The way I approached these kinds of requirements was with a simple custom list for ease of assignment by the compliance officer and a workflow to create an item on a task list assigned to the end-user.
The compliance officer creates a new item on the "assign policy or training" list - this consists of a multi-select people picker (for choosing which employees need to acknowledge they have read the materials) and a multi-select choice column with checkboxes for which materials need to be read and acknowledged (for each of the various policies which need active responses - different departments here get different training assignments and policies).
A workflow fires on these new item creation in the assignments list, which creates a task for each user of the type(s) matching what was checked-off as required. The workflow then sends an email to each user with the compliance text telling the user what to do (follow this link, read the text, acknowledge read).
The link takes them to the customized edit task form, which was modified to embed the relevant materials (pdf file, video training, etc.) and ends with a checkbox labeled "I have read and understood the RequiredPolicyThing".
The legal department wanted a checkbox requiring the user actively acknowledge having received and read the policy - just counting them as having read the policy when they just click on the link to it, with no indication that the link even necessarily worked for them (maybe they had a browser issue which blocked the pdf embed?), would not have met legal requirements.
This was fairly easy to set up - and I have a list with each user, the time it was assigned, time stamp of when they acknowledged it, and a checkbox showing they have actively acknowledged the policy. Also a simple view will tell the compliance officer who hasn't completed it, and I even threw in a past-due view (created date plus X days and not completed) for easy followup.