Prevent Duty Training in Health and Social Care: Who Is Actually Required to Do It

CQC-registered independent providers are not specified authorities under the Prevent duty. That will surprise a lot of compliance managers, and it is worth understanding properly, because it changes where your obligation comes from and therefore how you evidence it.

The duty, in nine words

Section 26(1) of the Counter-Terrorism and Security Act 2015 places a duty on a specified authority, in the exercise of its functions, to "have due regard to the need to prevent people from being drawn into terrorism."

That is the whole duty. A specified authority is any person or body listed in Schedule 6, and where Schedule 6 lists an authority by reference to particular functions, the duty attaches to those functions only. It does not apply to judicial functions or to parliamentary proceedings.

Who is actually specified in health

Schedule 6 specifies, in health: NHS trusts in England and Wales, NHS foundation trusts, Local Health Boards in Wales, and the Board of Community Health Councils in Wales.

That is the list. CQC-registered providers are not on it.

The statutory guidance describes CQC as having "regulatory oversight of independent and NHS-controlled providers" — regulatory oversight, not specified-authority status. The route by which non-trust providers are bound is contractual: NHS England oversees Prevent assurance through the NHS Standard Contract, which applies to commissioned services other than primary care, including private and voluntary organisations, and requires providers to include Prevent in their safeguarding services, policies and training.

So: an NHS trust is caught by statute. A CQC-registered independent provider delivering commissioned services is typically caught by contract. In Wales, monitoring runs through Healthcare Inspectorate Wales and the Care Inspectorate Wales.

Both end up needing the training. But if you are a private provider with no NHS Standard Contract, neither route reaches you — and if you are asserting in a tender that you are a specified authority under Schedule 6, you are asserting something inaccurate.

For a lay framing, the Department of Health and Social Care puts it more broadly: everyone working in healthcare settings, in the NHS or on behalf of the NHS, has a Prevent duty. That is a fair description of practice; Schedule 6 is the law.

Which guidance is current — and it is older than you think

The operative statutory guidance for England and Wales is the 2023 Prevent duty guidance, first published on 14 September 2023, with the page updated on 6 March 2024, in force from 31 December 2023. It replaces the 2015 revised guidance and the 2015 further and higher education versions.

There is no 2025 or 2026 replacement. We checked the collection page directly. The post-Shawcross revision is the 2023 version — that is the update people are often reaching for when they assume something newer exists. Later Prevent activity has produced policy documents and reviews, but it has not replaced the statutory guidance.

For Scotland, the 2015 guidance remains current.

What the guidance says about training

Staff who engage with the public should understand radicalisation. All frontline staff in specified authorities are expected to have a reasonable understanding of extremist and terrorist ideologies. Training should be delivered "at the earliest opportunity."

The named product is the free GOV.UK Prevent duty training service, covering Prevent awareness, the referral process, Channel, and refresher awareness.

On frequency, the guidance is unusually specific in one place and deliberately open in another. Staff with Prevent-specific responsibilities should refresh at least every two years. For everyone else, frequency is set by the organisation's own training needs assessment.

That split is the thing to build your matrix around: a stated two-year minimum for the people who hold the responsibility, and a documented local judgement for the rest. The second half is the same pattern as nearly all mandatory training, where the legal standard is a risk judgement rather than an interval — we set that out in our guide to how often mandatory training is actually required.

WRAP, and the naming problem

If your training records say WRAP — the Workshop to Raise Awareness of Prevent — check what your staff actually completed and when. The official products have been renamed and reorganised more than once, and the three authoritative sources on Prevent training for health and care are consistent in substance and inconsistent in labelling.

The practical advice is to record what the training covered rather than what it was called: Prevent awareness, the referral process, Channel. A record that says "WRAP, 2021" tells an auditor very little in 2026.

Where Prevent sits in your safeguarding structure

Prevent is a safeguarding duty, not a security one, and it belongs in the same governance structure as your other safeguarding work. Referrals go to Channel, the multi-agency panel, and the decision a frontline member of staff actually has to make is the same shape as any other safeguarding decision: recognise, record, escalate.

That is why the levels question matters. A care worker needs to recognise and refer. A safeguarding lead needs to understand the Channel process and hold the relationship with the local authority and police. Treating Prevent as a single organisation-wide e-learning module trains everyone to the first standard and nobody to the second.

Our guide to safeguarding training levels sets out how the children and adult frameworks allocate levels, and our guide to safeguarding children covers the wider statutory framework Prevent sits inside.

What to do

Establish your route first. If you are an NHS trust or foundation trust, you are a specified authority and the duty is statutory. If you are a CQC-registered provider delivering commissioned services, your obligation runs through the NHS Standard Contract and your evidence should reference that contract rather than Schedule 6. If you are wholly private with no such contract, record that you have considered Prevent and decided how you will handle it, because neither route compels you.

Then set two frequencies rather than one: every two years for staff with Prevent-specific responsibilities, and a documented interval for everyone else based on your training needs assessment. And write down which guidance version you trained against — the 2023 document for England and Wales, the 2015 one for Scotland.