CQC Statutory Notifications: What Care Providers Must Report and When

Every registered provider and registered manager in adult social care carries a legal duty that has nothing to do with clinical practice and everything to do with paperwork: telling the Care Quality Commission when specific things happen at the service. This is the statutory notification duty, set out in the Care Quality Commission (Registration) Regulations 2009 (principally Regulations 16 to 18), and it exists separately from the duty of candour, which is the requirement to be open with service users and their families about incidents that affect them directly. Statutory notifications are about keeping the regulator informed; duty of candour is about keeping the person in your care informed. Both matter, but they are not the same obligation, and treating them as interchangeable is one of the more common gaps found in provider governance.

What counts as a statutory notification

A statutory notification is a formal report a registered provider is legally required to send to CQC about a defined event, change or incident connected to a regulated activity. CQC's guidance on notifications is explicit that these are set out in law rather than being a matter of provider discretion, and that the timescale for each notification type varies depending on what has happened. The duty sits alongside, but is distinct from, the Regulation 20 duty of candour under the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, which is about disclosure to service users after a notifiable safety incident. This article focuses on the provider-to-regulator side of that picture: what must go to CQC, and when.

What must be notified, and how quickly

Regulations 16, 17 and 18 of the Registration Regulations 2009 form the core of the notification duty for incidents. Regulation 16 covers the death of any person using the service. Regulation 17 covers the death, or an unauthorised absence extending beyond midnight on the day it began, of a person detained or liable to be detained under the Mental Health Act 1983. Regulation 18 is the broadest of the three and covers a defined list of other incidents. For all three, CQC's own guidance uses the same standard: notification must be made without delay.

One point worth flagging because it trips providers up: an outbreak of infectious disease is not, on its own, a CQC statutory notification. CQC's published guidance for adult social care providers directs outbreaks to the local health protection team or the UK Health Security Agency under separate health protection legislation, not to CQC. Where an outbreak is severe enough to stop the service operating safely, for example through a staffing shortfall, that consequence can itself become notifiable under Regulation 18, but the outbreak is not a standalone CQC notification category. Getting this distinction right matters, and it is exactly the kind of detail worth building into the record-keeping and evidence trail covered in our guide to incident investigation and documentation standards.

How notifications are submitted

CQC's guidance directs providers to send most notifications using the current online notification form, accessed through the provider's CQC account, which generates a reference number automatically on submission. Where an online form is not available for a particular notification type, CQC provides a downloadable form that is completed and emailed in, with an acknowledgement number issued in return. CQC is clear that providers should always use the latest version of a form from its website, since forms are periodically updated. Registered managers should treat the correct form, sent through the correct channel, as part of getting the notification right, not just the timing.

What happens if you don't notify CQC

Failing to notify is not simply a governance weakness that shows up at inspection. CQC's guidance states plainly that it is an offence not to notify it when a relevant change, event or incident has happened. This sits within CQC's wider criminal enforcement powers under the Health and Social Care Act 2008 framework, and CQC's guidance on Regulation 18 specifically notes that it can pursue prosecution for a failure to notify without first issuing a warning notice, which is a different route to enforcement than the escalation ladder providers may be more used to for other regulatory breaches. In practice, a missed notification is also a governance red flag in its own right: it suggests the provider does not have reliable oversight of incidents affecting the people in its care, which is exactly the kind of systemic weakness explored in our article on good governance in health and social care.

Building a notification process that doesn't rely on memory

The providers who consistently get this right treat statutory notifications as a process, not a judgement call made in the moment by whoever is on shift. A few practical steps help:

• Name an owner. The registered manager should have unambiguous responsibility for deciding whether an event is notifiable and for submitting the notification, with a named deputy for when they are unavailable.
• Map events to regulations in advance. A simple one-page reference, built from the table above, means staff escalating an incident and the registered manager assessing it are working from the same list rather than trying to recall regulation numbers under pressure.
• Separate escalation from submission. Frontline staff need a clear, fast route to tell the registered manager an event has happened; the registered manager then makes the notification decision and submits it, so the "without delay" clock is not lost to an internal reporting gap.
• Log every notification made, and every decision not to notify. If an incident was assessed and judged not notifiable, record why. This protects the provider if the judgement is later questioned and creates a pattern CQC can see reflects genuine consideration rather than avoidance.
• Review notification records periodically. Look for patterns, not just individual events, since a cluster of similar incidents can itself be a signal worth raising even where each individual notification was made correctly.

Statutory notifications and duty of candour are related, not identical

It is worth restating the distinction because the two duties are easy to conflate. Statutory notifications, under the 2009 Registration Regulations, are about what a provider tells the regulator. Duty of candour, under Regulation 20 of the 2014 Regulated Activities Regulations, is about what a provider tells the person affected, or their representative, including an apology and an explanation. Many incidents will trigger both duties at once, but a provider that has a strong notifications process and a weak candour process, or vice versa, has not met its full obligations. Each needs its own owner and its own checklist.

Statutory notifications are one of the more mechanical parts of CQC compliance, but treating them mechanically, with a named owner, a shared reference list and a habit of logging decisions, is precisely what turns a legal obligation into a reliable process rather than a recurring source of risk. New registered managers building this out for the first time will find it sits naturally alongside the wider preparation covered in our first CQC inspection survival guide, and providers wanting structured, accredited training on this and related regulatory duties can explore Learnsignal's CPD courses for health and social care professionals.