One Compliance Programme, Many Countries and Languages: A Nordic Operating Model

Most groups discover the problem the same way. A compliance manager in Helsinki or Stockholm is asked how many people have completed the anti-bribery course, and finds that the answer exists in three systems, in two languages, against three different versions of the course, and cannot be reconciled into one number that anyone would defend in front of an auditor.

Underneath that reporting problem sits a legal one that is less visible and considerably more serious. Compliance training exists to discharge an obligation. If an employee cannot demonstrably understand the training, the employer cannot demonstrably discharge the obligation, and in a dispute the employer carries that risk. Language is not a convenience question in a compliance programme. It is part of whether the programme works at all.

Why English-only fails in a region with excellent English

Finland, Sweden, Norway and Denmark all score near the top of international English proficiency rankings, and the temptation to run everything in English is strong and cheap. It is also the most common structural weakness in Nordic compliance programmes.

The reason is the gap between conversational fluency and comprehension of a legal obligation under time pressure. An employee who is entirely comfortable in an English-language meeting may still process a scenario about improper benefits, or a definition of a suspicious transaction, more slowly and less accurately in a second language. Compliance training is precisely the case where that matters, because the whole point is that the person recognises a situation quickly, months later, while distracted.

There is a documentary dimension too. If a manager is later dismissed for breaching a policy, or a company argues that it exercised due care before an incident, the strength of that argument depends on being able to show that the person understood what was required. Training delivered in a language the employee has never worked in is a weaker foundation for that argument than training delivered in the language they actually think in.

Finland adds a further point that is often missed by groups headquartered elsewhere. Finland has two national languages. A Finnish employer with Swedish-speaking employees, concentrated on the coast and in Ostrobothnia, is not making an export decision when it considers Swedish. It is addressing its domestic workforce.

The obligations are not the same in each country

The deeper reason a Nordic programme cannot be a single translated artefact is that the underlying duties diverge. The EU sets the direction, but each country transposed on its own timetable, with its own thresholds and its own supervisor.

Cyber security is the clearest recent example. Finland brought NIS2 into force on 8 April 2025 through kyberturvallisuuslaki 124/2025, with registration due by 8 May 2025 and a risk management model by 8 July 2025, supervised through Traficom’s National Cyber Security Centre. Sweden brought its cyber security act, cybersäkerhetslagen (2025:1506), into force on 15 January 2026, with MSB coordinating and sector authorities supervising, and with the express statutory training duty aimed at the management body rather than at the wider workforce. For nine months a group with entities in both countries had materially different obligations in each, and it still has differently scoped training duties today.

Whistleblowing diverges on a different axis. Finland’s whistleblower protection act, 1171/2022, took effect on 1 January 2023, with internal channels required within three months and organisations of 50 to 249 employees given until 17 December 2023, and with a centralised external channel operated by the Office of the Chancellor of Justice. Sweden’s visselblåsarlagen (2021:890) phased its internal channel requirement, reaching employers with 50 to 249 employees by 17 December 2023, with Arbetsmiljöverket supervising and acting as the catch-all external authority. Norway sits outside that threshold logic entirely: under chapter 2A of the working environment act, undertakings with as few as five employees must have whistleblowing routines.

A group applying one threshold rule across the Nordics will therefore be wrong somewhere. A Norwegian subsidiary of thirty people needs routines that the same-sized Finnish or Swedish subsidiary does not.

Workplace conduct diverges again. Sweden’s restructured work environment regulations, effective from 1 January 2025, place specific requirements around kränkande särbehandling including an express duty to ensure that managers and supervisors have the knowledge to prevent and handle it. Finland approaches the same territory through the occupational safety and health act, the equality act and the non-discrimination act, supervised by the occupational safety authorities. The concepts are related but they are not translations of each other.

Translation is the wrong deliverable

Once the obligations differ, literal translation stops working, because the terms carry legal content.

Kränkande särbehandling is defined in Swedish work environment regulation and turns on conduct directed at one or more employees in an offensive manner capable of excluding them from the workplace community. Rendering it as bullying loses the definition. Rendering the Finnish epäasiallinen kohtelu as the same English word loses a different definition. A Swedish manager reading a course that says harassment where the law says kränkande särbehandling will not recognise the obligation as the one she is actually under, and the training will not do its job.

The workable model is one master and transcreated national versions. The master carries the argument, the structure and the scenarios. Each national version keeps the structure but replaces the framing law with the national instrument, names the national authority, uses the national legal terminology, and adapts scenarios to situations that occur in that market. This is more expensive than translation and considerably cheaper than the alternative, which is training that is technically available and practically ignored.

Deciding which languages you actually need

Decide by workforce composition rather than by country list. A Finnish manufacturer with a large Estonian-speaking production workforce may need Estonian more urgently than it needs Danish, even though it has a Danish sales office staffed by six people who all work in English every day.

The practical test is exposure. Take the roles with the highest compliance exposure, look at who actually holds them, and ask in which language those specific people would want to be asked a difficult question. Production supervisors, warehouse leads and field service staff are frequently the least served by English-only programmes and frequently among the most exposed.

Keeping versions synchronised

This is where multi-language programmes decay. A regulator changes something in one country, the local team updates its own version, and within two years the four language versions teach four different things.

Three disciplines prevent it.

First, version everything, so that each national variant records which master version it derives from and which national law it reflects.

Second, separate the durable content from the volatile content, keeping statute references, authority names, thresholds and dates in a clearly delimited section that can be updated without reopening the whole module.

Third, assign a named owner per country whose job is to flag national change, and a single owner of the master who decides whether a national change should propagate.

Governance: who owns what

The question that determines everything downstream is whether the programme is owned at group or entity level.

Group ownership gives consistency, one reporting view and lower unit cost, but produces exactly the failure Nordic subsidiaries complain about, which is training that does not reflect local law and that arrived without consultation. Entity ownership produces relevant training and unreconcilable reporting.

The arrangement that works is group ownership of the master, the standards and the reporting layer, with entity ownership of national accuracy and delivery, and a defined route by which an entity can require a change. Alongside that, build in the consultation step early. Rolling out mandatory training that creates new employee obligations engages co-operation obligations in Finland and co-determination practice in Sweden, and a group that treats these as a formality at the end of the project will lose weeks it did not plan for.

Reporting across entities

The end state to design toward is a single view showing, for any obligation, which people in which entities have received which version of which training in which language, and when. That is what an auditor, a supervisor or a board actually asks for, and assembling it manually from separate systems each time is the tax that most groups are currently paying without recognising it as one.

A worked example

Frequently asked questions