Check the scope
Every CQC-regulated health and social care provider. The statutory incident definition differs between health service bodies and other registered persons; NHS-funded work alone does not make a provider an NHS trust.
What the law requires
- Act openly and transparently about care and treatment. Following a notifiable safety incident, notify the relevant person as soon as reasonably practicable and provide reasonable support.
- The notification must include the known facts, proposed enquiries and an apology, be given in person and recorded securely. Provide the required written follow-up, including enquiry results, and retain correspondence.
- Apply Regulation 20(8) to health service bodies and 20(9) to other providers. If the relevant person cannot be contacted or declines to speak, record attempts and apply the statutory exception.
What CQC expects
- CQC guidance distinguishes NHS trusts and foundation trusts from other providers. The latter definition specifies particular harm outcomes or treatment needed to prevent them; a generic moderate-harm test is insufficient.
- CQC expects timely, compassionate communication and support. An apology is not an admission of liability. Openness continues even when the formal incident threshold is not met.
Suggested checks for your review
- Sample incidents both above and below the recorded candour threshold and check the healthcare professional’s opinion and provider category used.
- Trace an eligible incident through the discussion, apology, support, written follow-up and investigation updates.
- Check candour separately from CQC incident notifications; completion of one process does not establish completion of the other.
Illustrative evidence
Choose evidence relevant to the actual service and risk. These examples are not a universal list of documents required by CQC.
- Incident assessments explaining the relevant threshold and decision.
- Secure meeting records, correspondence and evidence of support offered.
- Follow-up communications and learning from the person’s experience.
Potential gaps to check
- Staff wait for a completed investigation before sharing known facts and apologising.
- The incident form is closed after external reporting without evidence of communication with the relevant person.
Sources and review
- cqc.org.uk — Regulation 20 (opens in a new tab)
- cqc.org.uk — Regulation 20 in full (opens in a new tab)
- cqc.org.uk — Incidents (opens in a new tab)
- cqc.org.uk — What you must do (opens in a new tab)
- legislation.gov.uk — Uksi · 2014 · 2936 · regulation · 20 (opens in a new tab)
Content version: 1 November 2026. Next planned review 1 December 2026. Check current primary sources before relying on a requirement.
Give the finding a next step.
Add a non-confidential action or evidence reference to your own working plan.
Open the evidence workbenchRelated guidance and next steps
Content version: . Named expert review remains pending for public launch.