Mandatory training is the one area of learning where "good enough" is tempting and expensive at the same time. Topics like data protection, health and safety or anti-bribery have to be completed by everyone, on a deadline, with a record that an auditor can read. That makes the build-versus-buy question more interesting than it first looks.

The case for building in-house is usually about fit. Your own policies, your own tools, your own examples. A generic course about phishing feels generic, and people click through it. A short module built around the actual systems staff use can land better. The cost is not only the build itself. Someone has to keep it updated when a regulation or internal policy changes, host it, track completions, send reminders and produce reports. Those parts are easy to underestimate.

The case for buying is mostly about the surrounding machinery. A learning management system handles enrolment, reminders, completion records and reporting, and some come with ready-made content for common compliance topics. One example of this kind of product is described here: https://www.kallidus.com/learn-lms/ — its pitch is an LMS plus content to simplify compliance, develop people and move from learning activity to proving impact. Whether that fits depends on your size and your risks, so treat it as one reference point rather than a recommendation.

One common pattern is a split approach: buy the generic, regulation-driven topics and build only what is specific to your business, such as your own processes or a product your staff must understand.

Some questions that might help decide:
1. How often does the content need to change?
2. Who will own updates after the first launch?
3. Do you need to show more than completion, for example that behaviour changed?
4. How many people need to take it, and in how many locations?

How have other founders split this? Did you start by building and later switch, or the other way around? And what made you change your mind?