Regulation 20: Duty of candour
Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 (SI 2014/2936)
Last verified by Verivius on 21 Oct 2026. Next review due 19 Jan 2027.
Plain British summary
When a notifiable safety incident happens, you must tell the person affected (or the person acting on their behalf) in person as soon as reasonably practicable, give a truthful account of what you know, say what further enquiries you think are appropriate, offer support, apologise, and follow up in writing. What counts as a notifiable safety incident depends on who you are. For a health service body, paragraph (8) sets it, and the test is death, severe harm, moderate harm or prolonged psychological harm that the incident could result in or appears to have resulted in. For every other registered person, which is most independent providers, paragraph (9) sets it, and the test is a different list: death, an impairment that has lasted or is likely to last at least 28 days, changes to the structure of the person's body, prolonged pain or prolonged psychological harm, a shortened life expectancy, or an incident that needs treatment to prevent death or an injury that would otherwise lead to one of those. Read paragraph (9) before you decide, because an incident caught in time can still engage the duty even where little harm was recorded. The regulation does not set a number-of-days deadline for the written stage; any specific deadline you see in Verivius is an operational default, not a legal duty.
Full text on legislation.gov.uk. Treat quotes on this page as targeted excerpts, not as a substitute for the regulation.
Targeted verbatim quotes (9)
“Registered persons must act in an open and transparent way with relevant persons in relation to care and treatment provided to service users in carrying on a regulated activity.”
Reg 20(1) (the headline duty)
“As soon as reasonably practicable after becoming aware that a notifiable safety incident has occurred a registered person must (a) notify the relevant person that the incident has occurred in accordance with paragraph (3), and (b) provide reasonable support to the relevant person in relation to the incident, including when giving such notification.”
Reg 20(2) (the notification trigger)
“The notification to be given under paragraph (2)(a) must (a) be given in person by one or more representatives of the registered person, (b) provide an account, which to the best of the registered person's knowledge is true, of all the facts the registered person knows about the incident as at the date of the notification, (c) advise the relevant person what further enquiries into the incident the registered person believes are appropriate, (d) include an apology, and (e) be recorded in a written record which is kept securely by the registered person.”
Reg 20(3) (the notification content)
“The notification given under paragraph (2)(a) must be followed by a written notification given or sent to the relevant person containing (a) the information provided under paragraph (3)(b), (b) details of any enquiries to be undertaken in accordance with paragraph (3)(c), (c) the results of any further enquiries into the incident, and (d) an apology.”
Reg 20(4) (the written notification)
“harm that requires a moderate increase in treatment, and significant, but not permanent, harm.”
Reg 20(7) (definition of "moderate harm")
“a permanent lessening of bodily, sensory, motor, physiologic or intellectual functions, including removal of the wrong limb or organ or brain damage, that is related directly to the incident and not related to the natural course of the service user's illness or underlying condition.”
Reg 20(7) (definition of "severe harm")
“In relation to a health service body, "notifiable safety incident" means any unintended or unexpected incident that occurred in respect of a service user during the provision of a regulated activity that, in the reasonable opinion of a health care professional, could result in, or appears to have resulted in (a) the death of the service user, where the death relates directly to the incident rather than to the natural course of the service user's illness or underlying condition, or (b) severe harm, moderate harm or prolonged psychological harm to the service user.”
Reg 20(8) (notifiable safety incident: health service bodies)
“In relation to any other registered person, "notifiable safety incident" means any unintended or unexpected incident that occurred in respect of a service user during the provision of a regulated activity that, in the reasonable opinion of a health care professional (a) appears to have resulted in (i) the death of the service user, where the death relates directly to the incident rather than to the natural course of the service user's illness or underlying condition, (ii) an impairment of the sensory, motor or intellectual functions of the service user which has lasted, or is likely to last, for a continuous period of at least 28 days, (iii) changes to the structure of the service user's body, (iv) the service user experiencing prolonged pain or prolonged psychological harm, or (v) the shortening of the life expectancy of the service user; or (b) requires treatment by a health care professional in order to prevent (i) the death of the service user, or (ii) any injury to the service user which, if left untreated, would lead to one or more of the outcomes mentioned in sub-paragraph (a).”
Reg 20(9) (notifiable safety incident: every other registered person)
“an expression of sorrow or regret in respect of a notifiable safety incident.”
Reg 20(7) (definition of "apology")
What Verivius does for you
Automatic DoC sub-lifecycle on qualifying incidents
When you log an incident on a subcategory the taxonomy flags as DoC-relevant, Verivius opens a Duty of Candour sub-lifecycle attached to the incident. You move it through assessment to verbal to written to final outcome, with each stage captured to the audit trail.
Harm-level pre-fill from log-time classification
If you captured a harm level when logging the incident, the DoC assessment dropdown is pre-filled to match. You confirm or change it before recording the assessment.
Written-notification countdown (10 working days)
Verivius shows a 10-working-day countdown for the written stage from the date the DoC assessment is recorded. The countdown turns red on overdue.
No published source identified. Verivius working convention.
Searched legislation.gov.uk Reg 20, the CQC current Regulation 20 guidance page, the CQC 2022 DoC PDF, and NHS England DoC pages on 2026-05-19. None specify a number-of-days deadline for the written stage. The 10-working-day figure circulates widely in UK provider policy documents but no primary statutory or regulator source was located. Treat this countdown as a Verivius working convention, not a legal duty. If a primary source surfaces, this rationale will be replaced with a primary_source variant.
Apology-given checkbox is mandatory
The verbal-notification form requires you to confirm an apology was given before it will save. The apology requirement is anchored in Reg 20(3)(d).
Source-anchored Verivius default. https://www.legislation.gov.uk/uksi/2014/2936/regulation/20 (fetched 21 Oct 2026)
Reg 20(3)(d) lists the apology as a mandatory component of the notification.
What this regulation does NOT say
Industry-folklore claims that are commonly attributed to this regulation but do not appear in the primary source.
Regulation 20(7) sets the harm threshold that triggers the duty.
Paragraph (7) only defines terms, including "moderate harm" and "severe harm". The trigger is the definition of "notifiable safety incident", which paragraph (7) hands to paragraphs (8) and (9). Paragraph (8) applies to a health service body and is the source of the familiar "moderate harm or above" test. Paragraph (9) applies to every other registered person and sets a different list, so an independent provider that screens only on moderate harm or above can miss a notifiable incident, particularly one where treatment prevented the harm.
The written notification must be sent within 10 working days.
A widely-circulated figure in UK provider policy documents and training materials. Some NHS Trust internal policies adopt 10 working days as an internal SLA; some adopt different figures (5, 7, 14). None of these are codified in Reg 20 itself or in CQC published guidance that we have been able to locate. Treat any specific deadline as a tenant operational choice.
A specific apology template or wording must be used.
Reg 20(7) defines "apology" as "an expression of sorrow or regret", no template is prescribed. CQC inspectors look for evidence the apology was genuine and recorded; they do not require a specific form of words.
The verbal stage must be conducted by a clinician.
Reg 20(3)(a) says "in person by one or more representatives of the registered person", it does not require a clinical role specifically. Many providers default to a senior clinician for credibility, but the regulation permits any representative of the registered body.