Ask people who build compliance training what it is for, and many will answer honestly. One instructional designer described it as the open secret of the field: compliance training exists to prove that the company did what the law or its insurer requires, not to teach anyone anything (Reddit, r/instructionaldesign).
Employees notice. In Gallup's panel of 13,583 US employees, only 10% strongly agreed that their compliance training had changed how they do their work (Gallup).
The checkbox is not going away, and it shouldn't. But in 2026 the people who review compliance programs, from US prosecutors to EU regulators, no longer stop at the checkbox. This guide covers what the evidence says about compliance training, what regulators now ask, and how to design a compliance training program that still ticks the box and also changes decisions.
EP 02Key takeaways.
- In the largest controlled study of security training to date, trained employees failed phishing tests only 1.7% less often than untrained ones on average.
- Format and framing matter. In one field study, in-person training reduced misconduct reports and video training showed no measurable effect. The effect also faded after about two months.
- US prosecutors explicitly ask how companies measure training effectiveness and whether training changes behavior.
- In the EU, DORA, NIS2 and the AI Act all now include training or literacy duties.
- Design compliance training around the risky decisions people actually face, not around the policy document.
What the evidence says about compliance training
Four studies are worth knowing before you plan next year's program.
1. Phishing training: a 19,500-person randomized trial. Researchers at UC San Diego ran an eight-month randomized controlled experiment with ten simulated phishing campaigns sent to more than 19,500 employees of UC San Diego Health. They found no significant relationship between how recently someone had completed annual security awareness training and whether they clicked. Embedded training, shown right after a failed simulation, produced a statistically significant but small effect: trained groups failed only 1.7% less often on average. Engagement was the core problem. More than half of training sessions ended within 10 seconds, and fewer than 24% of users formally completed the training material (Ho et al., IEEE S&P 2025).
2. Compliance training and misconduct: field data from a multinational. In a Harvard Business School field study supervised by Eugene Soltes, Jihwon Park analyzed proprietary training and misconduct-allegation records from a large multinational. In-person training was followed by a measurable drop in misconduct allegations, while video training showed no detectable effect. The effect lasted only about two months, and it was weaker where employees faced strong pressure to perform (Park, 2020). Training worked when people paid attention, briefly, unless incentives pushed the other way.
3. Harassment training: framing can backfire. Sociologists Frank Dobbin and Alexandra Kalev found that harassment training aimed at managers, which treats them as allies and gives them tools to intervene, was followed by more women in management. Training that treats employees as potential offenders can backfire. They recommend bystander-intervention training as the most promising alternative (Dobbin & Kalev, PNAS 2019; HBR 2020). The research is largely correlational, and some of the apparent "backfire" may reflect higher reporting, but the message about framing is consistent.
4. How employees rate it. In the Gallup data, 23% rated their compliance and ethics training as excellent. In-person training was rated excellent by 30% and web-based training by 17% (Gallup). The fieldwork dates from 2018, but no newer independent survey of this size has replaced it.
Put together, the studies don't say that compliance training is useless. They say that the usual format (annual, generic, click-through, built around policy text) produces attendance, not behavior. Format, framing, timing and incentives decide whether anything changes.
What regulators and auditors now expect
This section is general information, not legal advice.
US: the DOJ asks whether training works
The US Department of Justice's Evaluation of Corporate Compliance Programs, the guidance prosecutors use to assess a company's program (current version updated September 2024), asks directly: "How has the company measured the effectiveness of the training?" It continues: "Has the company evaluated the extent to which the training has an impact on employee behavior or operations?" It also asks whether training covers lessons learned from the company's own incidents and from those of other companies in the same industry (DOJ ECCP).
Hui Chen, the DOJ's former compliance counsel and principal author of the original 2017 guidance, has long argued that a program should be judged by whether it works, not by whether it was carried out (JD Supra). Completion rates answer the second question, not the first.
Industry benchmarks agree
NAVEX's 2026 State of Risk & Compliance report states that training completion rates are still useful but are not enough to measure whether a program is effective (NAVEX 2026). Practice lags behind. LRN's 2026 Program Effectiveness Report, based on surveys across eight countries and 26 industries, found that only 34% of programs actively use data analytics to evaluate compliance, even though 39% already use AI in compliance training (LRN 2026). Organizations are automating content faster than they are measuring its effect.
EU: training duties are multiplying
- DORA (Digital Operational Resilience Act, applicable since January 2025) requires financial entities to include ICT security awareness and digital operational resilience training as compulsory modules for staff, including senior management (Art. 13(6)).
- NIS2 requires members of the management bodies of essential and important entities to follow cybersecurity training, and encourages those entities to offer similar training to employees regularly (Art. 20(2)).
- The AI Act requires providers and deployers of AI systems to take measures that support AI literacy among staff who use those systems (Art. 4). The Digital Omnibus, in force since 27 July 2026, softened the original wording: organizations no longer have to guarantee a sufficient level of literacy for each individual, but they do have to act, and documenting those measures is the practical expectation (Lewis Silkin).
Labor inspectors look at the same thing in more traditional areas. Slovakia's labor inspectorate checked 21,253 employers in 2025 and recorded 29,809 occupational health and safety deficiencies. Shortcomings in informing and briefing employees were among the most frequent (NIP 2025 report). A signature shows that someone received a briefing. It doesn't show that they understood it.
5 reasons compliance training fails
1. It's built from the policy, not from the decisions. Subject experts want everything included. In one documented case, a VP sent the instructional designer a 147-slide deck for a data privacy module, insisting that learners needed to know everything (Reddit). Another module scoped at 45 minutes grew to two and a half hours after repeated additions (Reddit). Length goes up and attention goes down.
2. It teaches common sense and skips the hard calls. A former compliance professional summed it up on an instructional design forum: people don't need training in common sense, they need help with higher-level decisions (Reddit). "Don't take bribes" is easy. "Is this dinner invitation from a supplier during a tender acceptable?" is not.
3. It treats employees as suspects. Dobbin and Kalev's findings suggest that a tone of "here is what you must not do" invites resistance. Treating people as allies who can intervene gets better results.
4. It comes once a year, and the effect lasts weeks. If a training effect fades after about two months, as in Park's field study, an annual dose leaves most of the year uncovered.
5. Incentives contradict it. Park found that the effect of training was weaker under strong performance pressure. Julie Dirksen makes the same point from learning design: if the system rewards the risky behavior, training alone won't change it. In some companies, compliance training completion even counts toward bonuses and raises (Reddit). That rewards finishing the module, not making better decisions.
How to design compliance training that changes behavior
1. Start from the risky decisions
Use Cathy Moore's action mapping. Begin with the business risk, list what people must do in the moments that create that risk, design practice for those moments, and add information last. For anti-bribery, the decisions might be: accepting or declining a gift during a tender, handling a facilitation payment request, or responding when a colleague bends the rules.
2. Write realistic scenarios with plausible wrong answers
The NAVEX guidance on scenario-based compliance training describes the formula well: a recognizable situation, a meaningful decision and feedback that explains why a choice is appropriate or risky (NAVEX). The wrong options must be tempting. If the right answer is obvious, the scenario only tests reading. Practitioners say the most common flaw is unrealistic scenarios written by people who don't know the work (Reddit), so get scenarios from the people who face the situations.
3. Make it role-specific and treat managers as allies
A warehouse supervisor, a sales manager and a procurement specialist face different risks. Eugene Soltes has criticized one-size-fits-all group compliance programs (Deloitte). Give managers their own track: how to respond to a report, how to model the standard under pressure, how to intervene.
4. Keep the annual module, add short refreshers
Keep the annual module for the legal record. Add 3- to 5-minute scenario refreshers every two or three months, timed around real risk moments: before a tender season, before year-end deal pressure, after an incident in your industry. This also answers the DOJ question about lessons learned.
5. Keep the checkbox, and make it produce evidence
Completion is still needed. The goal is a record that also shows understanding: what each person decided in realistic situations, which mistakes are common, and where a policy or process is unclear. That is the evidence the DOJ questions point to, and the evidence Gallup's 10% suggests most programs lack.
6. Fix the incentives with the business
If a sales team is paid in a way that rewards the risky behavior, take the training results to the business owner. A pattern of wrong decisions across a whole team is often a process or incentive finding, not a training finding.
How to measure compliance training effectiveness
| Level | What you measure | Example indicator |
|---|---|---|
| Reach | Who completed it, when | Completion by role and deadline |
| Understanding | Can they recognize the rule? | Knowledge check, first attempt |
| Decision competence | Do they make the right call in a realistic case? | Share of correct decisions in scenarios, before and after, and after 8 weeks |
| Behavior | Does it show up at work? | Quality of hotline reports, phishing reports vs. clicks, audit findings |
| Outcome | Does risk go down? | Substantiated incidents, regulatory findings, losses |
Most programs report only the first row. The third row is the one L&D can own without waiting for other teams' data. For a full framework, see our guide on how to measure training effectiveness.
Where AI fits in compliance training, and where it doesn't
AI makes it cheaper to produce compliance content, and LRN's data shows that many organizations already use it for that. But faster production of the same click-through module only produces the checkbox faster. Used well, AI makes realistic practice affordable: an AI character can play the supplier, the pushy client or the colleague asking you to bend a rule.
Two guardrails matter:
- People define the decisions and the standard. The scenario, the consequences and the debrief should follow your policy and your risk assessment, not an AI model's general view of ethics.
- Label AI characters as AI. Under Article 50 of the EU AI Act, people must be informed when they interact with an AI system, and the transparency obligations apply from 2 August 2026 (AI Act Art. 50).
For how AI role-play compares with branching scenarios, see AI Role-Play Training vs. Branching Scenarios.