CQC Regulation 12: safe care and treatment

The regulation: Regulation 12 in full

Regulation 12 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, headed Safe care and treatment, says in paragraph (1): “Care and treatment must be provided in a safe way for service users.” Paragraph (2) then says that, “without limiting paragraph (1), the things which a registered person must do to comply with that paragraph include”:

• (a) “assessing the risks to the health and safety of service users of receiving the care or treatment”
• (b) “doing all that is reasonably practicable to mitigate any such risks”
• (c) “ensuring that persons providing care or treatment to service users have the qualifications, competence, skills and experience to do so safely”
• (d) “ensuring that the premises used by the service provider are safe to use for their intended purpose and are used in a safe way”
• (e) “ensuring that the equipment used by the service provider for providing care or treatment to a service user is safe for such use and is used in a safe way”
• (f) “where equipment or medicines are supplied by the service provider, ensuring that there are sufficient quantities of these to ensure the safety of service users and to meet their needs”
• (g) “the proper and safe management of medicines”
• (h) “assessing the risk of, and preventing, detecting and controlling the spread of, infections, including those that are health care associated”
• (i) “where responsibility for the care and treatment of service users is shared with, or transferred to, other persons, working with such other persons, service users and other appropriate persons to ensure that timely care planning takes place to ensure the health, safety and welfare of the service users”

That is the whole regulation today. Paragraphs (3) to (6), the COVID-19 vaccination requirement, were omitted on 15 March 2022, and on 21 October 2026 legislation.gov.uk showed no outstanding changes to Regulation 12.

The duty falls on the “registered person”, which Regulation 2 defines as “the service provider or registered manager” in respect of a regulated activity, so the provider and the registered manager carry it together. Regulation 8(1) applies it to every regulated activity a provider carries on, from personal care in people’s own homes to accommodation for people who need nursing or personal care (the scope of registration guide lists all 14). Under Regulation 8(2), neither has to do something that another registered person for the same regulated activity has already done. Regulation 3(3) says “an activity is only a regulated activity if it is carried on in England”, so Regulation 12 applies to services in England; Wales, Scotland and Northern Ireland have their own regulators and rules.

The regulation is made under section 20 of the Health and Social Care Act 2008, which since 1 October 2015 has required the Secretary of State to impose requirements “to secure that services provided in the carrying on of regulated activities cause no avoidable harm to the persons for whom the services are provided”.

Two older documents share the name and cause confusion. Regulation 12 of the Care Quality Commission (Registration) Regulations 2009 is a different rule, the duty to give CQC a statement of purpose. And the 2010 “essential standards of quality and safety” no longer apply: Regulation 25 of the 2014 Regulations revoked the 2010 Regulations they were written for.

What “safe” and “reasonably practicable” mean

CQC’s guidance on Regulation 12 states its purpose: “The intention of this regulation is to prevent people from receiving unsafe care and treatment and prevent avoidable harm or risk of harm.” That guidance carries legal weight. Regulation 21(a) says the registered person “must have regard to” the guidance CQC issues (for health care associated infections, Regulation 21(b) points to the Secretary of State’s code of practice instead), and CQC’s page presents it as “the guidance providers must have regard to”. This guide reads each limb through it.

Safe does not mean free of risk. CQC says: “CQC understands that there may be inherent risks in carrying out care and treatment, and we will not consider it to be unsafe if providers can demonstrate that they have taken all reasonable steps to ensure the health and safety of people using their services and to manage risks that may arise during care and treatment.” The Act draws the same line: under section 20(5B), harm is avoidable unless the provider “cannot reasonably avoid it (whether because it is an inherent part or risk of a regulated activity or for another reason)”.

“Reasonably practicable” is the test in 12(2)(b), and CQC explains it in its own terms: providers “should follow good practice guidance and must adopt control measures to make sure the risk is as low as is reasonably possible.” The list in paragraph (2) is a minimum. CQC’s guidance says “12(2) is not exhaustive and providers must demonstrate that they have done everything reasonably practicable to provide safe care and treatment”, and that providers “should consult nationally recognised guidance about delivering safe care and treatment and implement this as appropriate.”

Safety is also weighed against the person’s own wishes. CQC expects assessments and care to “be based on risk assessments that balance the needs and safety of people using the service with their rights and preferences”. The Regulation 9 guide covers the preference side of that balance.

One limit is easy to miss: “The regulation does not apply to the person’s accommodation if this is not provided as part of their care and treatment.”

The nine limbs in practice, as CQC reads them

CQC’s guidance takes the limbs one at a time. Grouped by what they cover, this is what it asks for.

Risk: 12(2)(a) and (b). “Risk assessments relating to the health, safety and welfare of people using services must be completed and reviewed regularly by people with the qualifications, skills, competence and experience to do so. Risk assessments should include plans for managing risks.” Care should “include arrangements to respond appropriately and in good time to people’s changing needs”, including “when they are admitted, discharged, transferred or move between services”, and should be carried out in accordance with the Mental Capacity Act 2005, including best-interests decisions, lawful restraint and, where required, applying for authorisation of a deprivation of liberty (see mental capacity assessment records and DoLS record keeping). Under 12(2)(b), “staff must follow plans and pathways”, and people’s care plans should carry “allergies, contraindications and other limitations relating to the person’s needs and abilities.” Covert medicines also sit here: “When it is agreed to be in a person’s best interests, the arrangements for giving medicines covertly must be in accordance with the Mental Capacity Act 2005.”

Incidents and alerts, also 12(2)(b). “Incidents that affect the health, safety and welfare of people using services must be reported internally and to relevant external authorities/bodies. They must be reviewed and thoroughly investigated by competent staff, and monitored to make sure that action is taken to remedy the situation, prevent further occurrences and make sure that improvements are made as a result.” “Incidents include those that have potential for harm”, so a near miss counts. CQC adds that outcomes “must be shared with the person concerned and, where relevant, their families, carers and advocates”, pointing to the duty of candour under Regulation 20. Providers “must comply with relevant Patient Safety Alerts, recalls and rapid response reports” issued by the Medicines and Healthcare products Regulatory Agency (MHRA) and through the Central Alerting System. CQC’s learning culture quality statement describes the service it wants to find, one in which “concerns about safety are listened to, safety events are investigated and reported thoroughly, and lessons are learned”. The incident reporting guide covers what goes where.

Staff: 12(2)(c). “Staff must only work within the scope of their qualifications, competence, skills and experience and should be encouraged to seek help when they feel they are being asked to do something that they are not prepared or trained for.” The evidence sits in the training matrix, competency checks and supervision records.

Premises and equipment: 12(2)(d) and (e). Contracting the work out does not move the duty: providers “retain legal responsibility under these regulations when they delegate responsibility through contracts or legal agreements to a third party, independent suppliers, professionals, supply chains or contractors.” Who enforces what is set by CQC’s memorandum of understanding with the Health and Safety Executive: CQC leads on the safety of people receiving care from a registered provider (its example is a service user falling from a window), while HSE or the local authority leads on the health and safety of workers, visitors and contractors, such as a member of staff injured while moving a resident. The RIDDOR guide covers the staff side.

Medicines: 12(2)(f) and (g). “People’s medicines must be available in the necessary quantities at all times to prevent the risks associated with medicines that are not administered as prescribed. This includes when people manage their own medicines.” Medicines policies and procedures “should be in line with current legislation and guidance and address: supply and ordering; storage, dispensing and preparation; administration; disposal; recording.” The record of administration is the MAR chart.

Infection: 12(2)(h). The Department of Health and Social Care’s code of practice on the prevention and control of infections, last updated on 13 December 2022, is statutory guidance for this limb and applies to adult social care in England. Regulation 21(b) requires registered persons to have regard to it in so far as Regulation 12 applies to health care associated infections, and CQC must take it into account in decisions about registration. Providers “do not by law have to comply with the code” if they can show they meet the regulation in an equivalent or better way. It sets “10 criteria” against which a provider is judged, and “not all criteria will apply to every regulated activity.”

Shared and transferred care: 12(2)(i). Where care is shared, “there should be appropriate arrangements to share relevant information promptly”. “When more than one provider is responsible for the safety of a person using services, the responsibility for providing safe care rests with the principal care provider at the time it is given.” And “when people move between services or providers, appropriate risk assessments must be undertaken to make sure their safety is not compromised”, including moves with bodies not registered with CQC, such as the police.

The evidence each limb produces

Regulation 12 does not list records, but CQC’s guidance describes things that can only be shown with them. For a care home or home care service, the evidence usually includes:

• individual risk assessments with their plans for managing each risk identified, who completed them and when they were last reviewed, including at admission, discharge and transfer (12(2)(a)); see care plan review records
• care plans that carry allergies, contraindications and limitations, and mental capacity and best-interests records where they apply (12(2)(a) and (b))
• an incident log including near misses, with each investigation, what changed as a result and what the person or family was told (12(2)(b))
• a log of Patient Safety Alerts and MHRA recalls received, and the action taken on each (12(2)(b))
• training, competency and supervision records showing staff work within their competence (12(2)(c))
• servicing, maintenance and safety check records for the building and equipment, and the checks made on contractors (12(2)(d) and (e))
• medicines stock checks, the medicines policy and the MAR charts (12(2)(f) and (g))
• infection prevention and control audits against the code’s criteria that apply to the service (12(2)(h))
• transfer and hospital discharge information, sent and received, with the risk assessment made at each move (12(2)(i))

Reviewed risk assessments, investigated incidents, alerts acted on and a medicines policy are CQC’s own expectations; the rest are the ordinary records a service keeps to show it complied. Regulation 12 sets no retention period for any of them; the care records retention guide covers how long each is kept. A risk register and a quality assurance calendar are two ways to check these records before an inspector does.

When a breach is an offence, and how CQC assesses Regulation 12

A breach of Regulation 12 is not automatically a crime. Under Regulation 22(2), a registered person commits an offence if they fail to comply with Regulation 12 and the failure results in “avoidable harm (whether of a physical or psychological nature) to a service user” or in “a service user being exposed to a significant risk of such harm occurring”. That is different from Regulation 11, where the breach alone is the offence. CQC’s offences page lists Regulation 12 among the offences that need that further harm qualification.

• No warning first. CQC says: “We do not have to serve a Warning Notice before prosecution.” It may also take other regulatory action.
• Penalty. Under Regulation 23(4), a person guilty of the offence is liable on summary conviction to “a fine”, with no upper limit since 12 March 2015.
• Fixed penalty. Schedule 5 sets the penalty notice amount at £4,000 for a service provider and £2,000 for a registered manager, and under Regulation 24(6) no prosecution can start within 28 days of a notice being received. Because the offence attaches to the registered person, a registered manager can be prosecuted or given a notice personally.
• Defence. Regulation 22(4) makes it a defence “to prove that they took all reasonable steps and exercised all due diligence to prevent the breach”. That defence is made from records: the risk assessment, its review, and what was done when the risk changed.
• Registration. “CQC must refuse registration if providers cannot satisfy us that they can and will continue to comply with this regulation.”

At inspection and in its other assessment work, CQC currently assesses services under its assessment framework, which “is made up of 5 key questions and, under each key question, a set of quality statements”. Regulation 12 sits under the safe key question, and all eight of its quality statements list Regulation 12 among their relevant regulations:

• Learning culture: Regulations 12, 16, 17 and 20
• Safe systems, pathways and transitions: 12 and 17, also considering 9
• Safeguarding: 10, 11, 12 and 13, also considering 9, 17 and 20
• Involving people to manage risks: 9, 11 and 12, also considering 10
• Safe environments: 12, 15 and 17
• Safe and effective staffing: 12, 18 and 19
• Infection prevention and control: 12 and 15, also considering 17
• Medicines optimisation: 9 and 12, also considering 11

The way CQC assesses is changing; the regulation is not. In March 2026, in its initial response to the Better regulation, better care consultation, CQC said that “rather than using quality statements”, its sector-specific assessment frameworks will use “new supporting key lines of enquiry”, that it will re-introduce rating characteristics, and that it “will remove scoring”. Its pilots of the new approach run between June and October 2026, “alongside – not instead of – existing inspections”, with final evaluation in November 2026, and “pilot judgements have no legal standing”. No date for the new frameworks to take effect had been published when this guide was written, so the quality statements above are the ones CQC assesses against. The evidence categories guide explains how inspectors gather evidence, and the Regulation 17 guide covers good governance: the systems and audit that should catch an unsafe practice before an inspection does.

The risk that changed between reviews

A risk assessment is reviewed on a date. The risk it describes changes whenever it changes, and the first anyone hears of it is usually a message.

A night carer messages the manager at three in the morning that a resident nearly fell getting out of bed, the second time this week. A district nurse texts the senior on shift that a dose has changed. A daughter tells a carer, by message, that her mother has a new cough and is off her food. A hospital discharge arrives as a phone call and a text, and the paperwork follows later. Each of those is what CQC means by “people’s changing needs”, and 12(2)(a), 12(2)(b) and 12(2)(i) turn on whether it reached the risk assessment, the care plan and the next shift in good time.

When something goes wrong, those messages are also the evidence. Whether a service took “all reasonable steps” is shown by when it knew and what it did, and the answer often sits on a personal phone, in an app the provider cannot open, belonging to a member of staff who may since have left.

ComplyChat gives those conversations a channel the provider owns. A mobile number verified by SMS is the identity, so bank and agency staff, visiting professionals and families without a work account can take part; everyone added to a channel is told it is on the record; and messages are recorded on the server as they are sent. On paid plans, once the tenant is connected, conversations are kept in the provider’s own Microsoft 365 subscription, under the retention schedules it already runs. It is not a risk assessment tool, a care planning system, an eMAR or a rota, and it does not update a care plan; it keeps the message that should have changed one.

A question for the next leadership or governance meeting: when a risk changes at three in the morning, where is the message that said so, and could we show what we did next?

Questions people ask

What are the aims of regulation 12 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014?

Regulation 12 aims to prevent people from receiving unsafe care and treatment and to prevent avoidable harm or risk of harm, which is how CQC states its intention. It is one of the requirements made under section 20 of the Health and Social Care Act 2008, which since 1 October 2015 has required the Secretary of State to impose requirements to secure that regulated services “cause no avoidable harm” to the people they serve.

What are the requirements for safe care and treatment according to CQC Regulation 12?

Regulation 12(1) requires that care and treatment “must be provided in a safe way for service users”, and 12(2)(a) to (i) lists what that includes: assessing risks and doing all that is reasonably practicable to mitigate them, competent staff, safe premises and equipment, sufficient equipment and medicines, the proper and safe management of medicines, infection prevention and control, and timely care planning when care is shared or transferred. CQC’s guidance says the list “is not exhaustive”.

Is a breach of Regulation 12 a criminal offence?

A breach of Regulation 12 is a criminal offence when it results in avoidable harm to a service user or exposes a service user to a significant risk of such harm (Regulation 22(2)), and CQC does not have to serve a warning notice before prosecuting. The penalty on summary conviction is a fine with no upper limit, a fixed penalty of £4,000 for a provider or £2,000 for a registered manager can be offered instead, and it is a defence to prove all reasonable steps and all due diligence (Regulation 22(4)).

What does “reasonably practicable” mean in Regulation 12?

Under Regulation 12(2)(b), doing “all that is reasonably practicable” to mitigate a risk means, in CQC’s words, following good practice guidance and adopting “control measures to make sure the risk is as low as is reasonably possible.” CQC accepts that care carries inherent risks and will not consider care unsafe if providers “can demonstrate that they have taken all reasonable steps”, and the Act treats harm as avoidable unless the provider cannot reasonably avoid it.

Is Regulation 12 the statement of purpose?

No: two different instruments each have a regulation 12. Regulation 12 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 is safe care and treatment; regulation 12 of the Care Quality Commission (Registration) Regulations 2009 requires a statement of purpose, which the statement of purpose guide covers. For the full list of fundamental standards, see the fundamental standards guide.

Official guidance and your next step

The primary sources are Regulation 12, Regulation 22, Regulation 23 and Schedule 5 on legislation.gov.uk; CQC’s guidance on Regulation 12, which providers must have regard to and which is the most useful single page on the subject; the eight quality statements under CQC’s safe key question; and, for infection, the code of practice. Quotations are from the pages linked in this guide as published on 21 October 2026.

This guide is a summary for providers registered in England, not legal advice about a particular person’s care, an inspection or enforcement action.

Then do one thing: pick three people your service supports, find the last change in each person’s needs, and check that the risk assessment was reviewed and the next shift told, with dates. Where you cannot show all of it, you have found where to start.