What Compliance Training Is Required by Law? (w/Examples) + FAQs

Federal law does not mandate a single universal compliance training requirement for all employers. However, specific OSHA regulations, industry rules, and state laws create a patchwork of mandatory training obligations. Employers who fail to provide required training face penalties ranging from $1,000 to over $165,000 per violation, depending on the law violated.

The complexity stems from the General Duty Clause in Section 5(a)(1) of the Occupational Safety and Health Act, which requires employers to provide a safe workplace—even when no specific standard exists. When combined with state-level sexual harassment laws, industry-specific regulations like HIPAA, and municipal ordinances in cities like Chicago and New York City, employers face dozens of potential training requirements. According to the EEOC’s 2024 annual report, the agency received 88,531 new workplace discrimination charges—a 9.2% increase from the prior year—underscoring why proactive training matters.

In this article, you will learn:

📋 Which federal agencies require workplace training and the specific regulations that apply to your business

⚖️ The six states that mandate sexual harassment prevention training for private employers—and their different requirements

💰 The exact penalties you face for non-compliance, from OSHA fines up to $165,514 per violation to state penalties of $1,000–$10,000

🏥 Industry-specific training requirements for healthcare, food service, financial services, and construction

✅ Step-by-step guidance on creating a compliant training program that protects your business from lawsuits

Federal Compliance Training Requirements

Federal law establishes baseline training requirements, but the rules differ by agency, industry, and hazard type. The most significant federal training mandates come from OSHA, while the EEOC provides influential guidance that shapes employer liability.

OSHA Mandatory Training Requirements

OSHA requires training under 29 CFR Part 1910 for general industry and 29 CFR Part 1926 for construction. The training requirements depend on the hazards present in your workplace—not your industry category alone.

The bloodborne pathogens standard at 29 CFR 1910.1030 applies to anyone with “reasonably anticipated contact” with blood or other potentially infectious materials. This includes nurses, physicians, housekeeping staff, tattoo artists, and funeral home workers. Training must occur at initial assignment and at least annually thereafter.

Hazard communication training under the HazCom standard requires employers to inform workers about hazardous chemicals in their work area, the location of Safety Data Sheets, how to detect releases, and measures to protect themselves. Training must occur at initial employment and whenever a new chemical hazard is introduced.

OSHA Penalties for Training Violations

OSHA’s 2025 penalty structure reflects annual inflation adjustments:

In 2025, Sound Construction Inc. faced $1,224,798 in penalties after OSHA identified seven willful and four serious violations at Connecticut worksites. Virginia Transformer Corp. was cited $986,888 for 53 serious and repeat violations. These cases demonstrate that OSHA aggressively pursues employers who fail to correct known hazards—including training deficiencies.

California employers face Cal/OSHA penalties that can exceed federal amounts: up to $25,000 for serious violations and $162,851 for willful or repeat violations.

Title VII and the EEOC’s Training Expectations

Title VII of the Civil Rights Act of 1964 prohibits employment discrimination based on race, color, religion, sex, and national origin. The law applies to employers with 15 or more employees.

Here is the critical point: Title VII does not explicitly require harassment training. You will not find a training mandate in the statute or regulations. However, federal courts have created a powerful incentive for employers to train anyway.

The Faragher-Ellerth affirmative defense, established by the Supreme Court in 1998, allows employers to limit their liability in hostile work environment cases by proving: (1) the employer exercised reasonable care to prevent and correct harassment, and (2) the employee unreasonably failed to use the employer’s complaint procedure.

The EEOC has stated that training is a key component of exercising “reasonable care.” Employers who provide comprehensive training, combined with effective complaint procedures, position themselves to assert this defense. Employers who skip training forfeit this protection.

The EEOC recommends periodic training for all employees to ensure they understand their rights and responsibilities. The agency’s 2024 Enforcement Guidance on Harassment emphasized that training should be ongoing—not a one-time event.

State Sexual Harassment Training Requirements

While federal law strongly encourages but does not mandate harassment training, six states require private employers to train employees: California, Connecticut, Delaware, Illinois, Maine, and New York. Each state has different employer size thresholds, training duration requirements, and retraining schedules.

California: SB 1343 Requirements

California Senate Bill 1343 expanded the state’s harassment training mandate in 2018. The law applies to employers with five or more employees—regardless of whether all five work in California.

The training must cover harassment based on gender identity, gender expression, and sexual orientation, with practical examples. It must also include “abusive conduct” training. The California Civil Rights Department provides free online training that meets state requirements.

California employees must complete training in even-numbered calendar years (2024, 2026, etc.). Employers who miss the deadline face enforcement action by the CRD.

California SB 553: Workplace Violence Prevention

Effective July 1, 2024, California SB 553 requires most employers to establish workplace violence prevention plans. This is a separate requirement from harassment training.

Employers must provide initial training when the plan is implemented and annually thereafter. Training must cover the employer’s specific plan, how to recognize and avoid hazards, and how to report threats. Cal/OSHA is already issuing citations for non-compliance.

Connecticut: Time’s Up Act

Connecticut’s Time’s Up Act (Public Act 19-16) requires employers with three or more employees to provide two hours of training to all employees within six months of hire. Employers with fewer than three employees must still train all supervisors.

The training must be interactive and compliant with Connecticut Commission on Human Rights and Opportunities guidelines. Remote employees who work in Connecticut must be trained.

Delaware: HB 360 Requirements

Delaware employers with 50 or more employees must provide interactive training on sexual harassment prevention. Independent contractors and employees working less than six months continuously do not count toward the 50-employee threshold.

Training must occur within one year of hire for new employees and every two years thereafter. Supervisors must receive additional training on their responsibilities to prevent and correct harassment.

Delaware also requires employers with four or more employees to distribute a Sexual Harassment Notice to all new hires, regardless of whether they meet the 50-employee training threshold.

Illinois: Workplace Transparency Act

Illinois requires annual sexual harassment training for all employers with one or more employees working in the state. This is the broadest requirement among states with mandatory training laws.

The Illinois Department of Human Rights provides model training that employers may use, or employers may develop their own training meeting or exceeding IDHR standards.

Restaurants and bars face additional requirements. They must establish a written sexual harassment policy, provide supplemental industry-specific training, and offer training in both English and Spanish. This supplemental training must include industry-specific conduct and scenarios.

The IDHR strongly recommends training new employees “as soon as possible” after hire, even though no specific deadline exists for new hires.

Maine: Title 26 Section 807

Maine employers with 15 or more employees must provide sexual harassment training to all employees within one year of hire and to supervisors within one year of assuming their role.

Maine law specifies minimum content requirements:

• Definition of sexual harassment with examples
• Employee rights under state and federal law
• Complaint procedures including how to file with MHRC or EEOC
• Protection against retaliation
• Disciplinary consequences for harassment

Penalties for non-compliance are escalating: $1,000 for the first violation, $2,500 for the second, and $5,000 for the third or subsequent violations.

Maine also requires employers to provide annual written notice to all employees describing sexual harassment and available protections.

New York: State and City Requirements

New York State requires all employers—regardless of size—to provide annual sexual harassment training to all employees. Every employer must also adopt a sexual harassment policy meeting state standards.

New York City adds additional requirements for employers with 15 or more employees:

• Training on bystander intervention
• Training on rights under NYC law
• Distribution of the city’s Sexual Harassment Fact Sheet
• Posting the Sexual Harassment Poster in English and Spanish

NYC training requirements apply to employees who work more than 80 hours in a calendar year and for at least 90 days. This includes independent contractors and freelancers meeting these thresholds.

New York Retail Worker Safety Act

Effective June 2, 2025, New York’s Retail Worker Safety Act requires employers with 10 or more retail employees to implement workplace violence prevention programs. Retail stores do not include restaurants.

Training must be interactive and include de-escalation tactics, active shooter drills, and emergency procedures. A separate requirement for “silent response buttons” takes effect January 1, 2027.

Chicago and Washington D.C. Requirements

Two major cities impose training requirements beyond their state laws.

Chicago: Bystander Intervention Training

Chicago amended its Human Rights Ordinance in 2022 to require annual training for all employers with at least one employee working within city boundaries. The requirements include:

• 1 hour of sexual harassment prevention training for all employees
• 1 hour of bystander intervention training for all employees
• 1 additional hour for managers/supervisors

Failure to train can result in fines up to $10,000, plus attorney fees. Even employees who work in Chicago only occasionally or remotely must be trained.

Washington D.C.: Tipped Worker Training

The Tipped Wage Workers Fairness Amendment Act requires employers who employ tipped workers in D.C. to provide sexual harassment training to all employees, managers, owners, and operators.

The training must include how to respond to, intervene in, and prevent harassment by co-workers, management, and patrons. Employers must also adopt a written sexual harassment policy and submit it to the D.C. Office of Human Rights.

State Harassment Training Summary

Industry-Specific Training Requirements

Healthcare: HIPAA Training

HIPAA requires covered entities and business associates to train all workforce members on privacy and security policies. This includes employees, volunteers, students, and contractors who may encounter protected health information.

The Privacy Rule at §164.530(b)(1) states that training must be provided “within a reasonable period of time” after joining the workforce and when functions are affected by material policy changes. Best practice is annual refresher training and immediate training for new hires before they access patient information.

Training records must be maintained for six years to demonstrate compliance during audits.

HIPAA violation penalties are structured in tiers based on negligence:

Annual maximum penalties can exceed $2 million per violation category. Criminal penalties for intentional misuse of PHI include up to $250,000 in fines and 10 years imprisonment.

Financial Services: AML Training

FINRA Rule 3310 requires broker-dealers to implement anti-money laundering programs that include ongoing training for appropriate personnel. The rule mirrors Bank Secrecy Act requirements for all financial institutions.

AML training must be customized to the firm’s risk profile and the audience receiving training. Front-line staff need to understand red flags and reporting obligations. Compliance officers require deeper training on regulatory requirements.

Independent testing of the AML program must occur annually (or every two years for firms without customer accounts). The test should verify that training programs address applicable regulatory requirements and are tailored to the firm’s risks.

Food Service: Handler Training

States with mandatory food handler training include California, Texas, Illinois, Florida, Oregon, Utah, Washington, Alaska, and Hawaii. Requirements typically mandate training within 14-60 days of hire.

California’s SB 476 requires employers to cover both the cost of training and the paid time employees spend completing it.

Even states without statewide requirements often have county or municipal mandates. Nevada has no state requirement, but the Southern Nevada Health District (including Las Vegas) requires food handler cards.

Construction: OSHA 10 and 30

OSHA’s Outreach Training Program provides 10-hour and 30-hour training for construction workers. While OSHA considers this training “voluntary,” many states, cities, and contractors require it.

OSHA 10-hour training is recommended for all construction workers. OSHA 30-hour training is recommended for workers with supervisory or safety responsibilities. Upon completion, workers receive a Department of Labor card.

New York City requires the OSHA 30 Voice Authentication course for Site Safety Training (SST) certification. California construction professionals may need additional state-level safety training.

Three Real-World Scenarios

Scenario 1: Multi-State Retailer

Situation: Maria owns a clothing retail chain with 75 employees across California (40), New York (25), and Connecticut (10).

Maria must provide California-specific harassment training to her CA employees, NY-specific training to her NY employees, and CT-specific training to her CT employees. Training that satisfies one state’s requirements will not satisfy another’s because each state mandates state-specific content.

Scenario 2: Chicago Restaurant Owner

Situation: James operates a restaurant in Chicago with 22 employees, including servers who earn tips.

James must train his employees more frequently and comprehensively than a non-Chicago Illinois employer. Missing the annual deadline could result in fines up to $10,000 from Chicago, plus civil penalties from IDHR.

Scenario 3: Healthcare Practice

Situation: Dr. Chen operates a medical practice in Maine with 18 employees, including nurses, administrative staff, and volunteers.

Dr. Chen faces overlapping federal and state requirements. HIPAA violations can result in penalties starting at $137 per violation, while Maine harassment training violations incur $1,000-$5,000 fines.

Mistakes to Avoid

1. Assuming federal law requires harassment training
Title VII does not mandate training. However, the Faragher-Ellerth defense makes training essential for limiting liability. Employers who skip training lose their best legal protection in harassment lawsuits.

2. Training only supervisors
California, Connecticut, Delaware, Illinois, Maine, and New York all require training for non-supervisory employees. Training supervisors alone does not satisfy state law.

3. Using generic, non-state-specific content
Each state with mandatory training requires state-specific content. New York City requires bystander intervention training that New York State does not. A generic course will not satisfy NYC employers.

4. Forgetting remote employees
Remote employees who work in states with training requirements must be trained—regardless of where your company is headquartered. An employee working from their Connecticut home for a Texas-based company must receive Connecticut-compliant training.

5. Missing retraining deadlines
California requires training every two years in even-numbered calendar years. Illinois requires annual training. Connecticut requires training at least every 10 years. Missing these deadlines exposes you to penalties.

6. Failing to document training completion
Maintain records showing who completed training, when, and what content was covered. HIPAA requires six years of training documentation. Without records, you cannot prove compliance.

7. Ignoring industry-specific requirements
Healthcare workers need HIPAA and bloodborne pathogens training. Financial services employees need AML training. Food handlers need certification within 30-60 days. General harassment training does not substitute for these requirements.

Do’s and Don’ts

Do’s

✅ Do train new hires promptly — Most states require training within 6 months, 90 days, or 1 year. Train as soon as possible to minimize liability exposure.

✅ Do use interactive training — Connecticut and California require interactive training. This means quizzes, scenarios, and opportunities for questions—not just videos.

✅ Do maintain detailed records — Document who attended, when, what topics were covered, and whether the training was state-specific. Keep records for at least six years.

✅ Do train contractors and temps — New York City requires training for independent contractors working 80+ hours. Illinois recommends training independent contractors working on-site.

✅ Do tailor training to job functions — HIPAA training for clinical staff differs from training for administrative staff. OSHA bloodborne pathogens training applies only to employees with exposure risk.

Don’ts

❌ Don’t assume one training covers all states — California, New York, Illinois, and Connecticut each require state-specific content. Multi-state employers need multiple training programs.

❌ Don’t skip supervisory training — California supervisors need two hours instead of one hour. Delaware and Maine require additional supervisor content.

❌ Don’t use outdated training materials — Laws change. California added workplace violence prevention requirements in 2024. Update your training annually.

❌ Don’t treat training as a one-time event — Illinois requires annual training. California requires training every two years. Bloodborne pathogens training is required annually.

❌ Don’t forget to pay employees for training time — Under federal law, time spent in employer-provided training is generally compensable.

Pros and Cons of Compliance Training

Pros

✅ Legal protection through the Faragher-Ellerth defense — Training demonstrates “reasonable care to prevent harassment,” potentially limiting employer liability in hostile work environment cases.

✅ Reduced workplace incidents — Effective training educates employees about prohibited conduct, empowers bystanders to intervene, and reinforces reporting procedures.

✅ Penalty avoidance — OSHA penalties exceed $165,000 for willful violations. State harassment training penalties range from $1,000 to $10,000. HIPAA fines can exceed $2 million annually.

✅ Improved workplace culture — Regular training signals that leadership takes harassment and safety seriously. This can improve employee morale and retention.

✅ Competitive advantage in regulated industries — Healthcare organizations with strong HIPAA compliance and financial firms with robust AML programs avoid enforcement actions that damage reputation.

Cons

❌ Direct costs — Training programs, whether developed internally or purchased from vendors, require investment. Supervisor time for training delivery adds additional cost.

❌ Employee time away from work — California’s two-hour supervisor training and Connecticut’s two-hour all-employee training remove workers from productive tasks.

❌ Complexity for multi-state employers — An employer in California, New York, Illinois, and Connecticut faces four different sets of requirements with different content, frequency, and documentation obligations.

❌ Administrative burden — Tracking who completed training, when their retraining is due, and maintaining records for years requires systems and oversight.

❌ Training alone does not prevent all claims — Even with training, employers face harassment claims. Training is one component of an effective prevention program, not a guarantee of immunity.

Data Privacy Training Requirements

The California Consumer Privacy Act (CCPA) requires covered businesses to train all individuals responsible for handling consumer privacy inquiries. Training must ensure employees understand consumers’ rights under the statute and how to direct consumers to exercise those rights.

The CCPA applies to businesses that meet specific revenue, data processing, or data sale thresholds. Employers collecting personal information about California employees, job applicants, or contractors must comply.

Multiple states have enacted data privacy laws with varying training implications. New Hampshire, Delaware, Iowa, Nebraska, New Jersey, Tennessee, Minnesota, and Maryland all have consumer data protection laws effective in 2025. HR teams should include data privacy and security training for personnel handling personal data.

Employer Size Thresholds Summary

FAQs

Is sexual harassment training required by federal law?
No. Title VII does not mandate training. However, the EEOC recommends it, and training helps establish the Faragher-Ellerth defense that limits employer liability in harassment cases.

Does California require harassment training for all employees?
Yes. Employers with five or more employees must provide at least one hour of training to non-supervisory employees and two hours to supervisors every two years.

Do remote employees need harassment training?
Yes. Employees working remotely in states with training requirements must receive compliant training, regardless of where the employer is headquartered.

Is OSHA training required annually?
It depends. Bloodborne pathogens and some other OSHA standards require annual training. Other standards require training only at initial assignment or when conditions change.

Do restaurants have extra training requirements?
Yes. Illinois requires restaurants and bars to provide supplemental industry-specific sexual harassment training in English and Spanish beyond standard employer obligations.

Must employers pay employees during training?
Yes. Under federal wage and hour law, time spent in employer-required training is generally considered compensable work time.

Can online training satisfy state requirements?
Yes. California, Connecticut, Illinois, New York, and most states permit online training if it meets interactivity requirements. D.C. previously required in-person manager training but now allows online.

What happens if an employer fails to provide required training?
Penalties vary. Connecticut fines up to $1,000. Maine fines $1,000-$5,000. Chicago fines up to $10,000. OSHA violations can reach $165,514 per willful violation.

Do independent contractors need harassment training?
Sometimes. New York City requires training for contractors working 80+ hours per year and 90+ days. Illinois recommends but does not mandate training for contractors.

How long must training records be kept?
It varies. HIPAA requires six years. Best practice for harassment training is at least three to five years to demonstrate compliance if claims arise.

Does HIPAA require annual training?
Not explicitly. HIPAA requires training for new workforce members within a reasonable period and when policies change. Best practice is annual refresher training.

Is workplace violence training required in California?
Yes. SB 553 requires most California employers to implement workplace violence prevention plans and provide annual training effective July 1, 2024.