Mandatory Training Requirements for GP Practices

General practice runs on a smaller, more exposed admin team than a residential care setting, yet it carries some of the highest-stakes clinical risk in the health system. A practice manager building a training matrix from a care-home checklist will end up either over-training reception staff on things that don't apply to them, or missing the specific statutory duties that do. Since Learnsignal's existing compliance content has largely been written with adult social care providers in mind, this guide sets out what actually applies to a GP practice team — clinical and non-clinical — and how the Care Quality Commission (CQC) looks at training evidence differently in general practice than it does in a care home.

Before anything else, it's worth being precise about the terms. As covered in our guide to statutory versus mandatory training in UK care settings, "statutory" means a legal duty exists somewhere in primary legislation or an Act, while "mandatory" means the employer has decided it's a condition of the role based on risk. Almost nothing in general practice is statutory in the narrow legal sense except a short list — everything else is mandatory because a practice's own risk assessment, indemnity provider, or CQC registration conditions require it.

What CQC actually requires — and what it leaves to the practice

The starting point that trips up a lot of new practice managers is that CQC does not publish a fixed list of mandatory training modules for general practice. In its guidance for GPs, CQC states plainly that "it is not CQC's role to identify specific training for providers and we do not specify any mandatory training for members of the GP practice team" (CQC, GP mythbuster 70: Mandatory training considerations in general practice). The expectation instead is that the practice itself identifies what its staff need based on their roles and the needs of its patient population, communicates that clearly, monitors completion, and can evidence that staff hold the skills, knowledge and competence for what they actually do.

That said, CQC is explicit about the areas inspectors will look for evidence of training in, even without naming a syllabus. These are: basic life support, infection prevention and control, fire safety, the Mental Capacity Act and Deprivation of Liberty Safeguards, safeguarding of children and adults, information governance, and role-specific clinical training such as immunisation, cervical screening or minor surgery competencies (CQC, GP mythbuster 70). There is one genuine statutory duty layered on top of all of this: under the Health and Care Act 2022, every CQC-registered provider — general practice included — has had a legal duty since 1 July 2022 to ensure staff receive training on supporting autistic people and people with a learning disability, appropriate to their role. In practice this is delivered as the Oliver McGowan Mandatory Training, split into Tier 1 for staff with little or no direct patient contact and Tier 2 for clinical staff and anyone providing direct care or support.

How CQC assesses GP practices differently from care homes

Under CQC's single assessment framework, every registered provider is still rated against the same five key questions — Safe, Effective, Caring, Responsive and Well-led — scored using a shared set of evidence categories. But the quality statements and key lines of enquiry sitting underneath those five questions are not identical across sectors, and CQC has been actively moving further in that direction. In 2026, CQC ran a consultation, "Give your views on draft sector-specific assessment frameworks," proposing four distinct frameworks — adult social care, mental health, primary care and community services, and hospitals — each with its own supporting questions and its own descriptions of what outstanding, good, requires improvement and inadequate look like in that sector (CQC, 2026). Feedback on the draft closed on 12 June 2026, and the frameworks were moving through piloting later in the year.

This matters for a GP practice manager because it formalises what inspection evidence already implied: a practice is not assessed against the same yardstick as a care home. A care home's evidence base is built around day-to-day personal care, staffing ratios across shifts, and continuous supervision of vulnerable residents. A general practice's evidence base is built around clinical governance, prescribing safety, continuity and access, multidisciplinary working with the wider primary care network, and the ability to identify and escalate risk in short consultations rather than long-term residential care. Training records get reviewed accordingly — inspectors are more likely to triangulate e-learning completion data, appraisal and supervision records, and significant event analysis than to observe care being delivered in real time. Our overview of the CQC single assessment framework and quality statements covers the shared mechanics in more depth if you want the full picture before layering the primary care specifics on top.

The core modules that actually apply to a practice team

Pulling CQC's areas of focus together with the sector-specific guidance bodies gives a realistic core list for a GP practice. Not every module applies to every role — that's the point of building a matrix rather than a blanket list — but this is the set most practices need to plan around.

Safeguarding — children and adults

General practice safeguarding training follows the intercollegiate framework, and the Royal College of General Practitioners (RCGP) publishes standards specific to general practice, updated in October 2024. These apply to "all GPs and everyone working in a general practice setting in the UK," clinical and non-clinical, and treat safeguarding as a whole life-course subject covering both children and adults rather than two separate streams. Most of the team needs Level 1 or 2 depending on the degree of patient contact; the practice or organisational safeguarding lead needs Level 3. RCGP is explicit that GP safeguarding leads do not need Level 4 or 5 — those levels are for named GPs, named nurses and designated safeguarding professionals working across a wider system, referenced in a separate intercollegiate document. The October 2024 update also moved the standard away from counting training hours and towards demonstrable competency built on adult learning principles, so a matrix built purely around "hours completed" is already out of date.

Basic life support and resuscitation

Resuscitation Council UK publishes a dedicated Quality Standard for primary care, and it is more prescriptive than CQC on this specific topic. It sets a minimum of annual updates for clinical staff, and expects clinical staff to be able to recognise cardiorespiratory arrest, summon help, start CPR and attempt defibrillation with an AED within three minutes of collapse wherever possible. Non-clinical staff aren't exempt — they're expected to be trained to recognise an arrest, call for help and perform chest compressions. The standard allows a mix of delivery methods (courses, simulation, mock drills, e-learning) but recommends hands-on training with assessment for clinical staff, and specifies that any defibrillator used in training should match the model actually in use in the practice.

Infection prevention and control

IPC training sits inside CQC's "Safe" domain evidence and is treated as core for every role that has any contact with patients, equipment or the clinical environment, including reception staff handling specimens or cleaning contact points. Frequency and depth should be risk-assessed against the practice's own IPC lead sign-off, typically annually for clinical staff with a lighter-touch induction and refresher for non-clinical roles.

Information governance and data security

Every GP practice, as a data controller handling special category patient data, is required to complete the NHS Data Security and Protection Toolkit (DSPT) annually. For the 2025–26 toolkit year, NHS England's submission deadline is 30 June 2026. The toolkit itself sets out assertions and evidence requirements — including staff information governance and data security training — specific to GP practices as a provider category, separate from the assertions built for pharmacies, dentists or social care providers. Missing the DSPT deadline doesn't just risk a CQC finding; it can affect NHS Smartcard access and wider system connectivity. Our detailed walkthrough of the DSPT deadline and submission requirements is worth reading alongside this if IG training ownership isn't yet clearly assigned within the practice.

Fire safety, Mental Capacity Act and role-specific clinical training

Fire safety training is a Regulatory Reform (Fire Safety) Order 2005 duty for every workplace, general practice included, and needs an induction plus periodic refresher for all staff. Mental Capacity Act and Deprivation of Liberty Safeguards awareness is expected wherever clinical staff assess capacity or consent, which in general practice covers most clinical roles even though DoLS applications themselves rarely originate from primary care. On top of the generic list, role-specific clinical competencies — immunisation and cold chain management, cervical screening, phlebotomy, minor surgery, chaperoning — need their own currency tracking separate from the "core" statutory/mandatory bundle.

Building a training matrix on limited admin resource

Most GP practices don't have a dedicated learning and development function — the practice manager is usually doing this alongside HR, premises, finance and complaints. A workable matrix doesn't need to be elaborate; it needs to be complete, current and easy to audit against at short notice.

• Map roles, not people, first. List every role in the practice — GP partner, salaried GP, advanced nurse practitioner, practice nurse, healthcare assistant/phlebotomist, dispenser, care coordinator, reception/admin, practice manager — and set out which of the core modules above apply to each, and at what depth (e.g., safeguarding Level 1 versus Level 3).
• Separate the genuinely statutory items from the risk-assessed ones. Oliver McGowan Tier 1/2, fire safety and DSPT-linked IG training are non-negotiable legal duties. Everything else — including most safeguarding levels and BLS frequency beyond the resus standard — should be justified by a written rationale so it holds up if CQC asks why a particular frequency or level was chosen.
• Use an established framework to structure content, not invent one from scratch. Skills for Health's Core Skills Training Framework (CSTF) was built as a blueprint any UK healthcare employer, including independent primary care providers, can use to map statutory and mandatory subjects and learning outcomes — it saves a small team from having to define competency standards from first principles.
• Set renewal dates against a single calendar, not per-person memory. A shared spreadsheet or an online CPD tracking platform that flags expiry dates automatically removes the single biggest cause of lapsed compliance in small teams: nobody remembering a certificate expired eight months ago.
• Assign clear ownership per topic. IG training ownership should sit with whoever manages the DSPT submission; clinical training currency should sit with a named clinical lead; the practice manager should own the master matrix and the audit trail, not necessarily deliver every module.
• Build the evidence trail CQC will actually ask for. Completion certificates, supervision notes referencing training, and a short written rationale for chosen frequencies are more persuasive at inspection than a spreadsheet of green ticks with no context behind them.

For practices needing to close specific gaps quickly, Learnsignal's CPD training library covers many of the core statutory and mandatory modules referenced above, with completion records that slot directly into a practice training matrix.

Getting the foundations right pays off at inspection

A GP practice's training matrix will never look like a care home's, and it shouldn't — the roles, the risk profile and the way CQC now assesses the two sectors are genuinely different, a gap the regulator itself is moving to formalise through sector-specific frameworks. What doesn't change is the underlying discipline: know which duties are genuinely statutory, build the mandatory layer on an honest risk assessment rather than habit or a borrowed checklist, and keep the evidence trail current enough that an inspection doesn't become an exercise in reconstructing history. For a small admin team, that discipline — more than any single module — is what keeps a practice's training compliance defensible.