Somewhere in your first years of running a business, the question surfaces — usually triggered by an insurance renewal, a new state law making the rounds, or a competitor's lawsuit: is there training we're legally required to be doing? And the honest answer is the unsatisfying one: yes, probably, and nobody will hand you the list, because the list doesn't exist in one place. It's assembled from federal agencies, your state, your industry, your headcount, and the contracts you've signed — which is why most small businesses discover their training obligations one citation, one claim denial, or one lawsuit at a time.
This playbook is the assembly method. One caveat before the first category, and it's not boilerplate: I'm not a lawyer and this isn't legal advice — requirements shift year to year and vary by state and industry, so treat what follows as the inventory you build and then verify with your state's labor department or an employment attorney. The verification takes an hour once you know what you're asking about. Knowing what to ask about is the hard part, and that's the part this playbook does.
Start with the floor: safety
OSHA applies to essentially every private employer, and it requires training in two ways. The narrow way: specific standards with explicit training requirements — hazard communication if your workplace has chemicals (and cleaning supplies count), bloodborne pathogens if anyone might plausibly be exposed (dental and medical practices, tattoo studios, gyms with first-aid responders), lockout/tagout, forklifts, ladders, respirators, and dozens more keyed to what your people actually touch. The broad way: the general duty to provide a workplace free of recognized hazards, which in practice means that if an employee could get hurt doing a thing, training them on the safe way to do the thing is the first item any inspector looks for. The method: walk your own floor, list what could hurt someone, and check each item against OSHA's published standards for your industry. A dental office, a machine shop, and a marketing agency produce three very different lists from the same walk.
The state layer: harassment training is the big one
The most commonly missed mandatory training in small business is sexual-harassment prevention, because it's state law, it arrived recently, and several states apply it to businesses your size. California requires it at five or more employees — a threshold a fourteen-person practice sailed past long ago — with set hours for staff and supervisors on a repeating cycle. New York requires it annually for every employer, headcount one and up. Illinois, Connecticut, Maine, Delaware, and Washington have their own versions with their own thresholds and clocks, and Chicago adds a city-level requirement on top of the state's. If you have employees in more than one state — including remote — you inherit each state's rules for the people who sit there. This is the category where "I didn't know" performs worst, because when a claim arrives, documented compliant training is frequently the difference between a defensible position and a settlement.
The industry layer: the license is the list
If your business is regulated, your regulator has training opinions. Healthcare-adjacent businesses handling patient information owe HIPAA training to every workforce member who touches it — and "workforce" includes the front desk, not just the clinicians. Food service owes food-handler and manager certifications that most states enumerate precisely. Financial services, insurance, real estate, childcare, transportation, cosmetology — each carries continuing-education and initial-training requirements attached to the license itself. The shortcut here: whatever body licenses you already publishes the requirements, usually with renewal deadlines attached. The failure mode isn't obscurity, it's that nobody in a small shop owns the calendar — the license renews late, or a new hire works unlicensed for a quarter because onboarding didn't include the industry layer.
The contract layer: obligations you signed up for
The last category is invisible because it isn't law — it's promises. Your liability insurer may require documented safety training as a condition of coverage, which means skipped training can surface as a denied claim at the worst possible moment. If you take card payments, PCI compliance includes security-awareness training for staff who handle payment data. Client contracts — especially with larger companies or anything government-adjacent — increasingly embed training clauses: data handling, anti-bribery, safety orientations for your people on their sites. Pull your insurance policies and your three biggest client contracts and search for the word "training." Most owners have never done this, and most who do find at least one obligation they were unknowingly out of compliance with.
Build the one-page register
The deliverable from all four layers is a single page: every requirement, its source, who it covers, how often it repeats, and where the completion evidence lives. That last column is where this becomes real, because in every category above, the training that happened but can't be proven functions — legally, contractually, and with your insurer — exactly like training that never happened. A sign-in sheet, a certificate, a dated completion record with the employee's name: boring artifacts, decisive when the inspector, adjuster, or plaintiff's attorney asks. Put renewal dates on an actual calendar with an actual owner, add a line to your onboarding checklist so new hires enter the cycle on day one, and re-verify the register once a year — state legislatures adjust these rules constantly, and the annual hour is what keeps the page true.
The bottom line
Required training is a four-layer inventory — federal safety, state mandates, industry license, and the contracts you've signed — and no one owes you the compiled list. Build it once with a floor walk, a state check, a look at your license, and a search of your own paperwork; verify it with someone qualified; then run it as a calendar with an owner and a paper trail. It's a day of work the first time and an hour a year after that. The alternative pricing — a citation, a denied claim, or an undefended lawsuit — is the version nobody chooses on purpose.
— Tom
Turn the register into actual training
LearningByDesign builds the courses your register calls for — objectives tied to the requirement, records that prove completion, and a calendar that keeps every renewal on time.
See how LearningByDesign works →