CQC Regulation 12: Safe Care and Treatment, and Why a Warning Notice Can Protect You

Most writing about CQC enforcement treats a warning notice as a hurdle the regulator has to clear before it can prosecute. It is closer to the opposite. Under section 29(5) of the Health and Social Care Act 2008, once a warning notice has been complied with within the time specified, no proceedings may be brought for a Part 1 offence arising out of the failure to which the notice relates, so far as it occurred before the relevant time.

A complied-with warning notice is a statutory bar on prosecution for the past conduct it covers. That is worth knowing before anyone treats one as merely administrative.

Regulation 12, safe care and treatment, is the regulation that makes this matter, because it is the one CQC reaches for when it prosecutes, and it carries an unlimited fine.

What the regulation says

Regulation 12(1) of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 is a single line: care and treatment must be provided in a safe way for service users. Regulation 12(2) then lists, without limiting that duty, the things a registered person must do to comply:

• (a) assessing the risks to the health and safety of service users of receiving the care or treatment;
• (b) doing all that is reasonably practicable to mitigate any such risks;
• (c) ensuring that persons providing care or treatment have the qualifications, competence, skills and experience to do so safely;
• (d) ensuring that the premises are safe to use for their intended purpose and are used in a safe way;
• (e) ensuring that equipment used for providing care or treatment is safe for such use and is used in a safe way;
• (f) where equipment or medicines are supplied by the provider, ensuring there are sufficient quantities to ensure safety and meet needs;
• (g) the proper and safe management of medicines;
• (h) assessing the risk of, and preventing, detecting and controlling the spread of, infections, including those that are health care associated;
• (i) where responsibility is shared with or transferred to other persons, working with those persons, service users and other appropriate persons to ensure timely care planning takes place.

Two housekeeping points. Paragraphs 12(3) to (6) have been omitted since 15 March 2022; they were the COVID-19 vaccination-as-a-condition-of-deployment provisions, and any guidance still quoting a regulation 12(3) is out of date. And nutrition and hydration are not in regulation 12 — they are a separate fundamental standard under regulation 14. It is a common misattribution.

Every charge is pleaded as read with regulation 8, which requires compliance with regulations 9 to 20A. Regulation 8(2) is the part managers should know: the duty does not require a person to do something to the extent that it has already been done by another registered person in relation to the regulated activity concerned.

The offence, and why the fine is unlimited

Regulation 22(2) creates the offence: a registered person commits an offence if they fail to comply with a requirement of regulation 12, 13(1) to (4) or 14, as read with regulation 8, and that failure results in avoidable harm, whether physical or psychological, to a service user; or a service user being exposed to a significant risk of such harm occurring; or, in a case of theft, misuse or misappropriation of money or property, any loss by a service user of the money or property concerned.

Note what the offence is not. It is not limited to particular sub-paragraphs. The words are a requirement of regulation 12 — the whole of it. CQC describes it as a breach of this regulation or a breach of part of the regulation, and charging practice bears that out: one recent prosecution turned on missing window restrictors, which is squarely a premises and equipment failure under 12(2)(d) and (e).

CQC can prosecute without first serving a warning notice. But a precise point is worth getting right, because a compliance lead who checks the source will notice: in CQC own taxonomy regulation 12 is not among the offences that may be prosecuted directly. It sits under a second heading, where prosecution needs the further qualification that the breach resulted in exposure to avoidable harm or significant risk of it, or loss of money or property. The real distinction across the regulations is not warning notice or no warning notice; it is prosecutable or not prosecutable at all. Regulation 18 on staffing, for instance, is never a criminal offence — CQC can take regulatory action but cannot prosecute it.

On penalty: regulation 23(4) makes a regulation 22(2) offence punishable on summary conviction by a fine, and the caps that used to apply were removed in March 2015. So this is a summary-only offence with an unlimited fine, which is how a magistrates court reached a seven-figure penalty against an NHS trust. By contrast the regulation 20 duty of candour offence is capped at level 4.

The time limit is also not the ordinary one. Under section 90(2), proceedings may be brought within twelve months from the date on which evidence sufficient to warrant proceedings came to the prosecutor knowledge, with a hard stop at three years after the commission of the offence. Not the six months that applies to most summary offences.

Registered managers are personally liable

A registered manager is a registered person in their own right under regulation 2(1), and so personally liable under regulation 22(2). Separately, section 91 extends liability to any director, manager or secretary where a body corporate offence is committed with their consent or connivance, or is attributable to their neglect.

This is not theoretical. In August 2026 the registered manager of Hall Lane Resource Centre was personally convicted on a guilty plea of an offence under regulations 12(2) and 22(2), relating to a failure to provide safe care that exposed a resident to significant risk of avoidable harm. CQC noted the case raised concerns around diabetes, fluid and hydration, and medicines management, and that staff were not trained to understand the resident condition. The penalty was modest in absolute terms — a fine of 1,666 pounds, a victim surcharge of 167 pounds and 500 pounds costs — but it is a criminal conviction against a named individual.

In March 2025 both a provider company and its former registered manager pleaded guilty in the same case. Maldon Lodge Care Home Ltd was fined 33,000 pounds with 20,000 pounds costs; the former manager was fined 600 pounds. An 87-year-old resident admitted after an urgent dementia referral was discharged without a dementia assessment, later opened a kitchen door onto a stairwell, fell and died. The failure was a risk assessment failure under 12(2)(a), compounded by a premises hazard.

The fine exceeds the costs, usually by a wide margin

This is the reverse of the pattern in duty of candour prosecutions, where the costs have been the real penalty. In February 2025 Nottingham University Hospitals NHS Trust pleaded guilty to six charges under regulations 12 and 22(2)(a) and (b) and was fined 1,600,000 pounds, reduced from an indicated 5.5 million for early guilty pleas and other factors, with CQC costs of 67,755 pounds. In 2023 Cygnet Health Care Limited was fined 1,530,000 pounds with 79,773.59 pounds costs. In 2024 Priory Healthcare Limited was fined 650,000 pounds with 43,672 pounds costs.

In every verified case the fine was the larger figure. CQC costs are modest and broadly fixed; the fine scales with turnover and culpability. The one nuance is that for a small provider the two converge, and the costs become proportionally far more painful.

One claim worth not making

Regulation 12 is widely described as the most frequently cited regulation in CQC enforcement. It appears in the charge sheet of every recent CQC prosecution press release we examined, so as a statement about charging practice that is defensible. But CQC does not publish a breakdown of enforcement by regulation — its annual report gives only aggregates — so the ranking rests on practitioner analysis rather than published data, and the two trade estimates in circulation do not reconcile with each other. What CQC own figures do show is a sharp fall in warning notices: 494 in 2024/25 against 932 the year before.

The due diligence defence, and where it sits

Regulation 22(4) provides that it is a defence for a registered person to prove that they took all reasonable steps and exercised all due diligence to prevent the breach. On the statutory wording this is unqualified and covers the regulation 12 offence; CQC own offences page is ambiguous about placement, but the legislation is not limited.

Two practical consequences. The burden is on the provider, to prove, on the balance of probabilities — a reverse burden, which means documentation is the defence. And it dovetails with CQC own concession on regulation 12: it understands there may be inherent risks in carrying out care and treatment, and will not consider a service unsafe if the provider can demonstrate it took all reasonable steps to ensure health and safety and to manage risks arising during care.

Where regulation 12 bites unexpectedly

Medicines sit in three limbs, not one

The statutory words for medicines management are seven: the proper and safe management of medicines. But the duty is spread wider than 12(2)(g). Paragraph (f) covers stock and availability where the provider supplies medicines. And CQC guidance puts a surprising amount of medicines content under 12(2)(b), the reasonably practicable mitigation limb: that medication reviews must be part of and align with care and treatment assessments and be reviewed regularly when medication changes; that providers must comply with relevant Patient Safety Alerts, recalls and rapid response reports from the MHRA and through the Central Alerting System; that medicines must be administered accurately, in accordance with prescriber instructions and at suitable times; and that covert administration, where agreed to be in a person best interests, must be in accordance with the Mental Capacity Act 2005.

A provider auditing only against (g) will miss alert compliance and medication review entirely.

The route to NICE guidance is 12(1) rather than 12(2)(g): CQC says providers should consult nationally recognised guidance about delivering safe care and treatment and implement it as appropriate. NICE guidance is not directly enforceable, but departing from it is evidence that what was reasonably practicable was not done, and it undercuts the due diligence defence. The relevant pieces are NICE SC1 on managing medicines in care homes, NG67 on managing medicines for adults receiving social care in the community, and NG5 on medicines optimisation.

The same failure, two regulations, one criminal penalty

This is the most useful structural point for a registered manager. CQC anchors the medicines competence expectation to regulation 18, not regulation 12. Its medicines optimisation guidance opens by citing regulation 18 as the provision addressing staffing, training, qualifications, competence and skills, and sets the expectation from NICE that all staff supporting medicines needs have an annual review of their knowledge, skills and competencies, with a formal process to assess competence, records kept, and new staff not permitted to manage or administer medicines before their competence is assessed.

But regulation 18 cannot be prosecuted. Regulation 12(2)(c) — qualifications, competence, skills and experience to provide care safely — can be, if someone is harmed or exposed to significant risk. Same facts, two regulations, and only one of them carries a criminal penalty. Providers conflate 12(2)(c) with regulation 18(2) routinely, and the distinction is exactly where criminal liability begins.

Transfers of care

Paragraph 12(2)(i) is more demanding than its wording suggests. CQC expects providers to work actively with others, internally and externally; where care is shared or services are integrated, to have arrangements to share relevant information promptly and plan and deliver care in partnership; and to risk assess moves between services or providers so that safety is not compromised. That includes moves involving bodies that may not be registered with CQC at all, such as the police. Decisions about moves for people who may lack capacity must be made in accordance with the Mental Capacity Act 2005.

And one allocation rule worth quoting to anyone arguing about whose problem a shared patient is: where more than one provider is responsible for a person safety, the responsibility for providing safe care rests with the principal care provider at the time it is given.

Does regulation 12 require training?

No named subject, no interval, no specified course. Regulation 12 requires an outcome — safe care — and 12(2)(c) requires that the people providing care have the qualifications, competence, skills and experience to do so safely. Competence, not attendance.

That distinction is the whole point. A provider can evidence a completed training matrix and still breach 12(2)(c) if the staff member was not competent to do the task safely. And because the regulation 22(4) defence is a reverse burden, the evidence that matters is the competence assessment and the supervision record, not the certificate. The same logic runs through the regulation 20 duty of candour, where what is recorded is what can be proved.