vault by thejojiz

Law & Regulation

CQC Regulations and Fundamental Standards

The fundamental standards every registered provider must meet, the statutory notifications, and how CQC assesses services in 2026.

Last reviewed 5 min read England focused
All key points
practice cue

For each standard, ask three things: what does the person experience, what do staff do, and what evidence shows the system working?

In plain English

The fundamental standards are the floor, not the ceiling. They describe the care everyone has a right to expect: care that is personal to them, respectful, given with consent, safe, and provided by enough properly supported staff, in a service that is honest when things go wrong.

Every provider carrying out a "regulated activity" — personal care at home, residential care, nursing care and so on — must register with the Care Quality Commission and then keep meeting these standards continuously, not just on inspection day. CQC checks through assessments, evidence gathering and site visits, publishes ratings, and can take enforcement action ranging from requirement notices to cancelling registration or prosecution.

If you work in care, you already deliver these regulations in small actions: offering choice at breakfast (Reg 9), closing the bathroom door (Reg 10), asking before you help (Reg 11), checking the hoist sling (Reg 12), reporting a bruise you cannot explain (Reg 13), and writing notes that are accurate and complete (Reg 17).

The regulations themselves

The fundamental standards sit in the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014:

  • Reg 9 — Person-centred care: care and treatment must be appropriate, meet needs and reflect preferences.
  • Reg 9A — Visiting and accompanying: added in 2023 — people in care homes must be able to receive visitors, and to be accompanied at appointments, without unreasonable restriction.
  • Reg 10 — Dignity and respect: including privacy, autonomy and independence.
  • Reg 11 — Need for consent: care must only be provided with consent, or lawfully under the Mental Capacity Act 2005.
  • Reg 12 — Safe care and treatment: risks assessed and mitigated, premises and equipment safe, medicines managed properly, infection risks controlled.
  • Reg 13 — Safeguarding from abuse and improper treatment: systems to prevent abuse, neglect, degrading treatment and unlawful restraint or deprivation of liberty.
  • Reg 14 — Meeting nutritional and hydration needs.
  • Reg 15 — Premises and equipment: clean, secure, suitable, properly maintained.
  • Reg 16 — Receiving and acting on complaints.
  • Reg 17 — Good governance: systems to assess and improve quality, manage risk, and keep accurate, complete, contemporaneous records.
  • Reg 18 — Staffing: sufficient numbers of suitably qualified, competent, skilled and experienced staff, with support, training, supervision and appraisal.
  • Reg 19 — Fit and proper persons employed: recruitment checks including DBS, references and history.
  • Reg 20 — Duty of candour: being open and honest after notifiable safety incidents, including apology.
  • Reg 20A — Display of ratings.
  • Reg 5 (for the organisation) — fit and proper persons: directors.

The CQC (Registration) Regulations 2009 add registration requirements and statutory notifications: deaths, serious injuries, allegations of abuse, applications to deprive someone of their liberty and their outcomes, police incidents, and events that stop the service running safely. "Without delay" means exactly that.

How CQC assesses — and what is changing

CQC currently organises evidence under five key questions — is the service safe, effective, caring, responsive and well-led — using its single assessment framework and quality statements, and awards ratings of Outstanding, Good, Requires Improvement or Inadequate. Evidence can be gathered at any time, not only during visits: notifications, feedback, data and documents all count.

2026 transition: following well-publicised criticism and an improvement programme, CQC consulted through 2025–26 and published draft sector-specific frameworks in March 2026, with the adult social care consultation closing in June. For adult social care the change means 24 key lines of enquiry in place of the 34 quality statements, "rating characteristics" describing what each rating looks like built into the framework itself, and the complex numerical scoring removed in favour of professional judgement — while the five key questions and the four-point rating scale continue.

A pilot with selected providers is running from June to October 2026, with CQC's evaluation due in November and go-live expected towards the end of 2026. Until your service is switched over, the existing framework still applies — check CQC's website for the current position rather than relying on secondhand summaries.

Whatever the framework, the underlying regulations above do not change with it: they remain the legal baseline, and enforcement continues to flow from them.

Good practice
  • Map your evidence: for each regulation, know where the proof lives — audits, care plans, training matrix, complaints log, meeting minutes. If it took an inspection to find it, it was too hard to find.
  • Treat notifications as a reflex, not a debate. A short internal flowchart — "incident happens → is it notifiable? → who sends it, by when" — prevents late notifications, which are themselves a breach.
  • Practise the duty of candour: a same-day phone call, an honest explanation, a written apology where required, and a record of all three. Apologising is not admitting legal liability.
  • Make Reg 17 your friend: honest audits with actions that actually close. An audit that finds nothing every month is not reassurance, it is a warning sign.
  • Keep staff files inspection-ready (Reg 19): DBS, two verifiable references, right-to-work, gaps in employment explained.
Everyday examples

Example 1. A resident in a care home falls and fractures a hip. The provider arranges treatment, notifies CQC without delay, tells the family honestly what happened and apologises (Reg 20), reviews the falls risk assessment (Reg 12), and records the whole chain (Reg 17). Same incident, handled well — the difference between learning and a breach is usually the response, not the event.

Example 2. A home care agency wins a new package requiring two carers and a hoist. Before the first visit, the coordinator checks staff have current moving and handling training, the hoist has a LOLER inspection in date, and the care plan reflects the person's own preferred routine. Regs 9, 12 and 18 met in one unglamorous half hour of preparation.

worked example

Situation
Care visits run repeatedly late, affecting meals and time-critical medicines.
Safer response
Deal with the immediate risk first, then treat the pattern as one issue engaging several regulations at once — person-centred care, safe care, staffing, complaints and governance.
Record
The person's experience, risk actions taken, root cause, communication, the improvement plan and whether the change held.

Source trail — go back to authority

Reminder: Educational reference only. Nothing on this site is legal, clinical or professional advice. Guidance changes: always check the current official source before acting. Full disclaimer.
navigate · open · esc close

Keyboard shortcuts

/Ctrl+K
Open search and commands
/
Jump straight to search
g then h
Go home
g then t
Go to tools
g then q
Go to quick reference
g then s
Go to sources
t
Toggle light / dark
?
Show this list