Statutory vs Mandatory Training: What UK Employers Must Know

Most UK employers use "statutory" and "mandatory" as if they mean the same thing. They do not. The difference between mandatory and statutory training is not academic. It determines who can prosecute you, what penalties you face, and how you should prioritise gaps in your training matrix.

Get this distinction wrong and you risk treating a criminal law obligation with the same urgency as an internal policy preference. That is how fines happen.

Here is how the two categories actually work, what falls into each, and why your training records need to distinguish between them.

What is statutory training?

Statutory training is training required by an Act of Parliament or statutory instrument. The obligation exists in law. It applies to every employer covered by that legislation, regardless of internal policy or sector guidance.

The primary source is the Health and Safety at Work etc. Act 1974 (HSWA 1974). Section 2(2)(c) requires employers to provide "such information, instruction, training and supervision as is necessary to ensure, so far as is reasonably practicable, the health and safety at work of his employees."

That is the general duty. Specific statutory instruments add detail:

Management of Health and Safety at Work Regulations 1999, Regulation 13 — training on recruitment, when exposed to new risks, and periodically thereafter.
Health and Safety (First Aid) Regulations 1981 — adequate first aid provision, including trained first aiders.
COSHH Regulations 2002, Regulation 12 — training for employees exposed to hazardous substances.
The Regulatory Reform (Fire Safety) Order 2005, Article 21 — fire safety training for all employees.
Manual Handling Operations Regulations 1992, Regulation 4 — training for employees who manually handle loads.

Failure to comply with statutory training requirements is a criminal offence. The HSE or local authority can prosecute. Courts can impose unlimited fines. In cases involving fatalities, individual directors can face imprisonment.

Between 2024 and 2025, UK businesses paid millions in HSE fines linked to training failures. In every case, the underlying obligation was statutory.

What is mandatory training?

Mandatory training is training required by your organisation's own policy or by a sector regulator — but not directly by statute.

The clearest example is care. CQC Regulation 18 (Staffing) requires that staff receive "appropriate support, training, professional development, supervision and appraisal." CQC then expects specific training topics — safeguarding, Mental Capacity Act, medication administration, infection prevention and control — as evidence of compliance with that regulation.

But no Act of Parliament says "all care workers must complete safeguarding training annually." The requirement comes from CQC's regulatory framework and enforcement practice, not from a statutory instrument. That makes it mandatory (required by the regulator) rather than statutory (required by law).

Other examples of mandatory training:

Oliver McGowan training on learning disability and autism — mandated under the Health and Care Act 2022, Section 181 for CQC-regulated providers. (This one is actually an interesting hybrid: the requirement is statutory, but the specific training content was defined by the regulator.)
CSCS cards in construction — not a legal requirement, but required by virtually every principal contractor and effectively mandatory for site access.
Level 2 Food Hygiene — the law requires food handlers to be trained "commensurate with their work activity," but the specific Level 2 qualification is an industry standard, not a statutory prescription.
Organisation-specific training — your own induction programme, internal systems training, or company safeguarding policy.

For a full list of what CQC expects, see our CQC mandatory training list for care homes. If you want to check your care home's training against CQC requirements automatically, use our free CQC Mandatory Training Checker.

The difference between mandatory and statutory training: a comparison

	Statutory training	Mandatory training
Who decides it is required	Parliament, via legislation	Your organisation, or a sector regulator (CQC, Ofsted, etc.)
Legal basis	Acts of Parliament, statutory instruments	Organisational policy, regulatory standards, contractual requirements
Consequence of non-compliance	Criminal prosecution, unlimited fines, imprisonment (for individuals in serious cases)	Regulatory enforcement (warning notices, conditions, rating downgrades, cancellation of registration), contractual penalties, dismissal claims
Who enforces	HSE, local authorities, Crown Prosecution Service	CQC, Ofsted, local authority licensing, your own HR
Examples	Fire safety, first aid, COSHH, manual handling, health and safety induction	Safeguarding (care), CSCS card (construction), allergen awareness (food), company induction
Applies to	Every employer covered by the legislation	Employers in the relevant sector, or all employees per your policy
Renewal obligation	As specified in the regulation, or "as often as necessary" to maintain competence	As specified by the regulator or your policy (typically annual)

The critical difference is the enforcement mechanism. A statutory training failure is a criminal matter. A mandatory training failure is a regulatory or contractual matter. Both have serious consequences, but the legal exposure is different.

Why this matters for your training matrix

Your training matrix should flag whether each requirement is statutory or mandatory. Here is why.

Prioritisation. When you have multiple training gaps — and every organisation does at some point — you need to know which ones carry criminal liability and which carry regulatory risk. A lapsed fire safety certificate (statutory) is a different category of problem than an overdue equality and diversity refresher (mandatory). Both need fixing. The fire safety gap needs fixing first.

Audit response. HSE inspectors and CQC inspectors ask different questions. An HSE inspector wants evidence of statutory compliance — risk assessments linked to training, competence records for specific hazards. A CQC inspector checks against their own framework of expected training topics. If your matrix does not distinguish between the two, you will scramble to answer both sets of questions.

Budget allocation. Statutory training is non-negotiable. You cannot defer it, deprioritise it, or substitute it with an awareness email. Mandatory training may have more flexibility in delivery method and timing. Knowing which is which helps you allocate budget where the legal risk is highest.

Defending gaps. If a training gap is discovered during an inspection, the consequences depend on the category. A statutory gap gives the HSE grounds for a Fee for Intervention charge at £188 per hour of inspector time, an improvement notice, or prosecution. A mandatory gap gives CQC grounds for a requirement notice, a rating downgrade, or — in serious cases — cancellation of registration. Your response to each needs to be different.

Incident investigation. After a workplace incident, the first question is always: was the person trained? The second question is: was that training legally required, or organisationally required? If the training was statutory and missing, the employer faces potential criminal prosecution under HSWA 1974. If it was mandatory and missing, the employer faces regulatory action and potential civil liability. The distinction shapes the legal strategy from the first day of the investigation.

For a complete checklist of both statutory and mandatory requirements by sector, see our mandatory training compliance checklist.

Common areas of confusion

Fire safety. Statutory. The Regulatory Reform (Fire Safety) Order 2005 requires the "responsible person" (usually the employer) to provide fire safety training. This is often listed alongside organisational mandatory training, which blurs the line. It is law.

First aid. Statutory. The Health and Safety (First Aid) Regulations 1981 require adequate first aid provision. The number of first aiders and the level of training depend on your risk assessment, but the obligation to provide it is statutory.

Safeguarding in care. Mandatory (via CQC), not directly statutory. The Care Act 2014 places safeguarding duties on local authorities, not directly on individual care providers as a training requirement. CQC interprets Regulation 13 as requiring safeguarding training, and no care provider would survive an inspection without it. But the training obligation comes from the regulator's interpretation, not from a specific line in a statute.

Manual handling. Statutory. The Manual Handling Operations Regulations 1992, Regulation 4, require employers to provide training where manual handling cannot be avoided. This applies to every sector, not just care or construction.

GDPR training. Neither statutory nor mandatory in the strict sense. No legislation requires GDPR training specifically. The UK GDPR and Data Protection Act 2018 require appropriate security measures, and the ICO considers staff training to be one such measure. Most organisations classify it as mandatory under their own policy.

Food hygiene. The obligation to train food handlers is statutory under the Food Safety and Hygiene (England) Regulations 2013. But the specific Level 2 qualification that everyone treats as the standard is an industry convention, not a legal prescription. The statute says "commensurate with their work activity" — the industry has interpreted that as Level 2.

How to categorise your training requirements

Start with your risk assessments. Every hazard you identify that requires training should be traceable to a specific regulation. If the regulation is a statutory instrument or Act of Parliament, the training is statutory. If the requirement comes from a regulator's guidance, a sector body, or your own policy, it is mandatory.

Here is a practical process:

List every training requirement in your current matrix. If you do not have a matrix, build one first — our guide on what a training matrix is covers the structure.
For each requirement, find the legal source. Search legislation.gov.uk for the regulation name. If you find it in an Act or statutory instrument, it is statutory.
If the source is regulator guidance, a code of practice, or your own policy, mark it as mandatory. This includes CQC expectations, industry body requirements (like CSCS), and anything listed in your company handbook.
Add a "Category" column to your training matrix. Mark each row as statutory or mandatory.
Add a "Consequence" column noting the enforcement body and penalty type for each. This turns your matrix from a tracking tool into a risk register.

The exercise takes an hour at most for a 20-30 person organisation. It fundamentally changes how you prioritise gaps, allocate budget, and respond to inspections.

If you are not sure where your gaps are, run your current records through our training compliance gap checker. It identifies which requirements apply to your sector and flags what is missing.

The practical takeaway

Both categories matter. An employee injured because mandatory safeguarding training was missed is still an employee injured. A CQC rating downgrade from Requires Improvement to Inadequate can close a care home just as effectively as an HSE prosecution.

But the legal mechanisms are different, the enforcement bodies are different, and your response to a gap should be different. Your training matrix needs to reflect that.

Treat statutory training as non-deferrable. Treat mandatory training as non-optional. Track both. Flag the category. Know the consequence of every gap before an inspector tells you.

This article is for general information purposes only and does not constitute legal advice. The distinction between statutory and mandatory training involves legal interpretation that may vary by jurisdiction, sector, and specific circumstances. Consult a qualified legal or health and safety professional for guidance specific to your organisation.

TrainProof flags every training requirement as statutory or mandatory, with the regulation reference attached. When a gap appears, you know exactly what is at stake and who enforces it.

Join the waitlist to be notified when it is ready.