Regulation 18: Statutory notifications

Reg 18 sits inside the Registration Regulations 2009 (separate instrument from the 2014 Regulated Activities Regulations that contain Reg 18 staffing; two different Reg 18s is one of the most common provider confusions). It lists categories of event that the registered provider must notify to CQC, alongside companion regulations 12, 13, 14, 15, 16, and 17 of the same 2009 instrument that each carry narrower notification triggers.

The headline triggers under Reg 18 include serious injury to a service user (impairment likely to be lasting, structural change to the body, prolonged pain or psychological harm, shortened life expectancy), any abuse or allegation of abuse, any incident reported to or investigated by the police, prolonged interruption of utilities to the premises (electricity, gas, water, or sewerage for more than 24 hours), placement of a service user under 18 in an adult psychiatric unit for longer than 48 hours, and Deprivation of Liberty Safeguards applications and outcomes. The companion regulations add death of a service user (Reg 16), certain Mental Health Act events (Reg 17), notifications about the provider as a body, and other narrower triggers.

CQC expects the notification to arrive without undue delay. The regulation itself does not set a single statutory clock that applies to every trigger; the standard language is “as soon as reasonably practicable and in any event no later than” followed by a type-specific window. Industry practice uses same-day or next-working-day as the operational target for most categories; the regulation itself permits flexibility where the underlying event needs more time to be confirmed.

CQC expects the notification to describe the circumstances of the event in enough detail for the regulator to understand what happened, what the provider is doing in response, and any immediate safeguarding implications. The notification is submitted through CQC's online notification system; paper submission is no longer accepted for most categories. Reference numbers are issued by the system on submission and the provider should retain them against the source record.

For health-service bodies, the duty to notify is disapplied where the incident has been reported to NHS England (Reg 18(4A)); the NHS reference should still be captured on the provider's own audit trail so the disapplication is defensible at inspection.

Across thirteen years of CQC inspections, Reg 18 was the single most-missed requirement on the inspector's sample. The miss almost never came from deliberate non-compliance. It came from one of four operational gaps. First: the recognition gap; the event happened, the team logged it as an incident or a complaint, but no one made the Reg 18 connection at log-time and the window passed before anyone noticed. Second: the ownership gap; the team agreed the notification was needed but no individual was named, the work split across three people's heads, and the submission never went in. Third: the deadline-and-evidence gap; the notification went in but late, with no evidence of filing attached, and the audit trail at inspection could not prove the submission happened cleanly. Fourth: the registered-manager change; the most-missed single trigger, where providers tell CQC verbally about a new registered manager but never submit the formal change notification. All four gaps are systems gaps; none of them are intent gaps. The fix is the same shape: trigger recognition at log-time, a named owner, a visible deadline, evidence attached at filing.

Verivius drives this regulation through the CQC statutory-notifications lifecycle. Every incident, complaint, and safeguarding concern is checked against the Reg 18 trigger map at the moment it is logged. Where a trigger fires, a notification record opens with the source pre-linked and the deadline visible. The Reg 18 lifecycle then runs through acknowledge, draft, file with the regulator (evidence required at filing), record confirmation, and close. The audit trail at inspection shows the chain from source event to filed notification to confirmation.

Sample policy templates that anchor here: CQC Reg 18 Statutory notifications · CQC Reg 16 Notification of death. The articles CQC notification mistakes that get providers downgraded and How long do you actually have to notify CQC? cover the operational nuance.