Statutory and mandatory training is the one part of NHS learning with a guaranteed annual budget, and most of it is e-learning that staff click through resentfully. The interesting change is not that immersive training might replace those modules. It is that the May 2025 mutual recognition agreement removed the repeated knowledge testing and explicitly kept local competence assessment, which is a different job, and one a slide deck was never going to do.
Key takeaway: Do not pitch immersive training as a replacement for the information governance module. Pitch it at the competence assessment that mutual recognition left behind, and at the three or four subjects where the underlying law asks for demonstrated practice rather than awareness.
What the framework actually is
The Core Skills Training Framework is written and maintained by Skills for Health, first developed in 2013, with the England version produced in partnership with what is now NHS England. The England version covers eleven subjects (Skills for Health):
Conflict resolution. Equality, diversity and human rights. Fire safety. Health, safety and welfare. Infection prevention and control. Information governance and data security. Moving and handling. Preventing radicalisation. Resuscitation. Safeguarding adults. Safeguarding children.
Its legal status is the thing people get wrong. The CSTF is not a mandate. Skills for Health describes it as “a national minimum standard”, and organisations “submit a Declaration of Alignment, confirming their training programmes are aligned to the Core Skills Training Framework subjects”. NHS England reports 89% of organisations have declared alignment. It is an alignment standard that almost everyone adopts, which is not the same as a legal requirement, and the distinction matters when you are deciding what you can change.
Worth noting: the published subject guides are dated June 2021. They are five years old.
Statutory and mandatory are not synonyms
Skills for Health, citing the framework, defines statutory training as training employers are legally required to provide as defined by law, and mandatory training as a requirement determined by organisations themselves (Skills for Health).
Apply that test honestly to the eleven subjects and the picture is uncomfortable. Very little of the list is statutory in the strict sense of a statute naming the training. Most of the time the law creates a duty of competence or safety, and training is simply the usual way of discharging it.
| Subject | Underlying driver | Does the law name training? |
|---|---|---|
| Fire safety | Regulatory Reform (Fire Safety) Order 2005, Article 21 | Yes, directly, including repetition and during working hours |
| Health, safety and welfare | HSWA 1974 s.2, MHSWR 1999 | Yes |
| Moving and handling | Manual Handling Operations Regulations 1992 | Partly, and HSE warns against relying on it |
| Infection prevention | Health and Social Care Act 2008 Code of Practice | Indirectly, via CQC regard |
| Safeguarding children | Children Act 2004 s.11 | No, the section does not mention training |
| Preventing radicalisation | Counter-Terrorism and Security Act 2015 s.26 | No, and the guidance says “should”, not “must” |
| Equality and diversity | Equality Act 2010, PSED | No, training is one way to evidence the duty |
| Resuscitation | Resuscitation Council UK guidelines | No statute, yet annual refresh at every level |
| Information governance | DPA 2018, UK GDPR, DSPT | Contractual and assurance, not statutory |
Two of these are worth dwelling on.
The Prevent duty is the cleanest example of the gap. Section 26 of the Counter-Terrorism and Security Act 2015 says only that a specified authority “must, in the exercise of its functions, have due regard to the need to prevent people from being drawn into terrorism” (legislation.gov.uk). Training appears only in the statutory guidance, phrased as “should”, and that guidance defines its own terms: must means legally required, should means expectation and good practice (gov.uk).
Manual handling is the opposite problem. HSE is unusually direct that awareness training is not the answer: “Training can be important in raising awareness and reducing risk, but it won’t ensure safe manual handling on its own.” HSE wants the task designed safe first, and where training does happen it expects practical demonstration “so trainers can correct unsafe practice” (HSE). An e-learning module with a drag and drop exercise does not correct anyone’s technique.
What changed in May 2025, and what did not
From 1 May 2025, staff moving between NHS organisations in England no longer repeat core statutory and mandatory training. NHS England gathered signatures from 262 NHS organisations, and forecast the change would save up to 200,000 days of staff time in the first year (NHS England). The wider programme forecasts up to 100,000 days a year from rationalisation (NHS England).
The subjects covered are the eleven CSTF ones plus the Oliver McGowan training on learning disability and autism.
Now the sentence that most write-ups skip. Organisations must still advise new starters that they will need to complete “local orientation, induction, other locally mandated training and periodic assessments of competence” for these subjects.
Read that carefully. What transfers is the knowledge component. What does not transfer is anything local: the layout of this building, the escalation ladder in this trust, the equipment on this ward, and the assessment that someone can actually do the thing. That is the work that remains, it is inherently local, and it is exactly the kind of thing that generic national e-learning cannot serve and a locally authored scenario can.
If you want the reason this is a growing category rather than a shrinking one, that is it.
One currency note for business cases: the promised replacement for the CSTF has not shipped. A Department of Health and Social Care written answer in February 2026 still described the CSTF’s eleven topics as the operative standard and said a new approach was expected “later this year” (UIN 111796). As of writing, nothing has been published. Plan against the CSTF.
While we are correcting things: there is no NHS document called an “NHS Mandatory Learning Policy Framework”, a phrase that circulates widely. What exists is NHS England’s National mandatory learning people policy framework, published April 2025, and it is a template for organisations “to adopt and adapt”, not a mandate (NHS England). It is an HR policy wrapper, not a training content standard.
Oliver McGowan: the one that is genuinely statutory
Section 181 of the Health and Care Act 2022 inserted a new section 21A into the Health and Social Care Act 2008, requiring providers to ensure each person working for them “receives training on learning disability and autism which is appropriate to the person’s role” (legislation.gov.uk). It applies to all CQC registered providers in every setting, including administrative and support staff.
The code of practice, published in June 2025, sets Tier 1 as 90 minutes of e-learning plus a one hour interactive online session, and Tier 2 as 90 minutes of e-learning plus a full day face to face, refreshed at least every three years (gov.uk).
The requirement that makes it unusual is that at least one person with a learning disability and one autistic person must be involved in co-production and co-delivery. A statutory instrument specifying who is in the room is rare, and it tells you something about what the legislation thinks works.
The evaluation of the trial backs that up, and it is the most useful evidence in this whole area for anyone arguing for scenario-based content. The National Development Team for Inclusion found that “over 80% agreed case studies, scenarios, and verbal discussions suited their learning style”, and that a blended model of e-learning followed by interactive sessions “proved most effective” while also being the cheapest, at £8 per person against £47 for the most expensive option (NDTi, June 2022).
The counterweights in the same report are worth carrying honestly. Only a small percentage preferred face to face. E-learning drew strong praise where it contained video of people with lived experience. And the hybrid model at Tier 2 did not work as well as either pure format. The evaluation also found something L&D teams should tattoo somewhere: more people said the shortest training was too long than said it of the longest. Perceived length tracks engagement, not minutes.
The e-learning completion metric is being abandoned anyway
The clearest signal that click-through completion has had its day comes from the Data Security and Protection Toolkit. Until July 2023 it required organisations to train at least 95% of staff using the national Data Security Awareness e-learning or a local equivalent. That target was removed. The requirement now is that all staff have “an appropriate understanding of information governance and cyber security”, assessed through a three-part model of training needs analysis, delivery, and evaluation of effectiveness (DSPT).
A national body looked at a completion percentage, concluded it was measuring the wrong thing, and replaced it with a requirement to evidence understanding. That is the direction of travel across all of this.
The frustration it responds to is well documented. The Department of Health and Social Care’s Busting Bureaucracy report recorded that clinicians said too much statutory and mandatory training “is either irrelevant to their role or too frequent”, and that repeating everything on moving organisation “disproportionally impacts staff who move frequently, such as F1 and F2 doctors on rotation” (DHSC, November 2020).
What CQC actually asks for
Regulation 18 of the 2014 Regulated Activities Regulations requires that staff “receive such appropriate support, training, professional development, supervision and appraisal as is necessary to enable them to carry out the duties they are employed to perform”. CQC’s guidance expects an initial training needs assessment reviewed “at appropriate intervals during the course of employment”, and states that “all learning and development and required training completed should be monitored and appropriate action taken quickly when training requirements are not being met” (CQC).
Nothing in Regulation 18 names a subject, a format or a refresher period. The test is competence to perform the role. A 100% compliance dashboard evidences completion, not competence, and the regulation asks for the second one.
So where does immersive actually belong
Not everywhere, and the pitch is weaker if you claim otherwise.
Poor fit. Information governance, equality and diversity, preventing radicalisation. These are awareness and policy subjects, nationally consistent, well served by short e-learning, and now covered by mutual recognition. Building scenarios for them is effort spent where there is no gap.
Good fit, three reasons.
First, the subjects where the underlying law wants demonstrated practice rather than awareness: moving and handling, resuscitation, conflict resolution. HSE explicitly wants unsafe practice corrected, which needs someone doing something observable.
Second, the local layer that mutual recognition deliberately left in place. Local orientation, local escalation routes, local equipment, and periodic assessment of competence. This is local by definition, changes when your building or policy changes, and is the clearest case for authoring your own rather than licensing someone else’s.
Third, anything where the learning depends on a situation rather than a fact. Safeguarding decisions, conflict de-escalation, and the lived-experience content the Oliver McGowan code builds itself around. The NDTi finding that scenarios suited over 80% of learners is a straightforward argument here.
Capture the local layer as 360° scenes of the actual ward or department, assess with decisions rather than multiple choice, and export completion to your LMS through SCORM or xAPI so the compliance record still lands where your reporting expects it. What you can add beyond completion is covered in what you can actually measure.
The short answer
Most CSTF subjects have a legal duty behind them but no statute naming the training, and the framework itself is an alignment standard rather than a mandate. The 2025 mutual recognition agreement removed the repeated knowledge testing and kept local induction and competence assessment, which is where immersive scenarios have a real job to do. Aim at the practical subjects and the local layer, leave the awareness modules alone, and measure understanding rather than completion, because that is what the regulators are now asking for.
The healthcare education pages cover how NHS teams are building this, and the Cardiff and Vale case study shows assessed scenario training in practice.