Training is easy to schedule but harder to prove, and across Europe the record behind each course now carries real legal weight.
Most boards know how much their organisation spends on training. Fewer can say who completed a mandatory course in Lisbon last March, which version of the material they saw, or where that record is kept today. For groups working across several European countries, that gap is starting to matter.
Data protection law expects organisations to show that they comply, not just claim it. The EU AI Act has also added a training duty of its own. As a result, the system that holds these records, often a training management system for instructor-led and blended courses, is becoming part of how a business is governed.
What does a training record need to prove?
A training record looks simple: a name, a course and a date. A useful one answers harder questions. Was the learner there for the whole session? Which version of the course was taught? Who delivered it, and when does the certificate run out? Any of these answers may be needed months or years later.
What leaders need here is often called an audit trail. It is a record, kept in time order, that provides evidence of the steps that affected a process. For training, it means being able to rebuild what happened long after the course has ended.
This is where shared spreadsheets tend to struggle. A file edited by many people shows the current state of things. It is much harder to use it to show how things got there, and who made each change.
That matters because European rules often rely on proof. Under the General Data Protection Regulation (GDPR), the organisation in charge of personal data must be able to show that its processing complies.
When a regulator, client or auditor asks whether staff were trained, the answer is only as strong as the evidence behind it. In many organisations, that evidence is still spread across files and inboxes.
Why has the AI Act raised the stakes?
The EU AI Act has made the training record matter even more. Since 2 February 2025, Article 4 has required providers and deployers of AI systems to take measures to support AI literacy among their staff. National market surveillance authorities began to supervise and enforce the rule in August 2026.
The rule has been eased, but not removed. Changes that came into force in mid-July 2026 mean that no specific, or “sufficient”, level of AI literacy is now required. The duty to support AI literacy itself remains in place.
The scope also goes beyond employees. According to the European Commission, the other people dealing with AI systems on an organisation’s behalf could include a contractor, a service provider or a client.
On the question of proof, the Commission’s questions and answers on AI literacy are clear. There is no need for a certificate. Organisations can keep an internal record of training and other guiding initiatives.
In other words, the record is the evidence. A company rolling out AI tools in five countries will want to show who was trained, on what and when. It should be able to do that on request, not piece it together under pressure from a regulator.
How does data protection apply to the records themselves?
There is a twist here. The records that prove compliance are themselves personal data, so the GDPR applies to them too. Its principles include data minimisation, accuracy and storage limitation.
In plain terms, that means collecting only what the record needs, keeping it correct and not holding it for longer than necessary. The responsibility stays with the organisation even when an outside provider, such as a software vendor, processes the data on its behalf.
Good habits here pay off in more than one way. As a recent look at the importance of GDPR for businesses points out, following the rules is not simply a legal requirement. Good data practice can also reduce risk and build trust, and that is as true for learner data as for customer data.
Location matters too. The GDPR limits transfers of personal data outside the European Economic Area unless proper safeguards are in place or the destination is formally judged adequate. For a group with learners in several countries, it is worth knowing exactly where its training management system stores their data.
The penalties are serious. At the upper end, GDPR fines can reach €20 million or 4% of worldwide annual turnover, whichever is greater. Few training records will ever come near that, but the message is plain. How training data is held is a leadership decision, not just an IT detail.
Why do local spreadsheets fall short?
In large groups, training often starts locally rather than from the centre. A health and safety course runs in Germany, a code of conduct session in Spain and a product course in the Nordics. Each office keeps its own spreadsheet, sign-in sheets and folder of certificates, often in its own language.
Every local team is doing its job. The trouble starts when someone needs one answer for the whole group. Records kept in a dozen formats across a dozen countries are hard to search, hard to secure and slow to bring together against a deadline.
Leaders already expect a defensible decision to leave a clear trail of reasoning. Training records deserve the same standard. A training management system can help by keeping courses, attendance, results and certificates in one database, with each learner’s history in a single record. That way, one search can show who was trained, where and when.
Software is only part of the answer, though. Someone still has to own the records, set the rules for keeping them and check that local teams follow those rules. Moving a dozen local setups onto one platform also takes time and local support, so many groups start with the courses that carry the most legal risk.
What should leaders ask before choosing a system?
Procurement teams will have their own checklists. These five questions go to the heart of the record-keeping issue, and they are worth asking early, whichever training management system is on the shortlist.
| Question to ask | Why it matters |
| Where will our data be hosted, and can we choose the region? | Some organisations need their data stored in a particular country or region. |
| Is every change to a record logged? | Without a change log, the system shows the current state, not an audit trail. |
| Can we set how long records are kept, by country or course type? | Storage limitation is a GDPR principle, so deletion should not depend on someone remembering. |
| What independent security checks can you show us? | A SOC 2 report or an independent security audit gives outside evidence, not just the vendor’s own word. |
| If we leave, can we take our full history with us? | Training records often need to outlast a software contract. |
No single answer settles the choice. But a vendor that cannot answer these clearly is telling you something about how your records would be kept. It is also worth asking to see each feature in a live demonstration, rather than relying on a sales sheet.
Training evidence belongs on the board agenda
Training has long been treated as a cost to manage and a calendar to fill. Across Europe, it is also becoming evidence. Regulators, clients and auditors can ask for proof that people were trained, and that the proof itself was handled lawfully.
Organisations that give their training records a clear owner and a proper home should be able to answer quickly. Those that do not may find out how long rebuilding the record takes at the worst possible moment.
