CQC regulations and the fundamental standards

Where the CQC regulations come from

The Care Quality Commission regulates health and adult social care in England under the Health and Social Care Act 2008. Anyone who carries on a "regulated activity" must be registered with CQC, and carrying one on without registration is an offence. The activities are listed in Schedule 1 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014: fourteen of them, including personal care, accommodation for persons who require nursing or personal care, treatment of disease, disorder or injury, diagnostic and screening procedures, surgical procedures, nursing care, maternity and midwifery services, and assessment or medical treatment for persons detained under the Mental Health Act 1983. A care home, a home care agency, a supported living service, a hospice, a GP practice, a dentist and an NHS trust are all caught.

Two sets of regulations then do most of the work. The 2014 Regulations contain the requirements about who may run a service (Regulations 4 to 7) and the fundamental standards (Regulations 9 to 20A). The Care Quality Commission (Registration) Regulations 2009 contain the registration requirements, most of them notifications to CQC. Regulation 8 of the 2014 Regulations is the hinge: "A registered person must comply with regulations 9 to 20A in carrying on a regulated activity." The registered person means the provider and any registered manager.

CQC's public description of the fundamental standards is the one to remember: they "are the standards below which your care must never fall". They are minimums, written as legal duties that care providers must meet for the people who use services, whether in a care home, domiciliary care, mental health services or a hospital. CQC registration is the first test: "When we register services, we check they are likely to meet the fundamental standards." The single assessment framework, the quality statements and the ratings sit on top of them and describe what good looks like; the regulations describe what is required.

Providers must also have regard to CQC's guidance. Regulation 21 requires the registered person to have regard to guidance CQC issues on Part 3, and CQC's regulations for service providers and managers sets out each regulation in full with that guidance beneath it. It is the most useful single reference a provider has.

The fundamental standards, one by one

There are fourteen, numbered 9 to 20A. The wording in quotation marks is the regulation's own.

• Regulation 9, person-centred care. Care and treatment must "be appropriate, meet their needs, and reflect their preferences", which the regulation turns into steps: assessing needs and preferences collaboratively with the person, designing care to meet them, and involving the person in decisions.
• Regulation 9A, visiting and accompanying in care homes, hospitals and hospices. Added from 6 April 2024. Unless there are exceptional circumstances, people staying overnight or living in a care home, hospital or hospice "must be facilitated to receive visits", care home residents "must not be discouraged from taking visits out", and people attending a hospital or hospice without an overnight stay must be enabled to be accompanied by a family member, friend or supporter.
• Regulation 10, dignity and respect. "Service users must be treated with dignity and respect", including privacy, support for autonomy, independence and involvement in the community, and due regard to protected characteristics under the Equality Act 2010.
• Regulation 11, need for consent. Care and treatment "must only be provided with the consent of the relevant person"; where a person of 16 or over lacks capacity, the provider must act in accordance with the Mental Capacity Act 2005.
• Regulation 12, safe care and treatment. "Care and treatment must be provided in a safe way for service users": assessing and mitigating risks, competent staff, safe premises and equipment, the proper and safe management of medicines, and infection prevention and control.
• Regulation 13, safeguarding service users from abuse and improper treatment. Systems "to prevent abuse" and "to investigate, immediately upon becoming aware of, any allegation or evidence of such abuse", with no discrimination, degrading treatment, unnecessary or disproportionate restraint, or unlawful deprivation of liberty.
• Regulation 14, meeting nutritional and hydration needs. "The nutritional and hydration needs of service users must be met" where the service provides accommodation, an overnight stay, or has taken on meeting those needs.
• Regulation 15, premises and equipment. Premises and equipment must be "clean, secure, suitable for the purpose", "properly used", "properly maintained" and "appropriately located", with appropriate standards of hygiene.
• Regulation 16, receiving and acting on complaints. "Any complaint received must be investigated and necessary and proportionate action must be taken", through an accessible system for "identifying, receiving, recording, handling and responding to complaints", with a summary to CQC within 28 days if it asks.
• Regulation 17, good governance. "Systems or processes must be established and operated effectively" to ensure compliance with the other standards: quality and risk, care records, staff and management records, feedback, and improving the governance itself.
• Regulation 18, staffing. "Sufficient numbers of suitably qualified, competent, skilled and experienced persons must be deployed", with the support, training, supervision and appraisal they need.
• Regulation 19, fit and proper persons employed. Staff must be of good character, have the necessary qualifications, competence, skills and experience, and be able by reason of their health to do the work, with recruitment procedures operated effectively and the information in Schedule 3 available.
• Regulation 20, duty of candour. Registered persons "must act in an open and transparent way" and, after a notifiable safety incident, tell the person in person, apologise, give an account, follow up in writing and keep a record.
• Regulation 20A, display of performance assessments. A rated provider must display its CQC rating legibly and conspicuously at its premises, and on every website it maintains with the date of the rating and where the report can be read on CQC's website.

The other regulations: who runs the service, and the registration rules

The fundamental standards are about care. The regulations around them are about the provider, and they are as enforceable.

Regulations 4 to 7 of the 2014 Regulations deal with the people in charge. Regulation 4 sets requirements where the provider is an individual or a partnership. Regulation 5 requires that directors, and people in equivalent posts, which CQC's guidance says includes trustees of charitable bodies, are fit and proper. Regulation 6 requires a body to nominate an individual "responsible for supervising the management of the carrying on of the regulated activity". Regulation 7 sets the requirements for registered managers, which our registered manager guide covers.

The 2009 Registration Regulations are mostly about telling CQC things. Regulation 12 covers the statement of purpose; Regulation 13 the provider's financial position; Regulation 14 notice of a registered person's absence; Regulation 15 notice of changes; Regulation 16 the death of a service user; Regulation 17 the death or unauthorised absence of a person detained under the Mental Health Act 1983; Regulation 18 other incidents such as serious injuries, abuse and police involvement; Regulation 19 fees; Regulation 20 requirements relating to termination of pregnancies; Regulation 21 the death of a service provider; and Regulation 22A the form notifications must take. CQC summarises them as providers must "notify us about certain changes, events and incidents", and our CQC notifications guide sets out each one with its timescale.

Other law applies alongside, and CQC's guidance on each regulation lists the most relevant: the Mental Capacity Act 2005 and the Mental Health Act 1983, the Care Act 2014 for safeguarding, the Equality Act 2010, health and safety law, and the Data Protection Act 2018. Meeting the fundamental standards does not discharge those duties, and breaching them will often be evidence of a breach of a fundamental standard too.

Enforcement: which breaches are offences

Most breaches of the fundamental standards lead to civil enforcement: requirement notices, warning notices, conditions on registration, suspension or cancellation. A smaller set are criminal offences, listed in Regulation 22 of the 2014 Regulations, and for these CQC can move straight to prosecution without first serving a warning notice. CQC's guidance on each regulation says which category it is in.

• Offences outright: Regulation 11 (need for consent); Regulation 16(3), failing to send CQC a summary of complaints when asked; Regulation 17(3), failing to send the governance report CQC requests; Regulation 20(2)(a) and (3), the duty of candour notification and its content; and Regulation 20A, display of ratings.
• Offences where harm results: Regulations 12, 13(1) to (4) and 14, where the failure results in "avoidable harm (whether of a physical or psychological nature)" to a service user, exposes a service user to "a significant risk of such harm", or, for theft or misuse of money or property, causes a loss.
• Not prosecutable: Regulations 9, 9A, 10, 15, 18 and 19, and the rest of 13, 16, 17 and 20, where CQC takes regulatory action instead.

Regulation 22(4) gives a defence where the registered person proves they "took all reasonable steps and exercised all due diligence to prevent the breach", which is in practice an argument made from records. Some offences can be dealt with by a fixed penalty notice under Regulation 24 instead of prosecution. Separately, CQC can prosecute for failing to make the death and incident notifications required by the 2009 Regulations. And at the front door, for each regulation, CQC "must refuse registration if providers cannot satisfy us that they can and will continue to comply".

How the single assessment framework relates to the regulations

The regulations are the law. The single assessment framework is how CQC assesses providers against it, and it replaced the key lines of enquiry. It "is made up of 5 key questions and, under each key question, a set of quality statements": is the service safe, effective, caring, responsive and well-led. Quality statements "are the commitments that providers, commissioners and system leaders should live up to", written as "we statements", and CQC says they "relate to the regulations listed that we would consider in our judgements".

The framework is due to change, which is a change to how CQC assesses, not to the regulations. In its initial response to its consultation, published on 24 March 2026, CQC said it will remove scoring, replace quality statements with new key lines of enquiry and re-introduce rating characteristics, and it scheduled pilots for June to October 2026. No date for the new approach to go live had been published when this guide was checked, so until CQC announces one the quality statements described here are the ones it assesses against; check its current provider guidance before an assessment.

Each quality statement's page names its regulations, and often a second list to "also consider". A few examples show how the mapping works:

• Safe and effective staffing (safe): Regulations 12, 18 and 19
• Consent to care and treatment (effective): Regulation 11, also considering 9 and 10
• Person-centred care (responsive): Regulation 9, also considering 10, 11, 12 and 14
• Governance, management and sustainability (well-led): Regulations 17 and 20A, also considering Regulation 12 and the 2009 notification regulations

Two practical consequences follow. First, a rating and a breach are different findings. The rating is CQC's judgement of quality, built from scores against the quality statements; a breach is a finding that a regulation has not been met, and it is what enforcement rests on. Second, preparing for assessment by the quality statements and preparing for compliance by the regulations are the same exercise from two directions: the evidence for a quality statement is largely the evidence that its regulations are met. Our guide to evidence categories covers how that evidence is gathered and scored.

In evidence terms, compliance with each standard looks ordinary: care plans that show the person's preferences and their review (Regulation 9); consent and capacity records (11); risk assessments, medicines records and infection control audits (12); a safeguarding log with referrals and outcomes (13); a complaints log from first contact to outcome (16); rotas, training records, supervision notes and appraisals (18); recruitment files with the Schedule 3 checks (19); and the candour record whenever something goes wrong (20). None of it is new. What an inspector tests is whether it is complete, current and used to improve the quality of care.

Regulation 17 is the one that connects them all, because it requires a system that checks the other standards are being met. A provider that audits against Regulations 9 to 20A, and can show what changed as a result, is answering both the law and the well-led key question at once.

Where the evidence for the standards is first written

Read the fourteen standards again and notice how many are about something someone said. A family member's complaint under Regulation 16 arrives as a text to the carer whose number they have. A concern about a colleague under Regulation 13 is first raised in a staff group chat. The duty of candour conversation under Regulation 20 begins as a message from a worried daughter. A request to visit under Regulation 9A, a refusal of consent under Regulation 11, a manager's decision to cover a staffing gap under Regulation 18: each is usually settled in a message before it reaches a record.

Those messages are the evidence the standards depend on, and the registered person must be able to show them. Held on staff members' own phones, they belong to the people who sent them, and a provider that cannot produce them has to rely on memory for the part of the story an inspector, a family or a court is most interested in.

ComplyChat provides a channel for those work conversations, with everyone added told it is on the record and able to object or leave. A mobile number verified by SMS is the identity, so bank staff, volunteers and families without a work account can be in it. Messages are recorded on the server as they are sent, and on paid plans the lasting record files into the provider's own Microsoft 365 once the tenant is connected, under the provider's retention rules. It is not a care planning, rostering or medicines system and it does not make a provider compliant with anything; it keeps the conversations that are part of the evidence.

A question for the next governance meeting: for each of the fourteen standards, where would the first report of a problem arrive in this service, and could you produce it a year later?

Official guidance and your next step

The primary sources are the Regulated Activities Regulations 2014 and the Registration Regulations 2009 on legislation.gov.uk; CQC's regulations for service providers and managers, with guidance under each regulation; its plain-English page on the fundamental standards; and the assessment framework, where each quality statement lists its regulations. Quotations are from those pages as published on 25 September 2026. These regulations apply in England; Wales, Scotland and Northern Ireland have their own regulators and standards.

This guide is a summary for providers in England, not legal advice about a particular registration, inspection or enforcement action.

Then do one thing: take the list of fourteen standards and, against each, write the name of the person responsible for it in your service and the last audit or check that tested it. The blank lines are where to start.