OHS Training Records and Official Inspection Compliance | Qulak

For legal counsel and OHS specialists, the critical question is: OHS training records and inspections how does an organization demonstrate that it has met its training obligations? A “completed” label on an LMS screen may not be enough on its own. The training plan, participant, content version, exam or assessment result, attendance information, authorization, approval, and change history should be readable together.

Article 17 of Occupational Health and Safety Law No. 6331 stipulates that training must be provided before work begins, when the job or workplace changes, and when equipment or technology changes, and that training must be renewed in line with new risks. The same article also raises the obligation not to employ people in certain jobs without a training and vocational training certificate. In current practice, legislation, sector, and organizational policy should be considered together; this article is not legal advice, but a framework for designing auditable digital workflows.

The official legislation announcement by the Union of Municipalities of Türkiye, reports that the regulation on employees’ OHS training was published in the Official Gazette dated April 2, 2026, and numbered 33212. Organizations should also check the current text for effective dates and transitional provisions.

Why are OHS training records and inspections a chain of records?

The Ministry of Labour and Social Security’s (ÇSGB) official statements emphasize that employers must provide employees with OHS training and that training should be linked to risks and changing conditions. Inspection preparation is therefore not just a matter of uploading certificates. An inspector may seek to understand which risks and duties the organization linked its training decision to, who attended, and whether the record was changed afterward.

The ÇSGB’s Frequently Asked Questions page on İBYS makes an important distinction: submitting data through software does not eliminate the obligation to prepare documents stipulated by legislation for the relevant service. This distinction is decisive when positioning a learning platform such as Qulak. Qulak can be designed to support the lifecycle and reporting of training records; the organization’s official documentation and notification obligations must be maintained separately.

How should timestamped logging be designed?

According to the Information and Communication Technologies Authority’s (BTK) explanation of e-signatures, a timestamp is a record verified by the electronic signature of an electronic certificate service provider, used to establish when electronic data was created, modified, sent, received, or recorded. This definition does not mean that every date-and-time field in an application is a qualified timestamp. The project design should clearly distinguish “application event time” from “authorized timestamp service.”

A log schema can be designed with Qulak according to the organization’s needs. For example, an employee opening training content, starting an exam, completing an exam, an instructor approving attendance, or a report being exported can each be treated as a separate event. For each event, fields such as event type, user or system actor, record time, content version, source device or session information, action result, and authorized role can be considered.

Minimum event flow for a record

1. Assignment: The employee’s role, location, risk profile, and relevant training rule are matched.
2. Delivery: The content, version, and training provider or instructor details are recorded.
3. Participation: The attendance or participation method, verification level, and reason for any exception are identified.
4. Assessment: The exam, survey, practical exercise, or instructor approval is retained according to the organization’s procedure.
5. Report: The report is exported together with management approval, output date, and the role that generated it.

How should a Ministry of Labour inspection PDF be prepared?

The ÇSGB’s official guidance titled “What Is a Labour Inspection? Who Is a Labour Inspector?” explains that an inspector may examine records, documents, lists, schedules, and reports that legislation requires to be kept or made available. For this reason, an inspection PDF should be prepared as a readable file that links the relevant records together, rather than as a one-page certificate.

With Qulak, based on the fields used by the organization, an inspection file template can be configured. This is not an official Ministry form and does not replace the inspection outcome. The aim is to make it easier for legal, OHS, HR, and audit teams to view the same dataset and have it reviewed by a person when needed.

With this structure, the PDF is positioned not as an “automated compliance certificate,” but as an evidence package that facilitates preparation before an audit. Adding the report version, generation time, data scope, responsible role, and a “requires internal organizational review” note at the bottom of the output reduces the risk of conveying unwarranted certainty.

Facial verification and personal data controls

If facial verification is being considered for OHS training, technical convenience should not take precedence over legal compliance. The announcement of the Personal Data Protection Board’s (KVKK) principle decision No. 2026/921, dated April 29, 2026,draws attention to the power imbalance in the employment relationship and the assessment of the proportionality and necessity of biometric data. The announcement states that less intrusive alternatives to biometric methods should be considered for tracking working hours.

This approach can also be applied to training participation. Before facial data or facial matching results are used, the purpose, legal basis, retention period, access role, and alternative verification method should be documented. The elements of a specific subject, provision of information, and free will in KVKK’s explanation of explicit consent should be taken into account. If no genuine alternative is offered to an employee who does not consent, relying solely on a checkbox should not be considered sufficient.

• Information notice: It is clearly explained what data will be processed, for what purpose, for how long, and by whom.
• Data minimization: Options that process less data and derived results are considered instead of storing facial images.
• Alternative verification: Options such as a PIN, organizational card, handwritten signature, instructor approval, or supervised check-in are added to the procedure.
• Human oversight: When an automated rejection, absence, or access revocation decision is required, review by an authorized person is ensured.

A process for these checkpoints can be designed with Qulak; the organization’s data controller, legal, and information security teams should verify which data processing model will be used, whether facial verification is truly necessary, and how it will be recorded in the personal data inventory.

How can an auditable training workflow be designed with Qulak?

When selecting an enterprise LMS, compliance is an end-to-end operating model rather than a single list of features. The topics of authorization, reporting, and content management covered in the enterprise LMS selection guide can be reconsidered in the OHS context. The first step is for the legal and OHS teams to draw up a list of the “evidence they want to see during an inspection.” The second step is to map these fields to the training, user, assessment, and reporting workflows in Qulak.

For example, a new employee can be assigned role-based training; steps that must be completed before work begins can be tracked through a workflow; and a record structure can be configured to report the training outcome not merely as a badge, but together with the relevant program, content version, and approval chain. This scenario is verified against Qulak’s current plan and integration scope. It should not be assumed that the same fields or integrations are ready for every organization.

If a connection to HR systems is planned, an architectural assessment like the one in the API and HRIS integration guide can be conducted. However, the details of data synchronization, identity matching, transfer of authorization, and error handling for this connection should be designed according to the organization’s existing systems. Naming an integration does not, by itself, mean official notification or İBYS compliance.

Frequently Asked Questions

Official research sources

Related Qulak content