For works councils & employee representatives

Security where nobody is singled out.

Awareness must not turn into performance monitoring. With me there is no public shaming and no personal “who clicked” list for senior management. The team is evaluated as a whole – as protection, not surveillance.

Example scene for Works councils
“Is performance being monitored secretly here?”
“Will individuals be singled out if they click?”
“Is participation voluntary and fair?”
Model works agreement See prices
Your obligations

What you have to do – and what this lets you tick off.

The yardstick is § 87 BetrVG and the GDPR. Both can be settled cleanly with a short works agreement. Each point states openly whether I cover it, partly support it or whether it lies with your IT – linked to the matching attack scenario.

◐ partly
Co-determination on technical systems that can monitor behaviour or performance. · § 87 para. 1 No. 6 BetrVG
↳ covers: Phishing simulation

A phishing simulation can fall under co-determination. I provide the model works agreement and the information sheet so that the works council can approve before the start. The decision itself is yours.

✓ covered
No personal monitoring of behaviour or performance through the evaluation. · § 87 BetrVG, Art. 5 GDPR
↳ covers: Team report

The team report only shows rates per group. There is no “who clicked” list for management, and no result ends up in the personnel file.

✓ covered
Informing employees before the start about purpose, process and data processing. · Art. 13 GDPR, § 81 BetrVG
↳ covers: Information sheet

The information sheet for staff explains on one page what happens, what doesn’t happen and which data is generated.

✓ covered
Data minimisation and retention periods for simulation data. · Art. 5(1)(c), (e) GDPR
↳ covers: Team report

Only what is needed for the proof and the team report is stored; click data of individual people is archived after the run and not evaluated.

✓ covered
Training before the first test, so that nobody is “caught” without prior knowledge. · Fairness, working atmosphere
↳ covers: Process

Training first, then an announced test. The order is part of the product, not up for negotiation.

You will find the full comparison with ISO 27001, NIS2 and cyber insurance under Obligations & standards. Businesses generate their time-stamped proof of training directly in the Cockpit.

The works council package

Two documents that settle approval in a single meeting.

I provide both templates free of charge, without registration. They are deliberately short, written in plain German, and tailored to data processing at secureIT. Your own adjustments are explicitly welcome.

📝 Model works agreement (PDF)

Purpose, process, evaluation without personal data, retention periods, employee rights. Two pages, to fill in and sign.

 📄 Information sheet for staff (PDF)

One page for the notice board or a circular email: what is coming, what happens after a wrong click, who sees what.
Examples

This is what it looks like in practice.

Cockpit, team report, certificate and proof of training for a fictitious company with twelve people. All names and results are made up; the layout is exactly what you will see yourself later.

Cockpit The business Cockpit

Groups, registered people and the cost if everyone completes. From here you start training, an initial test or a repeat run.

Team report Team report in the Cockpit

The team’s click and data-entry rates, a comparison with all test runs, participation in training. Anonymised.

Team report Evidence PDF, page 1

Results at a glance and protection level with a recommendation. The PDF carries an authenticity QR code and is suitable for audits, insurers and NIS2 documentation.

Certificate Certificate of participation

Name, course, dates of training and practical test, reference to standards, signature and a verifiable certificate number with QR code.

Compliance evidence NIS2 compliance evidence

All training carried out, with time stamps and participation rates, mapped to the requirements. Also for ISO 27001, GDPR, the AI Act and cyber insurance.

Individual report Personal report

Each person sees only their own result: reaction to each test email, how the scam could have been spotted, and what their device gave away.

All example views
How I work with you

This is how my training works.

With me, fairness is not an add-on but built in: training comes first, then practice – announced and without a pillory. A wrong click is a learning moment, not an entry in the personnel file. That way, security grows with the team, not against it.

Three ways – you choose what suits you.

1 In person, by me

I train your team in person – on site or online, in conversation and with examples from your everyday work.

2 In-house with my materials

You run the training yourself: I provide the ready-made materials and you pass them on in-house – at your own pace.

3 Everyone online on their own

Everyone learns online the way they prefer – by text or video, at their own pace, choosing the content.

My recommendation

Train first, then test – deliberately in that order.

  1. Initial training

    First I equip your team (or you do it with my materials). Everyone starts with the same basic knowledge.

  2. Phishing test as a self-check

    Only then does the simulated attack follow – not as an exam, but as a self-check: everyone sees whether what they learned holds up in everyday work.

  3. A security culture, refreshed when needed

    Training and testing grow into a constructive security culture in your business, which you simply repeat when the time comes.

📊

Your status report is based on your team’s results after the training – it shows the level you set out to reach, not the unprotected starting point.

➕

New team members can be added later with one click: they immediately receive the online training materials and a first self-test – and join the next joint session or training with the same prior knowledge.

The reverse order – and why I advise against it.

From a management perspective, it often seems logical to assess the situation with a test first and only then decide whether training is needed. Technically that works – I can set it up for you.

A surprise test without prior training is exactly what you rightly warn against: people are tricked before they could have known better. That damages trust and the working atmosphere – and is delicate under co-determination law. A test without prior training only measures the starting point at zero. My approach turns this around: equip first, then check.

No subscription, as and when you need it, and always with my personal support.

AI in everyday work

AI tools are subject to co-determination. Here is a template for that.

Copilot, transcription, chatbots: as soon as AI tools can evaluate behaviour or performance, the works council has a right of co-determination under § 87 para. 1 No. 6 BetrVG (German Works Constitution Act). My model works agreement on AI sets out the principles, so that not every tool has to be negotiated separately: no performance monitoring, no AI decisions about people, training during working hours.

  • Model works agreement on AI, free of charge as a PDF
  • Training duty under Art. 4 of the EU AI Act as part of the agreement
  • AI course with certificate, without evaluating individual answers
See the AI course with certificate Model works agreement on AI (PDF)
Relevant for you

For your review.

Why nobody is singled out →

How evaluation, voluntary participation and data protection work together.

 How it works →

The complete process, transparent from start to proof.

 Questions for me →

Open points? I answer them personally – for the works council too.
FAQ

Frequently asked questions

Does the works council have to approve a phishing simulation?
In many cases, yes. A phishing simulation can count as a technical system capable of monitoring behaviour (§ 87 para. 1 No. 6 BetrVG, German Works Constitution Act). That’s why I supply the template works agreement right away, so the council can give proper approval before the start. Whether co-determination applies in an individual case is something to clarify with your council or your legal adviser; I don’t provide legal advice on this.
Does management see who clicked?
No. The team report shows rates per group, not names. The trained person sees their own result as a learning moment. There is no export of a personal click list for management.
What happens to the data after the test?
What is stored is what’s needed for the proof of training and the team report: who was trained and when, and the team rate. Individual click data is archived after the test run and not analysed further. Retention periods and scope are set out in the template works agreement.
Can the works council agree to “training only, test later”?
Yes. The training runs without a simulation; the phishing test is only unlocked after the council has decided. The proof of training is still created immediately.
Is this a subscription?
No. There is no subscription and no contract term. You book training and tests as you need them – once or on a recurring basis, whatever suits you.
What does it cost?
For businesses, €49 net per person, one-off: training, first phishing test run, team report, Cockpit and six months of monthly refreshers. Further test runs cost €22 per person. For individuals, the training with certificate costs €29 incl. VAT, but without team report, Cockpit and refreshers, hence the lower price. An initial conversation and the self-tests are free. Compare all services on the pricing page →
Does the effect of a one-off training actually last?
Not on its own, which is why I don’t stop at the certificate. Everyone who completes the course receives a short interactive lesson by email every calendar month for six months: under five minutes, no login, a different current topic each time. Keeping it short is deliberate; the effect comes from spreading it over time. In the Cockpit you see your teams’ completion rate and the average score. This refresher is included in the business price at no extra cost.
Do I need an IT department for this?
No. Setup takes about an hour: choose a course, add your team, get started. The proof of training is created automatically. If you like, I’ll set it up together with you.
How does training with you work?
However you prefer: I train your team in person (on site or online), you run the training yourself with my ready-made materials, or each person learns online at their own pace. My recommendation: train first, then run the phishing test as a self-check – that builds a security culture instead of putting people on the spot.
Will anyone on our team be singled out or monitored?
No. There is no public shaming and no personal “who clicked” list for senior management. The team is evaluated as a whole. A wrong click is a learning moment, not an entry in someone’s personnel file.
Does this cover GDPR, NIS2, ISO 27001 or insurance requirements?
It covers the awareness and training part of these obligations – including proof of training with a timestamp. I state openly what belongs to your technology/IT. You’ll find the full comparison under “Obligations & standards”.
What happens when staff change?
You add new team members later with a click: they immediately receive the online training materials and a first self-test, and join the next joint training with the same level of knowledge.
Do I get proof of training or a certificate?
Yes. Proof of participation and completion with date and timestamp is created automatically for each person – as audit-proof evidence for audits, insurers or your own documentation.
Does this also cover AI fraud and deepfakes?
Yes. Current tactics such as AI-assisted phishing, fake voices and deepfakes are part of the courses and simulations – in line with the AI literacy requirement of the EU AI Act.
Are schools and non-profit associations really free of charge?
Yes. For schools and non-profit associations the offer is free of charge – this matters to me personally.
How quickly can I start?
Right away and without a call, if you like: you register your business or institution yourself at /registrieren, add your team, choose the course and phishing templates and start the test run – all on your own in the Cockpit, set up in about an hour. To get a feel for it, there are the free self-tests. And if you’d rather have support, just send me a short message; I’ll get back to you personally.

Your question is not listed?

Ask me directly. You only need to give an email address if you want to receive my answer.

A quick confirmation that a human is typing here, not a bot.

Set up in an hour – no IT department needed.

Choose a course, add your team, get started. Proof of training is generated automatically along the way.

Add your team Test it yourself first

Set up in an hour, trained in a week.

Create a free account, add your team, unlock the course. You only pay when you start. Would you rather see what a test email looks like first? The self-test is free.

Add your team Test it yourself first