Anyone who has had to cover mandatory training (data protection, health and safety, anti-bribery and similar topics) eventually hits the same decision: build the e-learning course yourself or buy an off-the-shelf one. I'd like to hear how people here weigh it up, because the trade-offs look less obvious than they first seem.

Arguments usually made for building:
- The content can reflect your own policies, systems and wording, so people see their real workplace rather than a generic example.
- You control updates when a procedure changes.
- Tone and branding can match the rest of internal communication.

Arguments usually made for buying:
- A course on a standard topic already exists, so the time goes into rollout rather than scripting and design.
- Regulatory topics are the same for many organisations, so there is little to gain from reinventing the basics.
- Someone else maintains the content when the rules shift.

One page worth a look when comparing is this overview of off-the-shelf e-learning courses: https://www.kallidus.com/resources/elearning-off-the-shelf-courses/. Kallidus describes what it offers as a learning management system plus content to simplify compliance and develop people, which is the kind of setup this question is about.

A middle route also seems common: buy the generic compliance base, then build short custom modules for the parts specific to your organisation, such as your own reporting routes or local rules. It also raises the question of how the two parts feel to a learner when the styles differ.

Questions I'd like to put to the thread:
1. Which mandatory topics are genuinely worth building, and which are not?
2. Who owns updates after launch, and how is that tracked?
3. How do you judge whether a bought course fits your people, beyond the demo?
4. If you went hybrid, where did you draw the line?

Stories of what worked and what had to be redone would be the most useful, including cases where a bought course turned out to be a poor fit.