How do you update training when a regulation changes?

Training needs a formal change process because obligations often require training to be suitable for current rules and risks, and an informal update usually misses assessments, records, or people already trained. For example, Australia's model Work Health and Safety Regulations require training to be suitable and adequate having regard to the risks associated with the work at the time the training is provided (regulation 39(2) of the Work Health and Safety Regulations 2011).

Some regulators say this directly. The Australian Transaction Reports and Analysis Centre (AUSTRAC) states in its AML/CTF training guidance that it expects training material to include updates on AML/CTF regulatory changes and emerging risks.

Recent reforms show why commencement dates and affected populations need careful tracking. Each of the following changed what training in the affected sector should say.

• AML/CTF reforms (Australia). AUSTRAC states that reforms to the AML/CTF Act commence on March 31, 2026 for businesses already regulated and on July 1, 2026 for newly regulated businesses in the legal, accounting, real estate, and jeweller sectors. See AUSTRAC AML/CTF training requirements.
• EU AI Act (European Union). Article 113 of Regulation (EU) 2024/1689 applies the Act in stages: Chapters I and II from February 2, 2025, and most other provisions from August 2, 2026. Regulation (EU) 2026/1744 then moved the high-risk requirements in Chapter III, Sections 1 to 3, to December 2, 2027 for Annex III systems and August 2, 2028 for Annex I systems. Training that still gives August 2, 2026 as the start date for Annex III high-risk obligations is out of date.

The method runs from monitoring to release and records an output at each step.

1. Monitor sources. Subscribe to regulator newsletters and set alerts on the official legislation registers for each jurisdiction where you operate, where they offer them. Output: a change log of items noticed, with dates.
2. Confirm the change. Read the primary instrument or guidance, not a summary. Note what changed, who it applies to, and every commencement date. Output: a change summary signed off by compliance or legal.
3. Trace the impact. Using your compliance obligations register and training map, list affected obligations, roles, learning outcomes, assessment items, and content items. Output: a completed impact assessment (template below).
4. Decide the treatment. For each item: minor edit, redesign, new item, or retire. Output: a treatment decision per item.
5. Update outcomes, assessments, and content together. Change the outcome first, then the assessment that tests it, then the content. Output: new versions, each with a version number and change note.
6. Review and approve. Subject matter and compliance review, with named approvers. Output: approval records.
7. Release and retrain. Release before commencement where possible. Assign delta training to people trained on the old version and full training to new starters. Output: assignment records and a completion target date.
8. Close out. Confirm completion, archive superseded versions, and note any period where training lagged the rule. Output: a close out note.

A change impact assessment records, for each affected item, what the change means for it and what will be done. The template below is original; the rows are an illustrative AML/CTF example, not advice on the reforms.

Usually not. People trained on the previous version generally need delta training covering only what changed, with a short assessment of the changed outcomes. Full retraining is warranted when the change is broad or when evidence shows the original training was not effective.

Record which version each person completed so you can target delta training precisely. That depends on disciplined version control for training content.

Before release, confirm that every affected item has been changed consistently and that the people who need the change will actually receive it. The checklist below is a practical final gate.

• Every row in the impact assessment has a treatment decision and an owner.
• Learning outcomes, assessment items, and content all reference the new rule, and no item still cites the superseded instrument, date, or threshold.
• Job aids, procedures, and quick reference guides linked from the training have been updated at the same time.
• Assignment rules target the right roles, including contractors and people who move into affected roles after release.
• Delta training is assigned to people who completed the previous version, identified by version rather than by course title.
• Superseded versions are archived, not deleted, so past completions can still be traced to what was taught.
• The approval record names who approved the regulatory interpretation and on what date.
• A date is set to check completion and to review early assessment results for signs the change was misunderstood.

If you find a gap between commencement and release, record it and the reason. That record, with the remediation, is more defensible than silence, and it feeds the next training library audit.

Knowledge Foundry connects obligations, concepts, learning outcomes, and assessment points in one framework with provenance. When a source changes, the affected outcomes and assessments can be traced from the source rather than found by searching course text.