What to Put in a Compliance Training RFP: Requirements Tied to the Rules

Most training RFPs are written from a template that was last reviewed when the organisation bought a different kind of software. They ask about implementation timelines, user licences and support SLAs, and they are largely silent on the things a regulator will actually ask about when the training is tested.

This is a different kind of specification document: the requirements a regulated employer should put in a training tender because a named rule requires them, with the rule attached to each one. It is written for finance, healthcare and legal buyers in the UK and Ireland, and it is general information rather than legal or procurement advice.

Start from the evidence you will have to produce

The useful question is not "what does this platform do". It is "when a regulator asks me to prove that a named individual was competent to do a specific thing on a specific date, what can I hand over".

Work backwards from that and the specification writes itself. Every regulated training obligation in the UK and Ireland resolves into four evidential demands: who was trained, on what, when, and what the firm concluded about their competence as a result. A platform that cannot produce all four for an individual, on request, has failed regardless of how good the content is.

Requirements the rules actually impose

1. Individual-level records, retrievable by person and by date

This is the baseline. The FCA's training and competence regime in TC 3 and SYSC 28 is built on records kept for individuals. CQC Regulations 17 and 18 require good governance and properly qualified, competent and skilled staff, which in practice means a provider must be able to evidence training per person. Our guides to FCA training and competence records and the CQC equivalent set out the detail.

What to specify: export of a complete per-individual training history, in a machine-readable format, without vendor assistance. If producing an inspector's evidence pack requires raising a support ticket, you have bought a reporting dependency rather than a record system.

2. Retention that outlasts the contract — and an exit export

Regulated retention periods routinely run to five or six years, and in healthcare considerably longer. Training records are frequently needed after the employee has left and after the supplier contract has ended.

What to specify: the retention period the platform will hold records for; whether records for leavers are retained or purged; the format and completeness of a full data export at exit; and how long after termination the export remains available. Ask for a sample export, not a description of one. This is the single most commonly omitted clause in training procurement and the most expensive to discover late.

3. Dated, versioned content — and proof of which version was completed

Regulatory content changes. When a rule is amended, the question an inspector asks is whether staff were trained on the position as it stood at the relevant time.

What to specify: that each module carries a review date and a version identifier; that the completion record stores which version the person completed, not merely that they completed something; and the supplier's committed timescale for updating content after a regulatory change, with a worked example from the last twelve months. A supplier who cannot name a recent change they shipped, and how fast, is telling you something.

4. Accessibility, with the version named

Every employer owes a reasonable-adjustments duty under section 39(5) of the Equality Act 2010, and section 20(6) makes providing information in an accessible format an expressly reasonable step. Public bodies have a harder conformance obligation under the 2018 accessibility regulations, which cover staff-facing closed systems and point at WCAG Level A and AA without pinning a version.

What to specify: the WCAG version and level, when it was last independently tested, whether conformance covers the platform and the course content, what accessible alternative exists where a module falls short, and — critically — that completion via an accessible alternative still produces a normal completion record. Our guide to what accessibility law actually requires of compliance training covers why a conformance badge alone does not discharge the duty.

5. Assessment that evidences competence, not attendance

Several regimes draw an explicit line here. South Africa's fit and proper determination states that meeting the minimum training requirements "does not in itself serve as evidence" of competence — a formulation that captures what UK regulators expect in substance. Completion of a module is attendance. Competence is a conclusion the firm reaches.

What to specify: whether assessment results are recorded at question level or only as pass or fail; whether the pass mark is configurable by the buyer; whether re-sits are recorded or overwrite the previous attempt; and whether the platform can record a manager's competence sign-off as a distinct event from the learner's completion. That last field is what turns a training log into a competence record, and many platforms do not have it.

6. Mapping to the obligation, and who maintains it

Suppliers increasingly ship a mapping from their catalogue to a regulator's requirements. Treat the mapping as a deliverable with an owner and a review cycle, not as marketing.

What to specify: who maintains the mapping, how often it is reviewed, what happens when a regulator withdraws or replaces a framework, and whether you are notified. That last point is not hypothetical — CQC has announced it is replacing the single assessment framework and removing scoring, which will invalidate any mapping anchored to quality statements. A supplier whose mapping is pinned to a framework in the process of being withdrawn should be asked how and when they will re-anchor it.

7. Data protection specifics, not a generic clause

Training data is employee personal data, and completion records combined with assessment results are a performance record.

What to specify: the processing location and any sub-processors; the retention and deletion mechanics described above, which are a data protection matter as much as a records one; whether assessment detail is visible to line managers and on what basis; and the position on any analytics or benchmarking the supplier performs across customers. Ask whether the data processing agreement is the supplier's standard form and whether the schedule of sub-processors is contractual or merely published.

8. The commercial terms that bite later

Three specifics worth pinning down in the specification rather than in negotiation: how the licence counts users (named, concurrent or active, and what happens to a leaver mid-term); whether the price covers the whole catalogue or a selected subset, and what adding a module costs mid-contract; and whether content updates are included or chargeable. Our guide to assessing a compliance training provider goes further into the commercial evaluation.

Scoring it

Weight the evidential requirements above the experiential ones. A platform with an excellent interface and no version-level completion record will fail an inspection that a plainer platform survives. In practice, requirements 1 to 3 should be pass or fail gates rather than scored criteria: if a supplier cannot produce a per-person export, hold records for the retention period, and tell you which version of a module a person completed, nothing else they offer compensates.

Ask for evidence rather than assertions on each gate — a sample export, a sample individual record showing the version field, a named recent content update with its date. Suppliers who have built for regulated buyers will have these to hand. Suppliers who have not will offer to arrange a demonstration.

A note on public sector tenders

One technical point for contracting authorities. Regulation 42(8) of the Public Contracts Regulations 2015 expressly required technical specifications for procurement intended for use by staff of the contracting authority to take accessibility into account. Those Regulations were revoked on 24 February 2025 by the Procurement Act 2023, and section 56 of the Act — the successor technical-specifications provision — carries no accessibility wording. The underlying equality duties are unaffected, but tender templates that cite the 2015 Regulations now cite a revoked instrument, and that is worth a look before the next procurement goes out.

For the development side of what you are buying, structured CPD programmes are what the records above are evidence of — and specifying the record before choosing the content is the right order to do it in.

This guide draws on obligations set out in the regimes covered elsewhere in this library and on the statutory texts named above, read in October 2026. It is general information, not legal or procurement advice, and it is not a substitute for taking advice on a specific tender.