Understand CQC registration requirements

Review your CQC registration, regulated activities, and annual fee obligations. Notify CQC of any changes to registered manager or nominated individual.

CQC inspection ratings explained

CQC rates services Outstanding, Good, Requires Improvement, or Inadequate across five key questions. An Inadequate rating can trigger special measures and potential closure.

Outstanding: Significantly exceeds fundamental standards
Good: Meets fundamental standards consistently
Requires Improvement: Not meeting all standards - action plan required
Inadequate: Serious failings - enforcement action likely
Rating domains: Safe, Effective, Caring, Responsive, Well-led
Re-inspection frequency: Risk-based - no fixed re-inspection intervals
Rating display requirement: Within 21 calendar days of publication
Penalty for not displaying: Offence - fine on summary conviction

CQC is replacing the single assessment framework with sector-specific frameworks during 2026; the four ratings and five key questions are retained.

CQC enforcement powers

CQC can issue warning notices, impose conditions, suspend registration, or cancel registration entirely. Criminal prosecution is possible for operating without registration or failing to meet fundamental standards.

Operating without registration: Unlimited fine and/or up to 12 months' imprisonment (either-way offence, section 10(4))
Breach of fundamental standards: Unlimited fine (criminal prosecution)
Failure to display rating: Fine on summary conviction (Regulation 20A)
Obstruction of inspector: Unlimited fine
False statement in application: Level 4 fine (£2,500), summary only (section 37)
Warning notice (section 29): Formal requirement to comply; representations within 10 working days
Conditions on registration (section 12): Restrictions imposed via notice of proposals (section 26) and decisions (section 28)
Suspension (section 18) / urgent suspension or variation (section 31): Temporary cessation; urgent cancellation via justice of the peace order (section 30)
Cancellation of registration (section 17): Cannot provide regulated activities
Appeals: To the First-tier Tribunal within 28 days (section 32)

Healthcare professional registration requirements

Understand registration requirements for doctors, nurses, dentists, pharmacists, and allied health professionals including fees and revalidation cycles.

GMC revalidation requirements

Doctors must demonstrate continued fitness to practise through appraisal, CPD, patient feedback, and colleague feedback. Responsible Officers oversee revalidation for employed doctors.

Know your revalidation date

Revalidation occurs every 5 years from when you obtained full registration. Check your personal revalidation date in GMC Online and set reminders.
Participate in annual appraisals

Have an annual appraisal with your designated appraiser (arranged by NHS employer or private appraisal service). Review your practice, create personal development plan, and document CPD activities.
Maintain supporting information portfolio

Continuously collect: CPD records (the GMC sets no minimum hours - follow your royal college or faculty guidance), quality improvement activities, significant events, colleague feedback (multisource feedback), patient feedback, complaints and compliments review.
Ensure connection to responsible officer

You must have a designated connection to a responsible officer who will review your evidence. Most NHS doctors are automatically connected through their employer.
Undergo responsible officer review

Near your revalidation date, your responsible officer reviews your portfolio and appraisal evidence and makes a recommendation to GMC: revalidate, defer, or non-engagement.
Receive GMC decision

GMC reviews the recommendation and makes final decision. You'll be notified via GMC Online. If revalidated, your new 5-year cycle begins immediately.

NMC revalidation requirements

Nurses and midwives submit revalidation online every 3 years. Employers should support staff by providing practice hours confirmation and participating in reflective discussions.

Know your revalidation date

Revalidation is required every 3 years from your registration date. Check NMC Online for your exact date and set reminders (6 months, 3 months, 1 month before).
Log practice hours

Record minimum 450 practice hours over 3 years (or 900 if registered as both nurse and midwife). Log in the NMC revalidation form.
Complete CPD hours

Complete minimum 35 hours CPD over 3 years, with at least 20 hours being participatory learning. Document what you learned and how you applied it to practice.
Write reflective accounts

Write 5 reflections linking your CPD or practice-related feedback to NMC Code standards. Keep these in your portfolio.
Collect practice-related feedback

Obtain minimum 5 pieces of feedback from patients, service users, or colleagues over your 3-year cycle. Use in reflective accounts.
Have reflective discussion

Discuss your 5 reflective accounts with another NMC registrant. Record discussion details and obtain confirmation from your discussion partner.
Obtain confirmation

Have an NMC registrant (confirmer) review all your evidence and confirm your declaration is honest. May be the same person as your discussion partner.
Submit revalidation online

Submit via NMC Online up to 60 days before deadline. Complete the form, pay your fee, and make revalidation declaration. You may be selected for verification (a sample of submissions is checked).

DBS checks for employers

Understand DBS check levels, eligibility for enhanced checks, processing times, and using the DBS Update Service for ongoing monitoring.

DBS check levels and fees

DBS checks range from basic (spent and unspent convictions) to enhanced with barred list (for regulated activity with vulnerable groups). Healthcare typically requires enhanced level.

Basic DBS check: £20 - unspent convictions and conditional cautions
Standard DBS check: £20 - spent and unspent convictions and cautions
Enhanced DBS check: £41 - standard plus relevant local police information
Enhanced with barred lists: £41 - enhanced plus whether the applicant is barred
DBS Update Service: £15 per year, free for volunteers
Volunteers: Standard and enhanced checks are free

A responsible organisation may charge an administration fee on top of the DBS fee for a basic check. Standard and enhanced checks are available only to employers entitled to ask an exempted question under the Rehabilitation of Offenders Act 1974 (Exceptions) Order 1975. The Update Service covers standard and enhanced checks only.

Check someone's criminal record (opens in a new tab)

Safeguarding and mental capacity

Understand your duties under the Care Act 2014, Mental Capacity Act 2005, and Making Safeguarding Personal approach.

Care Act safeguarding framework

The Care Act 2014 established statutory safeguarding duties including the Making Safeguarding Personal approach. Multi-agency working and information sharing are essential.

When section 42 applies (England)

Section 42 applies where a local authority has reasonable cause to suspect that an adult in its area, whether or not ordinarily resident there, has needs for care and support (whether or not the authority is meeting any of those needs), is experiencing or at risk of abuse or neglect, and is unable to protect themselves against it because of those needs. The authority must make, or cause to be made, whatever enquiries it thinks necessary to decide whether any action should be taken and, if so, what and by whom. The duty sits with the local authority, not the provider.

The Care and Support statutory guidance (paragraph 14.17) lists the types of abuse and neglect to consider: physical abuse, domestic violence or abuse, sexual abuse, psychological abuse, financial or material abuse, modern slavery, discriminatory abuse, organisational abuse, neglect and acts of omission, and self-neglect. The statutory guidance endorses the Making Safeguarding Personal approach, which puts the person's views, wishes and outcomes at the centre of safeguarding.

What providers must do

A provider registered with the Care Quality Commission must, under regulation 13 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014:

establish and operate systems and processes effectively to prevent abuse of service users
establish and operate systems and processes effectively to investigate, immediately upon becoming aware of it, any allegation or evidence of abuse
not provide care or treatment in a way that discriminates, uses unnecessary or disproportionate control or restraint, is degrading, or significantly disregards the service user's needs
not deprive a service user of their liberty for the purpose of receiving care or treatment without lawful authority

Regulation 18 of the Care Quality Commission (Registration) Regulations 2009 also requires the registered person to notify the Commission without delay of any abuse or allegation of abuse in relation to a service user. Section 45 of the Care Act 2014 requires a person to supply information to a Safeguarding Adults Board on request where the conditions in that section are met.

Enquiry duty: Local authority, Care Act 2014 s.42
Provider duty: Regulation 13, 2014 Regulated Activities Regulations
Notify CQC: Any abuse or allegation of abuse, without delay (2009 Registration Regulations, reg 18)
Types of abuse: Ten, listed in statutory guidance paragraph 14.17
Applies in: England

Mental Capacity Act 2005

Healthcare providers must follow Mental Capacity Act principles when caring for adults who may lack capacity. This includes capacity assessments, best interests decisions, and understanding Deprivation of Liberty Safeguards (DoLS).

The statutory principles

A person must be assumed to have capacity unless it is established that they lack it.
A person is not to be treated as unable to make a decision unless all practicable steps to help them have been taken without success.
A person is not to be treated as unable to make a decision merely because they make an unwise decision.
An act done or decision made for a person who lacks capacity must be done or made in their best interests.
Before the act is done or the decision made, regard must be had to whether the purpose can be achieved in a way that is less restrictive of the person's rights and freedom of action.

Assessing capacity

A person lacks capacity in relation to a matter if, at the material time, they cannot make a decision for themselves because of an impairment of, or disturbance in the functioning of, the mind or brain. The impairment can be permanent or temporary (section 2). A person cannot make a decision if they cannot understand the relevant information, retain it, use or weigh it as part of making the decision, or communicate the decision (section 3). Lack of capacity cannot be established merely by reference to age, appearance, or a condition or behaviour that might lead others to make unjustified assumptions.

Best interests

The person deciding must consider all relevant circumstances (section 4), including whether the person is likely to regain capacity, and must so far as reasonably practicable permit and encourage them to take part. They must consider the person's past and present wishes and feelings, and the beliefs and values likely to influence their decision, and take into account the views of anyone named by the person, carers, and any attorney or deputy where practicable and appropriate.

Deprivation of Liberty Safeguards (England and Wales)

Section 4A of the Act allows a person to be deprived of their liberty only if the deprivation is authorised by Schedule A1 (hospital and care home residents) or by a relevant decision of the court. The managing authority of the hospital or care home must request a standard authorisation from the supervisory body where the conditions in Schedule A1 are met.

A standard authorisation lasts for the maximum authorisation period stated in the best interests assessment, which is the shorter of the assessor's recommended period and one year.
If the deprivation needs to begin before a standard authorisation can be given, the managing authority can give itself an urgent authorisation of no more than 7 days, and the supervisory body may extend it once by no more than a further 7 days.
In England, all assessments for a standard authorisation must be completed within 21 days beginning with the date the supervisory body receives the request, or during the period of an urgent authorisation if one is in force (Mental Capacity (Deprivation of Liberty: Standard Authorisations, Assessments and Ordinary Residence) Regulations 2008, regulation 13).
In Wales, each assessor must complete their assessment within 21 days of being instructed by the supervisory body, or within 5 days where an urgent authorisation has been given (Welsh Regulations 2009, regulation 9).

Liberty Protection Safeguards

The Mental Capacity (Amendment) Act 2019 provides for Liberty Protection Safeguards to replace DoLS, but its main provisions come into force only on a day appointed by regulations. Section 4A(5) of the Mental Capacity Act 2005 still refers to Schedule A1, so DoLS remains the scheme in force.

Core law: Mental Capacity Act 2005
DoLS: Schedule A1 to the Act
Urgent authorisation: Up to 7 days, one extension of up to 7 days
Standard authorisation: Up to 1 year, as set by the best interests assessment
Assessment time (England): 21 days from the supervisory body receiving the request
Liberty Protection Safeguards: Not in force
Applies in: England and Wales

Mental Capacity Act Code of Practice (opens in a new tab)

Medicines and controlled drugs compliance

Understand legal requirements for storing, prescribing, administering, and recording medicines including controlled drugs.

Controlled drugs regulations

The Misuse of Drugs Regulations 2001 classify controlled drugs into five schedules with varying levels of control. Healthcare providers must comply with storage, recording, and destruction requirements.

The five schedules

Schedule 1: drugs with no recognised medicinal use, such as LSD. A Home Office licence is needed.
Schedule 2: includes morphine, diamorphine, fentanyl, methadone and oxycodone. These carry the strictest controls, including registers and prescription requirements.
Schedule 3: includes buprenorphine, temazepam, midazolam, tramadol, gabapentin and pregabalin. Prescription requirements apply, but the register duty in regulation 19 does not.
Schedule 4: Part 1 includes most benzodiazepines, zolpidem and zopiclone.
Schedule 5: low-strength preparations with the lightest controls.

Registers

A person authorised to supply Schedule 1 or Schedule 2 drugs under regulation 5 or 8 of the Misuse of Drugs Regulations 2001 must keep a register (regulation 19). The register must have a separate part for each class of drug and a separate page for each strength and form. Entries must be in chronological order, made on the day of the transaction or, if that is not reasonably practicable, the next day, in indelible ink or in a computerised form in which each entry is attributable and capable of being audited. Entries must not be cancelled, obliterated or altered; a correction is made by a dated marginal note or footnote. The register must be kept at the premises it relates to and used only for purposes related to the Regulations (regulation 20).

For drugs obtained, each entry records the date received, the name and address of the supplier and the quantity. For drugs supplied, including by administration, it records the date, the name and address of the person or firm supplied, the prescriber's or licence holder's details, and the quantity. For Schedule 2 drugs it also records who collected the drug and whether proof of identity was requested and provided. The senior registered nurse in charge of a ward, theatre or other department in a hospital, care home or prison is not subject to this register duty (regulation 19(3)(c)). Registers must be preserved for two years from the last entry (regulation 23). The Regulations do not require a running balance column.

Prescriptions

A prescription for a controlled drug in Schedules 1 to 3 must be indelible, dated and signed by the prescriber, and must give the prescriber's address (other than for health prescriptions), the name and address of the patient, the dose, and the form and strength or the total quantity in both words and figures (regulation 15).

Safe custody (Great Britain)

The Misuse of Drugs (Safe Custody) Regulations 1973 apply to premises occupied by a retail pharmacy business and to care homes. The occupier and every person concerned in managing those premises must ensure that controlled drugs, other than those exempted by Schedule 1 to those Regulations (which includes midazolam), are kept so far as circumstances permit in a locked safe, cabinet or room built and maintained to prevent unauthorised access and to the structural requirements in Schedule 2 to those Regulations. The requirement does not apply to a drug under the direct personal supervision of a pharmacist (in a pharmacy) or of the person in charge of the care home or a member of staff they designate.

Accountable officers (England)

Under the Controlled Drugs (Supervision of Management and Use) Regulations 2013, each designated body in England must appoint or nominate an accountable officer. In England the designated bodies are NHS trusts, NHS foundation trusts, English independent hospitals (unless fewer than ten people work there or the Care Quality Commission has determined otherwise), NHS England and the headquarters of the armed forces. A person who manages or carries on a care home is a relevant person under regulation 5, for whom NHS England is the relevant body, and does not appoint an accountable officer.

Register duty: Schedule 1 and 2 drugs only (reg 19)
Register retention: Two years from the last entry (reg 23)
Prescription rules: Schedules 1 to 3 (reg 15)
Safe custody premises: Retail pharmacies and care homes
Accountable officer: Designated bodies in England (2013 Regulations, reg 8)
Applies in: England, Scotland and Wales (accountable officers: England and Scotland)

Medical devices and equipment compliance

Understand MHRA registration, UKCA/CE marking, vigilance reporting, and equipment maintenance requirements.

Medical Devices Regulations

Medical devices must meet UK safety standards, carry appropriate UKCA/CE marking, and comply with post-market surveillance requirements. Healthcare providers must report adverse incidents.

Who the Regulations place duties on

The Medical Devices Regulations 2002 (SI 2002/618, as amended) place the duties on conformity assessment, product marking, registration and post-market surveillance on manufacturers and, for manufacturers outside the UK, on their UK responsible person. Devices fall into classes I, IIa, IIb and III by risk, with class III the highest. The Medicines and Healthcare products Regulatory Agency (MHRA) carries out market surveillance.

CE and UKCA marking

In Great Britain, CE-marked general medical devices compliant with the EU medical devices directive or active implantable medical devices directive can be placed on the market until the sooner of certificate expiry or 30 June 2028. CE-marked in vitro diagnostic devices compliant with the EU IVD directive can be placed on the market until the sooner of certificate expiry or 30 June 2030. Devices compliant with the EU Medical Devices Regulation or In Vitro Diagnostic Regulation can be placed on the market until 30 June 2030. Otherwise devices need UKCA marking. In Northern Ireland the EU Medical Devices Regulation and In Vitro Diagnostic Regulation apply.

Post-market surveillance

The Medical Devices (Post-market Surveillance Requirements) (Amendment) (Great Britain) Regulations 2024, made on 16 December 2024 and in force from 16 June 2025, added a post-market surveillance and incident-reporting regime to the 2002 Regulations. Its reporting deadlines, including for serious incidents and serious public health threats, bind the manufacturer.

Reporting an adverse incident

In England, Wales and Northern Ireland, report any adverse incident involving a medical device to the MHRA through the Yellow Card scheme, in line with your organisation's medical device policies and procedures. If you cannot report online, email aic@mhra.gov.uk; adverse incidents cannot be reported by telephone. Do not throw away or repair a device that has been involved in an incident; make it available to the manufacturer for analysis unless the police or a coroner is involved.

In Scotland, report to the Health Facilities Scotland online incident reporting system rather than the Yellow Card scheme.

Governing law: Medical Devices Regulations 2002 (SI 2002/618, as amended)
Regulator: MHRA
Risk classes: I, IIa, IIb, III
CE marking (EU directive devices): Accepted in Great Britain to the sooner of certificate expiry or 30 June 2028
CE marking (EU MDR/IVDR devices): Accepted in Great Britain until 30 June 2030
Incident reporting: Yellow Card (England, Wales, Northern Ireland); Health Facilities Scotland (Scotland)

Report a problem with a medicine or medical device (opens in a new tab)

Data protection for businesses

Understand UK GDPR requirements, lawful bases for processing, paying the data protection fee to the Information Commission (formerly the ICO), and data breach notification obligations.

Responding to data breaches

Understand your legal obligations when a data breach occurs, including notifying the Commission and communicating with affected individuals.

Meet workplace health and safety requirements

A comprehensive journey for UK employers to understand and comply with health and safety law.

Meet fire safety requirements for your business premises

If you control business premises in England or Wales, you are a responsible person under the Fire Safety Order 2005.

Employer health and safety duties

Review your full duties under health and safety law including policy requirements, training, and consultation with workers.

Choosing the right business insurance

Start with the insurance the law requires: if you employ anyone, you must have employers' liability insurance with at least £5 million cover, and business vehicles need motor insurance.

Professional indemnity insurance

Professional indemnity insurance covers claims arising from professional negligence, errors, or omissions in clinical practice. Healthcare insurance costs vary significantly based on specialty and activity risk.

Legal requirement: Required by professional regulators for many solicitors, financial advisers and architects. Healthcare requirements vary by role and regulator. For accountants, PI cover is generally a professional-body requirement (such as ICAEW or ACCA), not a requirement in law
Solicitors minimum: £2-3 million per claim (SRA minimums)
Financial advisers minimum: €1.25 million per claim (FCA requirement)
Architects minimum: £250,000 for domestic work
What it covers: Claims of negligent advice or services causing client financial loss

Legally required insurance

Employers' liability insurance is a legal requirement. Most healthcare providers also need professional indemnity and public liability insurance, though only EL is statutory.

Required for: Employers of anyone, including part-time staff
Minimum cover: £5 million
Fine, no insurance: Up to £2,500 for each day
Fine, certificate not displayed: Up to £1,000
Covers: Employee injury or illness claims
Exempt: Employers with only close family as employees, unless the business is a limited company
Exempt, based abroad: Employees normally based abroad, until they spend 14 days continuously in Great Britain (7 days on an offshore installation)
Exempt, single employee: A company whose only employee is its owner and who holds 50% or more of the issued share capital

Employers' Liability Insurance (opens in a new tab)

Employers' liability exemptions and fines

A small number of employers are exempt. Not displaying your certificate carries a fine of up to £1,000.

Required for: Employers of anyone, including part-time staff
Minimum cover: £5 million
Fine, no insurance: Up to £2,500 for each day
Fine, certificate not displayed: Up to £1,000
Covers: Employee injury or illness claims
Exempt: Employers with only close family as employees, unless the business is a limited company
Exempt, based abroad: Employees normally based abroad, until they spend 14 days continuously in Great Britain (7 days on an offshore installation)
Exempt, single employee: A company whose only employee is its owner and who holds 50% or more of the issued share capital

Employers' Liability Insurance (opens in a new tab)

MHRA authorisation overview

Overview of MHRA authorisation types for manufacturers and distributors of medicines and medical devices.

Running clinical trials

If you conduct clinical trials, understand MHRA authorisation, ethics approval, GCP requirements, and safety reporting obligations.

Run a healthcare business

Next steps

Growing your business

Start importing goods to the UK

Transfer ownership of your business

Related journeys

Prepare for CQC's 2026 assessment framework

Start a healthcare business

Healthcare compliance quick check

Run a retail business