LMS in Europe: a guide for companies and training providers in the EU

What companies and training providers in Europe need from an LMS

Europe is one market with many rulebooks. The EU sets the main laws once, for 27 member states, and each country adds its own: labour law, funding schemes and the authority you answer to. The EU also has 24 official languages, so a company with staff in five countries often trains in five languages.

For a European buyer, the questions come in a familiar order: can we process learner data lawfully and know who touches it, what does the AI do and can we control it, can everyone use it, including people with disabilities, and will it pass our works council and our tender rules.

GDPR: learner data, processors and transfers

Every use of learner data needs a lawful basis under Article 6 of the GDPR. For staff training, that is usually a contract, a legal duty (for mandatory safety training, for example) or a legitimate interest. Consent is a weak basis at work: the EDPB says employees are rarely free to say no to their employer. Article 88 lets each country add its own rules for data at work, by law or by collective agreement, so check yours.

Your organization is usually the controller and the LMS vendor a processor. Article 28 says you may only use processors that give sufficient guarantees, under a contract that sets out what they may do. A processor needs your authorisation to bring in sub-processors, and the EDPB says you should know who every one of them is. If the LMS scores or profiles people at scale, a data protection impact assessment (Article 35) may be needed.

Data may leave the EU only under Chapter V. The EU-US Data Privacy Framework, adopted by the Commission on 10 July 2023, covers US companies that have certified under it. The EU General Court upheld it on 3 September 2025, and an appeal is pending at the Court of Justice (C-703/25 P). Other transfers usually rely on the Commission’s standard contractual clauses. Ask where every sub-processor sits, including AI model providers.

Classbase’s hosting region is confirmed during the demo, before anything is agreed. Whoever you talk to, ask these questions:

• In which country and data center are learner records, files and backups stored?
• Which sub-processors see the data, including AI model providers, where are they, and on which transfer tool?
• Will you sign an Article 28 contract that names the region and the sub-processors?
• How fast will you tell us about a breach? We must tell our authority within 72 hours where feasible.
• Can we export one learner’s full record, to answer a request within one month?

The EU AI Act and training

The AI Act (Regulation (EU) 2024/1689) has applied in stages since 2 February 2025. From that date, providers and deployers of AI systems have an AI literacy duty for their staff (Article 4), and some practices are banned, including emotion recognition at work and in education (Article 5). The Digital Omnibus on AI (Regulation (EU) 2026/1744), in force since 27 July 2026, softened Article 4: you must take measures to support your staff’s AI literacy, without guaranteeing any set level.

Annex III lists high-risk uses that matter here. In education and vocational training: deciding admission, evaluating learning outcomes, assessing the level someone should study at, and watching for cheating in tests. In employment: decisions on promotion or termination, allocating tasks, and monitoring or evaluating performance. Regulation (EU) 2026/1744 moved these obligations from 2 August 2026 to 2 December 2027. For AI built into products that EU safety law regulates, it moved them from 2 August 2027 to 2 August 2028.

What this means for an LMS: if the AI grades answers that count toward a qualification or a job decision, treat that as a possible high-risk use and plan for human oversight and records now. Ask any vendor which AI features it offers, who checks the AI’s grades, and what it logs.

Works councils and employee monitoring

In Germany, the works council has a right of co-determination over “the introduction and use of technical devices designed to monitor the behaviour or performance of the employees” (Works Constitution Act, section 87(1) no. 6). Section 98 adds a say in how in-company vocational training is carried out. An LMS records completions, scores and activity for each person, so bring the works council in before you choose.

The usual outcome is a works agreement that says which reports managers may see, how long records are kept and what the AI may do. Other countries have their own employee bodies and rules, so ask local counsel early. A platform makes this easier when roles limit who sees what and every action is logged.

Accessibility: the European Accessibility Act and EN 301 549

The European Accessibility Act (Directive (EU) 2019/882) has applied since 28 June 2025. It covers listed products and services, including e-commerce, consumer banking and e-books. A training provider that sells courses to the public online is likely in scope for that service. Microenterprises that provide services, with fewer than 10 staff and no more than €2 million in turnover or balance sheet, are exempt. An internal staff academy is not on the list.

Public bodies already follow the Web Accessibility Directive (Directive (EU) 2016/2102), and EU procurement law asks buyers to write accessibility into technical specifications for anything people will use (Directive 2014/24/EU, Article 42). The usual yardstick is EN 301 549, which builds on WCAG. Ask any vendor, us included, for a conformance report, and test the learner screens with a keyboard and a screen reader in the demo.

Many languages: what to check, and what Classbase supports

With 24 official EU languages, “multilingual” can mean two different things: the platform’s own screens, and the courses inside it. Check both. Ask which languages the admin screens, the learner app, emails and certificates come in today, and how a course is kept in step across languages when the source changes.

To be clear about Classbase: its own screens are in English, Arabic and Turkish today. Courses can be taught in the 40 languages the app lists, including German and French. The AI translates a course with your glossary, ready for review, and flags cards that need a new translation when the source changes.

Training you may have to prove: NIS2 and funded programmes

If your organization falls under NIS2 (Directive (EU) 2022/2555), the members of its management body must follow cybersecurity training, and cybersecurity training is one of the risk measures you must take (Articles 20 and 21). Member states had to apply it from 18 October 2024. Auditors will ask who was trained, on what and when.

Public money for skills comes with records too. The European Social Fund Plus has about €99.3 billion from the EU budget for 2021–2027, spent through national programmes. In France, since 1 January 2022, providers that want public or pooled funds such as the CPF or an OPCO need Qualiopi certification. In Germany, the Federal Employment Agency can fund employee training under section 82 of SGB III when the course runs more than 120 hours and both provider and course are AZAV-approved.

None of these schemes needs a special LMS, and Classbase has no integration with them. What they need is clean evidence per learner: enrollment, attendance, results, completion and the certificate, exported per group.

Buying an LMS in the EU: tenders and a checklist

Public buyers follow Directive 2014/24/EU above set values. For 2026 and 2027, that is €140,000 for supplies and services bought by central government and €216,000 for other contracting authorities. Buying training itself, rather than software, falls under a lighter regime from €750,000. Those tenders are published on TED, the EU’s tender site, and bidders usually fill in the European Single Procurement Document (ESPD) as a first self-declaration. Private companies often borrow the same shape for an RFP. Put these points in your requirements:

The UK and Switzerland

The UK has its own UK GDPR and Data Protection Act 2018, changed by the Data (Use and Access) Act 2025, which received Royal Assent on 19 June 2025 and is brought into force in stages. On 19 December 2025 the Commission renewed its decision that the UK protects data adequately, until 27 December 2031. The European Accessibility Act is not UK law, but it covers UK firms that serve consumers in the EU. The AI Act can still reach a UK provider whose system is used in the EU.

Switzerland’s revised Federal Act on Data Protection has applied since 1 September 2023, and the EU recognises Switzerland as giving adequate protection. Since 15 September 2024, Swiss data can go to US companies certified under the Swiss-US Data Privacy Framework. EU laws such as the AI Act reach Swiss firms that sell into the EU or whose AI output is used there.

How Classbase is designed to help

Classbase is an LMS and LXP built around AI agents, for training providers and corporate academies. You decide what the AI may do, action by action: Do it, Ask first or Never. Every action, by a person or an agent, is in the activity log. Grades the AI is unsure of wait for an instructor. Five roles limit who sees learner data, and a training provider can run each client company as its own organization, so Harbour Logistics never sees another client.

It supports SSO with OIDC or SAML plus SCIM, imports SCORM 1.2 and 2004, works with LTI 1.3 and sends xAPI to your record store. Certificates come in one or two languages, with a code and QR anyone can verify, and reports export as CSV.

Be clear on what it isn’t. Classbase holds no ISO 27001 or SOC 2 certification, we don’t claim any official integration, and we don’t publish a hosting region yet. Its screens are in English, Arabic and Turkish. It is designed to keep the records European rules ask for, and in the demo we say what is ready today. Book a demo with one of your own courses, and we’ll confirm hosting.