CQC notification forms: which ones, and how to file them

Providers often search for a specific form because that is how notifications used to work. Today, statutory notifications are submitted through CQC's online notification system, and paper submission is no longer accepted for most categories. So the question “which form do I use?” is really two questions: which category of event has occurred, and what does CQC expect that notification to contain. Get those right and the submission itself is straightforward.

The categories sit in law, principally in Regulation 18 of the Registration Regulations 2009, with a handful of companion regulations carrying their own narrower triggers. The current category list and the live system are CQC's, so check the trigger against the regulation and CQC's own guidance for the event in front of you, rather than relying on memory or a checklist that may be out of date.

The headline triggers under Regulation 18 include serious injury to a person using the service, any abuse or allegation of abuse, any incident reported to or investigated by the police, a prolonged interruption of utilities to the premises, the placement of a young person in an adult psychiatric unit beyond a set period, and Deprivation of Liberty Safeguards applications and their outcomes.

The companion regulations add the death of a person using the service, certain Mental Health Act events, and notifications about the provider as an organisation, such as a change of registered manager. The precise thresholds, for example how serious an injury has to be and how long an interruption has to last, are set out on our Regulation 18 explainer, and you should confirm them against the regulation for the specific event.

One trigger is worth singling out because it is the most commonly missed: the change of registered manager. Providers routinely tell CQC about a new manager in conversation and never submit the formal change notification. It is a notification like any other, and its absence shows up at inspection.

You file through CQC's online notification system, against the category that matches the event. CQC expects the notification to describe the circumstances in enough detail for the regulator to understand what happened, what you are doing in response, and any immediate safeguarding implications. A notification that says an event occurred, with no account of the response, is incomplete even when it is on time.

The system issues a reference number on submission. Keep it, against the source record, the incident or complaint or safeguarding concern that triggered the notification. At inspection, that reference is how you prove the submission actually happened and when, which matters as much as the submission itself.

One exception worth knowing: for health-service bodies, the duty to notify can be disapplied where the incident has already been reported through the relevant national route. Even then, capture the national reference on your own audit trail, so the disapplication is defensible rather than assumed. Confirm the current position for your service against CQC's guidance.

There is no single clock that applies to every trigger. The standard expectation is that a notification arrives without undue delay, with type-specific windows for particular categories. Same-day or next-working-day is a sensible operational target for most events, but the regulation allows some flexibility where the underlying event genuinely needs time to be confirmed.

Because the timing is shaped by the event rather than a single number, it is worth reading the actual duty for the category in front of you. We go into this in detail in how long you actually have to notify CQC.

The notification itself is rarely the hard part. The misses almost always happen earlier, and they fall into four shapes.

Recognition. The event happened and was logged as an incident or a complaint, but nobody connected it to the notification duty at the time, and the window passed before anyone noticed.

Ownership.Everyone agreed a notification was needed, but no single person was named to file it, the task lived in three people's heads, and it never went in.

Deadline and evidence. The notification went in, but late, and with nothing on file to prove it was submitted cleanly, so the audit trail could not stand up at inspection.

The quiet ones. A change of registered manager mentioned but never formally notified is the classic example.

None of these are deliberate. They are all gaps in the system around the notification, not in anyone's intent, which is exactly why the fix is a system: spot the trigger when the event is logged, name an owner, make the deadline visible, and attach the evidence at filing.

The form is the easy bit. What protects people, and what stands up at inspection, is catching that an event qualifies in the first place, owning it, filing it in time, and keeping the proof linked to the event it came from.

That is the part Verivius is built to make automatic. Every incident, complaint and safeguarding concern is checked against the notification triggers the moment it is logged; where one fires, a notification record opens with the source pre-linked and the deadline visible, and the trail runs from the original event to the filed notification to CQC's confirmation. You can read how that works on the statutory-notifications lifecycle and the Regulation 18 explainer.

See how Verivius works for your sector, or talk to us about a design-partner engagement.