience. They are how you comply without a classroom day.

In short: an event starts the clock, a cycle keeps it running, and the record has to outlive both.

Language is part of the requirement

Topics and deadlines are only half of the rule. The other half is how the message arrives.

What the law says about language

The German accident insurers are the most explicit. DGUV Regel 100-001 requires instruction in an understandable form and language. It says that handing out rules or regulations alone is not enough. Where verbal communication falls short, it names sketches, photos or videos. The employer must make sure the content was understood, for example by asking questions, having the employee demonstrate the task or watching them work. GefStoffV and BetrSichV use the same phrase: understandable form and language.

OSHA’s 2010 policy statement is just as plain. “If an employee does not speak or comprehend English, instruction must be provided in a language the employee can understand.” The DOJ’s 2024 evaluation guidance carries the idea beyond safety, to every compliance topic. It asks whether training was offered in the form and language appropriate for the audience.

New York is the most specific. Labor Law §201-g requires the harassment policy and training information in English and in the language each employee names as their primary one, wherever the state provides a template in that language. Otherwise an English notice complies. The state’s templates cover at least eight languages besides English. California’s civil rights department offers its own courses in six languages. The UK asks for “comprehensible” information.

A completed module in a language the employee does not understand is a record, not proof.

Who in your workforce needs another language

More people than your HR system shows. In June 2025, 16.7 percent of employees subject to social insurance in Germany had no German citizenship, about 5.8 million people, according to Federal Employment Agency data. In temporary agency work the share was about half. In hospitality it was about 45 percent. Citizenship is not language, so read this as a signal, not a count of people who do not speak German.

The household numbers point the same way. Destatis found that 6 percent of the population in private households spoke no German at home in 2023, and 17 percent were multilingual. In the US, 19.1 percent of the civilian labor force was foreign-born in 2025, according to the BLS. The Census Bureau’s 2018 to 2022 survey found 21.7 percent of people aged five and over speaking a language other than English at home.

Risk concentrates as well. The BLS counted 5,070 fatal work injuries in 2024. Hispanic or Latino workers died at a rate of 4.3 per 100,000 full-time equivalents, against 3.3 overall. The BLS does not attribute those deaths to language. The numbers do mark a group where understood safety training matters most.

Captions: the text layer everyone gets

Whatever language the audio is in, captions help. Morton Ann Gernsbacher’s 2015 review of more than 100 studies found that captions improve comprehension of, attention to and memory for video. The benefit is largest for viewers watching in a non-native language. WCAG 2.2 lists captions for prerecorded video at Level A, the lowest level of accessibility conformance. For a mandatory module, that makes captions the default, not an extra. Captions in the source language also give your reviewer a written line to check against the policy text before any translation starts. They also carry the message where the sound is off, in an open-plan office or next to a loud machine. If you are unsure how captions differ from subtitles, our explainer on closed captions sets out both.

In short: five jurisdictions, one demand. Training the employee can understand, and an employer who can show they checked.

How to build compliance training programs

Five steps take a program from policy text to proof. The order matters more than the tools.

Step 1: Map duties, audiences and languages

Start per legal entity and per site, not per company. List the topics from the table above and the audiences: all staff, managers, reporting-office staff, and agency workers wherever you are the hirer. Add the deadlines and the languages. Use working languages, not passport languages. Ask each site manager which language a safety briefing actually happens in. Give every topic an owner: HR for harassment prevention, the safety specialist for instruction, the DPO for data protection.

Then decide what to build. A ready-made course is often the fastest route for US topics such as harassment prevention, where state law sets content and length. California and New York even publish their own free model training. Buy or adopt those. Build your own where the content is yours: your code of conduct, your hazards, your equipment.

Step 2: Keep each compliance training module short

The best evidence on clip length comes from voluntary learners. Guo, Kim and Rubin analysed 6.9 million video sessions across four edX courses in 2014. Median engagement was at most six minutes, regardless of how long the video was. Compliance viewers are obligated, not voluntary, so treat six minutes as a sensible ceiling per clip rather than a law of attention. The DOJ’s 2024 guidance notes that some companies have moved to shorter, more targeted sessions.

One idea per clip. Put the policy text beside it. Write the script from the policy wording rather than from memory, so the reviewed text and the spoken text match. That pays off in the next step, because every sentence of the source becomes one line to check in each language. Our article on how to create training videos covers the production side.

Step 3: Translate, then review before release

Machine translation is fast, and it turns a finished source module into a usable first draft in each target language. A legally reviewed module needs more than a draft. Someone who knows the subject and the target language has to read every line before anyone is trained on it. ISO 18587:2017 describes that kind of full human post-editing of machine output.

Fix the legal terms first. Works council, whistleblowing channel, data protection officer: those must not drift between the Polish and the Czech version. The mechanics of translating a video are simple. The review is where the time goes. Where a written policy already exists in the target language, hand it to the reviewer, so the video and the document use the same words. Note who reviewed which language and on which date, because that name belongs in your evidence file.

Step 4: Release the module inside your LMS

Assignment, deadline, reminders and completion belong in the learning management system or the HR system. That is where the learner is known. Tie the deadlines to the events from the cadence section: a new hire gets the module in the first week, a transferred employee on the day of the change. Report completion per site and per working language, so a gap in one language group shows up before an auditor finds it. If your LMS reports through xAPI, the IEEE standardised that format in 2023 as IEEE 9274.1.1. The records sit in the LMS or a learning record store. The video is embedded in the module, but the proof of who finished it is not stored with the video. In Germany, read the works council section below before you switch on tracking.

Step 5: Check understanding, not only completion

A progress bar that reaches the end tells you the video played. The DGUV rule asks for more: questions, a demonstration, observation. The DOJ asks how you measured effectiveness, whether employees learned the material, what happened to those who failed the test and whether behaviour changed. For hazardous substances in Germany, the instruction itself must be oral and specific to the workplace. A video supports it, but it does not replace it.

Training is a real lever, but a limited one. In a 2006 paper, Kalev, Dobbin and Kelly studied 708 private-sector establishments from 1971 to 2002. Diversity training on its own was among the least effective measures, while assigning clear responsibility worked better. That was diversity training, not compliance training in general. The lesson still travels: give every module a named owner and a review date.

In short: map the duties, keep clips short, review every translation, let the LMS hold the learner record, and test understanding.

See what one module in several languages looks like. Create an alugha account, upload a training clip and add a second language track to it.

Proof: what an auditor asks for

Learning and HR vendors are right about one thing. Automated assignment, reminders and completion reports are what make a program auditable at scale, and no spreadsheet replaces them. A completion report is necessary, but it is not sufficient. It shows that someone reached the end of something. It does not show which version they saw, in which language, or whether they understood it.

The evidence chain, item by item

For data protection training, GDPR Art. 5(2) adds a general rule: you must be able to demonstrate compliance with its principles, not only achieve it. Give every module and every language version a version number, so the LMS record, the video and the archive point to the same version when someone asks.

The California row is the one most programs underestimate. The regulation asks you to keep “a copy of all written or recorded materials that comprise the training” for at least two years. So the exact video each employee saw, per language, has to be retrievable after you have updated the module twice. HIPAA keeps its documentation for six years, counted from creation or from the date it was last in effect.

The LMS proves who finished. Only the content can prove what they were told, and in which language.

Involve the works council before you track

In Germany, §87(1) no. 6 of the Works Constitution Act gives the works council co-determination over technical systems able to monitor employee behaviour or performance. An LMS or a player that records who watched what, when and how far typically falls under it. Involve the works council before you switch on completion tracking, not after the first report lands.

Agree who may see individual records, for what purpose and for how long. One workable pattern: team-level figures for managers, named records only for the people who follow up on a missed deadline. That agreement becomes part of your proof as well. Without a works council, the GDPR’s purpose limitation and data minimisation principles in Art. 5(1) still set the same boundaries.

In short: the learner half of the proof sits in the LMS, the content half sits with the video, and in Germany the works council has a say in how the learner half is collected.

Where the compliance module lives

The video in your compliance training for employees has to live somewhere. Where matters.

YouTube’s reach, and the cost inside an intranet

YouTube deserves its reputation. An unlisted video costs nothing, needs no procurement and plays on every device. For public content, its reach is unmatched. For an awareness campaign aimed at customers or applicants, it is often the right home.

Inside an intranet page, the trade changes. The embed loads a third party’s scripts into the page your employees open. A finished anti-corruption module ends in suggested videos. By default they can come from any channel, and the rel=0 setting only narrows them to your own. And the data-protection training runs in a player your data protection officer has not reviewed. Section 25 of Germany’s TDDDG requires consent before information is stored on or read from an employee’s device, unless it is strictly necessary for the service they asked for. The EDPB’s Guidelines 2/2023 on the ePrivacy Directive read that scope broadly. Our article on GDPR-compliant video hosting covers the hosting side in detail.

Questions for any video host

Ask these before the first upload, of us or of anyone else.

• Where are the videos stored, inside the EU or outside it?
• Does the player load third-party trackers or advertising cookies?
• What does it store on or read from the employee’s device? Ask your DPO to check the consent setup for any embedded player.
• Is there an Art. 28 GDPR processing agreement? A processor needs a binding contract that sets out subject matter, duration, purpose, types of data and categories of data subjects.
• Can each language version be released separately, after its own review?

If a host cannot answer the fourth question in writing, stop there. If you want to go through these questions for your own setup, book a call with us.

In short: public reach and an internal compliance page want different players, and these five questions decide which one your DPO can sign off.

Where alugha fits, and where it does not

We solve one of the three jobs. Here is which one, and where our part ends.

We are not an LMS and not a compliance system. We do not enrol anyone, remind anyone or certify anyone, and we cannot tell an auditor who finished a module. We have no quizzes, no attestations, no SCORM packages and no xAPI statements. Completion proof, deadlines and reminders stay with your LMS or HR system. What we do is make sure the video inside your module plays in every employee’s language from one link.

One module, one link, every language

Our player carries every audio track and every subtitle track of a video under a single URL. The employee picks audio and subtitles separately. They can listen in Turkish and read German subtitles, and the switch takes effect immediately, without a reload. Your LMS holds one embed per module, not one per language. The link does not change when you add Czech.

The player starts in the language of the employee’s browser, read from the Accept-Language header, and falls back to the default track you set. Browser language, not location. On a shared shop-floor terminal set to German, the learner switches in the language menu. Set the embed’s subtitles to Automatic (force), and everyone gets a text layer, whatever the audio.

The player embeds in Moodle and other LMSs through the standard iframe. Some LMSs strip iframes or block third-party cookies, so an admin may need to allow alugha.com; our Moodle guide has the steps. For an internal module, set the video to Not listed and place the embed behind the LMS login. The LMS gates the page. The link itself stays reachable to anyone who has it.

A review gate for every language

In the dubbr, our editing workspace, a training video goes through three steps. Speech-To-Text creates the transcript, Automated Translation creates a new language track from it, and Text-To-Speech gives that track an AI voice. We offer AI-powered translation into 200+ languages. Every line stays editable per language tab, with the source beside it. On a paid tier, a glossary keeps fixed terms consistent across languages. What AI dubbing does well, and where a human voice is still better, is a separate question.

Then comes the gate. Every language track has its own state: Playable, Private or Hidden. Publish the source language on day one. Keep the Polish translation Private until legal or your local HR partner has read it, then switch it to Playable and publish. Available means finished, not live, as our note on published versus available content explains.

On a paid tier, each language track exports as plain text, WebVTT or SRT. The plain text is a written record of what the module said in each language. File it next to the video itself, which is the recorded material the California row above asks you to keep. We count plays per language track, on a paid tier and through our API, so you can see whether the Polish version is watched at all. We do not count completion per person. That stays in your LMS, which also keeps the personal data of who completed what out of the video layer. Hosting is in Germany and the EU, with no third-party advertising cookies and trackers, no ads and no third-party recommendations after the module ends.

In short: record once, add languages as tracks, keep one link.

When you do not need us

If your workforce shares one language and your LMS already plays video your DPO has signed off, you do not need us. The same goes for modules that are text and a quiz. Many are, and they work. A team small enough to train in one room needs a room, not a platform. Public awareness content belongs where YouTube’s reach is the point. And if your LMS vendor already localises video and hosts it in the EU, the only question is whether one link per module is worth a second tool. If only one site needs a second language, subtitles in the player you already have may carry it for now. The review step applies either way: whoever produces the translation, someone who knows the subject reads it before anyone is trained on it.

Frequently asked questions about compliance training for employees

What is compliance training for employees?

It is instruction on the laws, regulations and company policies that apply to each person’s job, run on a schedule and documented. It has three jobs: reach every employee in a language they understand, prove who completed which version, and meet the deadline. The US Sentencing Guidelines, in §8B2.1(b)(4), treat effective training as one element of an effective compliance program.

How often do employees need compliance training?

On events and on cycles. The events are hiring, a transfer, new equipment and a new hazard, under the EU framework directive of 1989 and OSHA’s rules. The cycles depend on the topic: annually for German safety instruction under DGUV Vorschrift 1 and for New York harassment prevention, every two years in California. The GDPR names no interval at all.

Is compliance training legally required?

Some of it is. Safety instruction is required in the EU, Germany and the UK, and under OSHA. Sector rules add more: HIPAA for health data, the German Money Laundering Act for obliged entities, DORA for financial entities since 2025. California and New York mandate harassment training. Data protection training is one way to meet the GDPR’s Art. 5(2) duty to demonstrate compliance.

Does compliance training have to be in the employee’s language?

For safety training, yes. Germany’s DGUV Regel 100-001 requires an understandable form and language. OSHA’s 2010 memo requires a language employees understand, and the UK asks for comprehensible information. New York wants harassment materials in each employee’s primary language where a template exists. For every other topic, the DOJ’s 2024 guidance asks whether training came in the form and language appropriate for the audience.

What are the 7 elements of an effective compliance program?

The US Sentencing Guidelines list seven in §8B2.1(b): standards and procedures to prevent and detect misconduct; oversight by the board and senior management; keeping people with a history of misconduct out of positions of authority; training and communication; monitoring, auditing and a reporting system; consistent incentives and discipline; and responding to misconduct and preventing it from recurring. Training is the fourth.

Can we use machine translation for compliance training?

Yes, as a draft. Machine translation turns a source module into a first version in every language quickly. Before anyone is trained on a legally reviewed module, a person who knows the subject must review every line, the kind of full human post-editing ISO 18587:2017 describes. Keep fixed legal terms consistent across languages, and release each version only after its review.

How do we prove employees understood the training?

Completion alone does not prove it. DGUV Regel 100-001 names three methods: comprehension questions, having the employee demonstrate the procedure, and observing the work. The DOJ’s 2024 guidance asks how you measured effectiveness, whether employees learned the material, what happened to those who failed the test and whether behaviour changed. Record the method and the result next to the completion in your LMS.

What are the 3 C’s of compliance?

There is no agreed definition. Different consultancies use different triples, and no statute or standard defines the term. For training, a useful working version is communicate, confirm, correct. Tell people the rule in their language, confirm they understood it, and correct the module when an audit or an incident shows a gap. Treat it as a working choice, not a standard.

Getting started

Three moves get a program on its feet this quarter.

1. List your mandatory topics per legal entity, with the cadence for each from the tables above. 2. List the languages your people actually work in, site by site. 3. Pick one module, record it once, add one language, and have that version reviewed before release.

The DGUV rule asked one question at the start: was it understood? A completion record answers a different one: it tells you the module was finished. Build your compliance training for employees so that both answers exist, the record in your LMS and the understanding in the language each employee speaks.

If your compliance modules must reach a workforce in several languages, book a call. We will walk through the review gate and the LMS embed on one of your own videos, and answer your data-protection questions about hosting.