EU obligations arrive as directives that each member state transposes into its own statute, so the requirement is common but the implementing law is local. Greece is shown here as the worked example, since it is where our hospitality curriculum is built. Every requirement below gates certification for the roles it applies to.
Each requirement below gates certification for the functions it covers. Nobody completes a role path in EU without clearing the items that apply to them first.
Employers must assess risk, put preventive measures in place, and ensure every worker receives adequate safety training on recruitment, on transfer, and when new equipment or technology is introduced. Training must happen during working hours and at no cost to the worker.
Premises must have evacuation procedures, designated responsibilities and staff who know how to execute them. Requirements attach to the building and its occupancy, not to the size of the employer.
Food business operators must ensure that anyone handling food is supervised, instructed and trained in food hygiene matters commensurate with their work, and that those responsible for the HACCP procedure have received adequate training.
Personal data must be processed lawfully and securely, with staff who handle it aware of their obligations. Article 8 sets a separate consent age for children that varies between member states, so youth-facing organizations need a distinct approach rather than a reused adult policy.
Organizations with 50 or more workers must operate an internal reporting channel, acknowledge reports within seven days, respond within three months, record every report including verbal ones, and prohibit retaliation. Greece transposed this as Ν.4990/2022, which also requires a formally appointed Officer.
Employers recruiting for professional or organised voluntary work involving direct and regular contact with children are entitled to request criminal conviction information for child sexual offences and any resulting disqualification. Convictions in other member states are exchanged through ECRIS.
Greece has transposed ILO Convention 190, requiring employers to adopt a policy against violence and harassment, to operate a procedure for receiving and examining complaints, and to designate a person responsible for it.
The European Accessibility Act applies from June 2025 to in-scope products and services, covering facility and digital accessibility. Staff training is how those obligations are met at the point of service: train guest-facing staff to handle accessibility requests.
This summary is built from publicly available regulatory sources and is not legal advice. It is not a determination that a given requirement does or does not apply to your organization, and requirements change. Confirm applicability with local legal counsel.
The requirement set is decided by two things: the cluster your business sits in, and the function each person performs. The same method applies in all three jurisdictions — only the statutes underneath change.
Which relationship your people are in decides which mandatory layer they carry.
Every function resolves to one of two seats, on a single test: direct contact with guests, minors, cash or confidential records.
Sports functions — Employee, Manager & Supervisor, Contractor, and Non-Employee or Volunteer with Access to Minors — resolve the same way. Access to minors puts a function in the high-contact seat regardless of employment status.
Groups running across borders get one process built to the strictest applicable standard, rather than three parallel programmes that drift apart. Tell us where you operate and we will map it.