What CQC Expects From Your Training Records System: Regulations 17 and 18

No regulator names a learning management system, and none ever will. What regulators do is specify what you must be able to show — and in a CQC-registered service those requirements are detailed enough to amount to a functional specification for whatever system holds your training data.

This guide works from Regulations 17 and 18 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 rather than from CQC’s assessment framework. That is deliberate. CQC has announced it is replacing the single assessment framework with separate sector frameworks and removing scoring, with a full consultation response due during 2026. The Regulations are statutory and unaffected, which makes them the only sensible thing to design a system against.

Regulation 18: the competence duty

Regulation 18(1) requires that “Sufficient numbers of suitably qualified, competent, skilled and experienced persons must be deployed” in order to meet the requirements of this Part. Regulation 18(2)(a) requires that staff “receive such appropriate support, training, professional development, supervision and appraisal” as is necessary to enable them to carry out the duties they are employed to perform.

Read CQC’s guidance on that duty and a set of system requirements falls out of it.

A per-role training needs profile, with review dates. Training, learning and development needs should be assessed when employment starts and reviewed at suitable intervals. A system holding only a list of completed courses cannot evidence this; it needs to hold what each role requires, separately from what each person has done.

A gap report, not a completion report. CQC expects completed and required training to be tracked, and action taken quickly where requirements are not met. That is two things: the delta between required and completed, and a record that someone acted on it. A dashboard showing 94% completion satisfies neither.

Supervision status as a field. New staff should be supervised until they demonstrate they can work unsupervised. That is a state attaching to a person at a point in time, not a document in a folder, and a system that cannot answer “who is currently cleared to work unsupervised?” cannot evidence it.

Appraisal linked to the training plan. Staff should have regular appraisals by a suitably skilled and experienced person, with training needs identified, planned and supported. The evidential chain runs appraisal → identified need → planned training → completion, and it has to be traceable end to end.

Profession-specific supervision rules. Health, social care and other professionals should have clinical or professional supervision where needed, in line with their own regulator’s requirements. One blanket supervision rule across a mixed workforce will not satisfy this; the requirements differ by register.

Exportable individual records. Regulation 18(2)(c) requires registered professionals to be “enabled to provide evidence to the regulator in question demonstrating, where it is possible to do so,” that they meet their professional standards. The employer’s system has to be able to hand the individual their own record in a form their regulator will accept — which matters for NMC revalidation and the equivalent processes elsewhere.

Universal learning disability and autism training. CQC’s guidance is that all staff should be trained to interact appropriately with people with a learning disability and autistic people, and that staff need supervision to understand and support them. Scope that as everyone, not as a clinical subset.

One further point sits oddly in a system discussion but belongs here: providers should help staff gain relevant qualifications and must not prevent or limit this. A platform configured so that only mandatory modules are visible, with no route to qualification pathways, works against that expectation.

Regulation 17: the records duty

Regulation 17(1) requires that “Systems or processes must be established and operated effectively to ensure compliance with the requirements in this Part.” The words operated effectively do the work — having a system is not the standard.

Regulation 17(2)(d) then requires the provider to “maintain securely such other records as are necessary to be kept in relation to—(i) persons employed in the carrying on of the regulated activity, and (ii) the management of the regulated activity”.

CQC’s guidance adds four things that shape system design:

• Scope is all staff, not new hires. Staff records must cover the employment requirements under Regulations 4 to 7 and 19 and apply to everyone, not only recent recruits. Historic staff data cannot be left behind in a migration.
• Management records count too — policies, procedures, audits, reviews and action plans for risks and incidents. A training system that holds courses but not the policy version staff were trained against leaves a gap.
• Access control and an audit trail. Records must be kept secure at all times and accessed, amended or destroyed only by authorised people. In practice that means role-based permissions and a log of who changed what.
• Paper or electronic are both acceptable, provided they meet the Data Protection Act 2018. There is no regulatory requirement to digitise — the requirement is to be able to produce complete, secure, accurate records.

On retention, CQC does not set a period. Its guidance says only that providers must observe data protection legislation about the retention of confidential personal information, and that records must be created, amended, stored and destroyed in line with current legislation and nationally recognised guidance. So retention is a policy decision the provider must be able to justify, not a number a vendor can configure for you.

What this amounts to as a specification

Pulling it together, a system in a CQC-registered service needs to be able to produce, on demand:

• the training requirement for each role, and the date it was last reviewed
• the gap between required and completed training, per person and per team
• evidence that action was taken where a gap existed
• current supervision status for staff not yet cleared to work unsupervised
• the chain from appraisal to identified need to planned training to completion
• an individual’s own record, exportable for their professional regulator
• which policy version a member of staff was trained against
• a log of who accessed or amended a record

Most compliance training platforms do the second item well and several of the others poorly. The useful question when assessing one is not how many courses it carries but which of the eight it can evidence without a manual workaround.

For the underlying regulatory requirements rather than the system layer, see our guides to CQC Regulation 9 and to HIQA inspections and staff training in Ireland, where the equivalent Irish expectations apply. Our CPD course library covers the training itself.

Frequently asked questions

Does CQC require an electronic training system?

No. CQC’s guidance states that paper and electronic records are both acceptable provided they meet the Data Protection Act 2018. The obligation is to maintain complete, accurate, secure records and to operate systems effectively, not to use particular software.

Is a completion percentage enough to evidence compliance?

No. Regulation 18 guidance expects both completed and required training to be tracked, with action taken quickly where requirements are not met. A completion figure shows neither the requirement it is measured against nor the action taken on the shortfall.

How long must training records be kept?

CQC does not specify a period. Its guidance refers providers to data protection legislation on the retention of confidential personal information, and requires records to be created, amended, stored and destroyed in line with current legislation and nationally recognised guidance.

Do training records cover long-serving staff?

Yes. CQC’s guidance on Regulation 17(2)(d) is explicit that staff records apply to all staff, not only new recruits, and must cover the employment requirements under Regulations 4 to 7 and 19.

Should the assessment framework drive system design?

Not at the moment. CQC is replacing the single assessment framework with separate sector frameworks and removing scoring, with a full consultation response due during 2026. Regulations 17 and 18 are statutory and unchanged, which makes them the stable basis for designing records and reporting.