Let’s be honest about compliance training for a second. When you say those two words to just about anyone in an organization, including learning professionals, you get some version of the same reaction: a groan, an eye roll, maybe a resigned “oh, that.” It’s become the necessary evil of L&D. Something you check off, not something you actually think about.
And yet, no other learning program touches as many people or covers as much ground. Compliance training reaches nearly every employee in nearly every organization and it spans an enormous range, from a fairly benign walkthrough of the employee handbook all the way to life-and-death procedures depending on your industry. The stakes vary, but they’re never really low. Get it wrong and, depending on the situation, you’re looking at anything from a formal warning to fines in the millions to the actual inability to operate your business.
Here’s the paradox we’re stuck with: This is one of the most universal, highest-stakes categories of learning in the entire organization and it’s also the one we’ve been the least willing to touch. While the rest of L&D has spent the last several years getting more learner-centric, more strategic, more tied to real outcomes, compliance training has largely just… stayed put. Check the box. Get it done. Move on.
It Doesn’t Have to Be This Way
Here’s the thing: People don’t learn differently because the content happens to be regulatory in nature. The fact that something is compliance-related doesn’t mean the neuroscience of how people absorb, retain and apply information suddenly works differently. So, there’s no real excuse for treating it differently in terms of design. That means bringing in the same things we already value everywhere else in learning: multiple modes of delivery, interactive formats and a genuine reliance on how people actually think, remember and apply what they’ve learned.
That also means finally letting go of completion as the measure of success. For years we’ve talked about moving away from “did everyone finish it” as the metric for learning broadly and we’ve made real progress there; except in compliance, where completion is often still treated as the finish line. It’s time to shift that mindset. It can’t just be about finishing. It has to be about improving performance. Strategy, content, technology and how we measure all of it need to be realigned around actual business needs, even for content that feels mundane on the surface. Because here’s the truth: even the most boring-seeming compliance topic exists for a real business reason. The framing just can’t be “take this training or else.” That approach has run its course.
To be fair, we’ll never get away from this completely. Some compliance training is dictated wholesale by a government agency or third-party regulator and there’s only so much creative license you have there. But for everything else, and that’s most of it, there’s no reason we can’t take a fundamentally different approach.
What Good Actually Looks Like
I want to share a few examples pulled from our Excellence Awards library, because they make the case far better than I can in the abstract.
ByteDance (TikTok) partnered with Siyona Tech to build a gamified privacy compliance program called PrivacyFlix — yes, styled after Netflix — and rolled it out in seasons. Season one covered things like data retention and protections for young users; season two moved into data security and AI governance. Instead of dumping everything on employees at once, they released it as an ongoing experience, complete with diverse narrative styles (a Wild West movie trailer among them), badges for progress and a design that worked seamlessly across desktop, laptop and tablet so people could move between devices without losing their place. The results back it up: 97.3% of surveyed employees reported measurable knowledge gain, satisfaction scores hit 4.6 out of 5, genuinely outstanding for compliance training, and the company saw a real cultural shift, with employees treating privacy as part of the culture rather than a box to check, along with reduced exposure to regulatory fines and reputational risk.
FanDuel, working with Labyrinth Training, took a character-driven approach to anti-money laundering training, content that’s often mandated and can feel dry by nature. Rather than static PDFs, they built relatable, retail-sportsbook-style scenarios and created a persistent universe of recurring characters that showed up across their anti-money laundering, anti-bribery and privacy programs, almost like a Marvel Cinematic Universe for compliance. Their Director of Financial Crimes Compliance noted that employees started asking who the characters were based on; a sign people were actually paying attention, not just clicking through. The company’s own framing captures it well: Story beats obligation. Compliance training shifted from something people dreaded to something people actually talked about with each other.
Blue Cross Blue Shield of North Carolina, partnering with Aptara, took a different route. Back in 2023, they realized their attempts to gamify training had become overly complex and were eating up too much seat time, so they stripped things down and leaned into microlearning: a format that, for years, compliance professionals insisted couldn’t work (“people need to sit for 12 hours to be in compliance”). A standout piece was their “test me” pathway: a pre-assessment that diagnosed what employees already knew so they weren’t forced through redundant content. That single move cut down on wasted time significantly and made the experience feel far more respectful of people’s time. They also built hands-on scenarios around AI and data privacy risk, phishing identification and industry-specific issues like data destruction protocols, letting people practice judgment rather than just reading rules.
Nordea, working with InfoPro Learning, focused on Infosec training and reported some of the clearest financial outcomes of the bunch: more than $300,000 saved through design and process streamlining, another $240,000 saved through reduced seat time and nearly $70,000 saved by focusing content more precisely on what people actually needed. On top of that, year-over-year NPS improved and IT tickets related to security issues dropped by more than 50%. The program was highly modular, localized into four Nordic languages and built around real-world decision loops and AI-assisted character storytelling; something that’s become far more feasible now that AI can handle branching narrative logic that used to require building every path by hand.
None of these organizations lost sight of the regulatory requirement. They just refused to stop there.
Five Strategies Worth Stealing
Pulling from these examples and our broader research, a few high-level strategies stand out for anyone looking to rebuild their approach:
- Provide context. Explain why the training matters to the business and to the individual; not just that it’s required.
- Use a wider variety of tools and modalities. Click-through PowerPoints alone don’t work anymore, if they ever really did.
- Lean on neuroscience and cognitive science, the same way you would for any other learning program.
- Recognize achievement. Completing compliance training shouldn’t just mean avoiding a stern email. Genuinely acknowledge people for getting it done.
- Measure a variety of outcomes, not just completion rates.
That last point is worth sitting with. In our research, we asked companies a simple question: is your compliance training effective at meeting your organization’s needs? When we looked at how the “yes” group and the “not really” group measure success, the differences were telling. Companies that say their compliance training is *not* effective tend to lean almost entirely on less strategic measures: Did we meet regulatory requirements, do we have a safe work environment, are we mitigating risk? Important, but not exactly ambitious. Companies that say their training *is* effective are far more likely to also track strategic outcomes: business performance, employee development, corporate citizenship, becoming an employer of choice. They’re not just trying to stay out of trouble; they’re using compliance training as a genuine extension of their learning strategy and their culture.
The Bottom Line
It really is possible to reimagine almost all of compliance training; not despite the regulatory pressure, but alongside it. The organizations that are getting this right aren’t ignoring their compliance obligations. They’re just refusing to let “we have to” be the whole story. They’re asking what outcomes actually matter, applying the same design thinking they’d apply to any other learning program and treating the people going through the training like people, not boxes to check.
The regulatory requirement isn’t going away. But the gap between “we’re in compliance” and “our people actually understand and act on this every day” is exactly the space where the real work happens. That’s where the opportunity is.
