What is in the CoreSkills library: statutory training that knows its provisions

In brief

The CoreSkills library is a ready-made body of training for the obligations that apply to almost every Finnish workplace: data protection, cybersecurity and artificial intelligence. The courses are written from statutes, and each one says which provision it rests on. They are cut into six-minute lessons and assembled into learning paths, of which the certifying ones end in an exam and a certificate. The library is shared by every customer and grows every week: a new statute or a changed provision shows up in the courses, not in next year's training day.

Three strands and the sectors

The library's backbone is three strands.

Data protection teaches what the GDPR, the Finnish Data Protection Act and the Act on the Protection of Privacy in Working Life require of every employee, and separately of the data protection officer, supervisors and HR: lawful bases, data subjects' rights, recognising and reporting a personal data breach.

Cybersecurity and NIS2 covers cyber hygiene for the whole workforce, that is phishing and social engineering, passwords and multi-factor authentication, remote work, malware and data classification, and for management and IT the obligations of the Cybersecurity Act: scope, risk-management measures, incident reporting and management's liability.

Artificial intelligence starts with the AI literacy that Article 4 of the AI Act requires of every deployer, and continues to the competence of an AI officer: risk classes, the obligations of a deployer of a high-risk system and human oversight. The amendment brought by Regulation (EU) 2026/1744 is in the library as a statute of its own, and the course that covers it reads both texts.

On top of the strands are sector courses. Health and social care has a data protection path resting on the Client Data Act, industry has OT security for production environments and cyber security for building automation, and subcontractors have a course on what a NIS2 customer's contract brings. A sector does not narrow the library but orders it: the organisation's own sectors come first, courses for everyone next and other sectors' courses last, and nothing is hidden.

Learning paths that end in a certificate

A learning path is what gets assigned and completed. It consists of skills and a required level for each, and skills accrue from courses. A certifying path ends in an exam, and a passed exam is claimed as a certificate valid for twelve months.

Learning path	Required level	Pass mark	Which obligation
Data protection essentials	2	75 %	GDPR: staff competence
Cybersecurity essentials	2	75 %	Cybersecurity Act: cyber hygiene
AI literacy	2	75 %	AI Act, Article 4
Data protection in health and social care	2, one skill at 3	75 %	Client Data Act
Management's cybersecurity duty	3	80 %	Cybersecurity Act: management training
AI officer competence	3–4	80 %	AI Act, Article 26
Data protection officer competence	4	80 %	GDPR, Articles 37–39
Information security officer competence	4	80 %	Cybersecurity Act, ISO/IEC 27001

The levels say what the competence is used for: a level 2 practitioner acts correctly in their own work, a level 3 owner is responsible for the matter and guides others, a level 4 expert resolves edge cases too. A responsible role's path requires more at a higher threshold and level, not a longer exam: every exam is three parts of ten questions, six minutes each. How the exam and the certificate work is covered in Exam and certificate.

A course that knows its provision

Every course in the library is written from named sources, and the statute is the most important of them. Statutes live in CoreSkills' own statute library as versions and provisions: the GDPR, the Data Protection Act and the Working Life Privacy Act, the AI Act and the Omnibus that amended it, the NIS2 Directive and the Cybersecurity Act, the Client Data Act, the Information Management Act and the Whistleblower Protection Act among others. A course and an exam question cite a provision, and a statute's wording is reproduced exactly or not at all.

Two things follow that set the library apart from a course video. First, the learner and the supervisor see what a claim rests on: the course ends with its sources, and the provision can be opened. Second, a change in the law is not missed. When a new version of a statute arrives, the exam questions resting on the changed provision are flagged for review, and the exam does not ask them until a person has checked them. The course is updated for the same reason, and a new course is written from a new statute within the same day, with a person's check.

Who checked it

Courses are written with AI. That is why every course's card and page say who checked it.

AI-generated, AI-checked means the automated check has run: the text does not repeat a licensed source verbatim, and the check's findings, for example claims it found no support for in the sources, are recorded in the course's review report for its reader. The label says a check was made; it does not guarantee the text is free of errors. AI-generated, checked by a person means someone has read and approved the course, and the approver's name and date are recorded.

The label tells the reader what they are reading. It does not affect the certificate: a certificate always rests on an exam whose questions a person approved one by one, and the exam never asks a question only AI has approved.

What the library is not

The library is not a course catalogue from which everyone picks what interests them. It is built backwards from obligations: first what the sector must know and what the requirement rests on, then the skills and levels, and only then the courses that teach them. That is why a path can be assigned to a job role, and why its completion counts as evidence.

Nor does the library replace the organisation's own guidelines. Onboarding, the organisation's own security policy and the sector's special instructions are made from the organisation's own material in the same form, and they accrue to the organisation's own learning paths. That is covered in From your own material to training.

How the library is used

The administrator picks the organisation's sectors, invites the staff and assigns learning paths by job role or to everyone, with or without a due date. The employee gets the path's next step in the day's plan, six minutes at a time, and the administrator sees from the reports who is on pace and who holds a valid certificate. What that looks like when a supervisor asks for a report is covered in Training evidence for the regulator.