Sample policy · CQC Reg 18

CQC statutory notifications policy template

Statutory anchor: Regulation 18 (notification of other incidents), Care Quality Commission (Registration) Regulations 2009 (SI 2009/3112). This policy also engages Regulation 16 (notification of death of a service user) and Regulation 17 (notification of death or unauthorised absence of a service user detained under the Mental Health Act 1983) of the same Registration Regulations, and Regulation 20 (duty of candour) of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 (SI 2014/2936). · primary source

Download the PDF

The PDF version of this template is the same content, formatted for adaptation in your document control system. The disclaimer above is repeated on the PDF cover.

Download PDFTalk to a consultant

Verivius pack version v1, 2026-06-10

1. What the regulation says

any injury to a service user which, in the reasonable opinion of a health care professional, has resulted in (Reg 18(2)(a), serious harm lead-in)

an impairment of the sensory, motor or intellectual functions of the service user which is not likely to be temporary, (Reg 18(2)(a)(i))

changes to the structure of a service user's body, (Reg 18(2)(a)(ii))

the service user experiencing prolonged pain or prolonged psychological harm, or (Reg 18(2)(a)(iii))

the shortening of the life expectancy of the service user. (Reg 18(2)(a)(iv))

any abuse or allegation of abuse in relation to a service user. (Reg 18(2)(e))

any incident which is reported to, or investigated by, the police. (Reg 18(2)(f))

an interruption in the supply to premises owned or used by the service provider for the purposes of carrying on the regulated activity of electricity, gas, water or sewerage where that interruption has lasted for longer than a continuous period of 24 hours, (Reg 18(2)(g)(ii))

any placement of a service-user under the age of eighteen in a psychiatric unit whose services are intended for persons over that age where that placement has lasted for longer than a continuous period of 48 hours. (Reg 18(2)(h))

any request to a supervisory body made pursuant to Part 4 of Schedule A1 to the 2005 Act by the registered person for a standard authorisation; (Reg 18(4A)(a), standard authorisation request)

any application made to a court in relation to depriving a service user of their liberty pursuant to section 16(2)(a) of the 2005 Act. (Reg 18(4A)(b), application to court)

The full text of the regulation is at https://www.legislation.gov.uk/uksi/2009/3112/regulation/18. Where this policy and the regulation diverge, the regulation wins.

2. Plain-English summary

A long list of "other incidents" must be notified to CQC without delay: serious harm to service users, abuse and allegations of abuse, incidents reported to or investigated by the police, events threatening your ability to continue safely (insufficient staff, lengthy utility interruptions, premises damage, fire-alarm failure), placement of under-18s in adult psychiatric units lasting over 48 hours, and Deprivation of Liberty Safeguards standard authorisation requests and Court of Protection applications where the Registration Regulations require notification. For health service bodies, the duty is disapplied where the incident has been reported to NHS England.

Reg 18 is the most-missed CQC requirement in the experience of the founder over thirteen years as a CQC inspector. The miss is rarely deliberate; the gap is in recognition (the team did not realise the event qualified) and process (no system flagged the deadline).

3. Scope

This policy applies to all employees, contractors, and external parties at who may identify or record events that could meet a Reg 18 notification trigger. It covers every regulated activity, every site, every patient pathway, and the cross-link from incidents, complaints, safeguarding concerns, and other source events to the notifications register.

(Tenant updates the angle-bracket placeholder.)

4. Roles and responsibilities

(Tenant updates the named role-holders.)

5. Procedure

The Reg 18 procedure operationalises the notification lifecycle from trigger identification through CQC confirmation to closure.

  1. Trigger recognition at log-time. When an incident, complaint, or safeguarding concern is logged, the platform's regulatory-trigger map is applied. The Notification Lead confirms the trigger call within the same working day. Events identified by the trigger map as Reg 18 in scope spawn a notification record automatically.
  2. Direct triggers (non-incident sources). Some Reg 18 triggers do not flow from an incident: police involvement (any incident reported to or investigated by police), utility interruption longer than 24 hours, prolonged absence of a service user detained under MHA, DoLS applications, fitness-of-the-provider events. These are logged directly as notification records by the Notification Lead.
  3. Acknowledge. The Notification Lead acknowledges the notification, confirming the trigger applies and the work is in their queue. Acknowledgement stops the dashboard counting it as unattended.
  4. Draft the submission. The Notification Lead drafts the regulator-facing wording using the CQC online notification form (or the equivalent CQC channel). The factual account is checked against the source record; the registered manager reads the wording before submission for any notification involving severe harm, death, or abuse.
  5. File with CQC. The notification is filed through CQC's online system. The reference number returned by CQC, the submitter's name, the submission timestamp, and a screenshot or PDF of the confirmation are recorded against the notification.
  6. Record confirmation. Where CQC sends a separate confirmation (some channels do not), the confirmation is recorded against the notification.
  7. Close. The notification closes when the regulator-side process is complete. The closure paragraph confirms what was filed and when.
  8. Not-applicable closure. Where a trigger fired but on review the team concludes the notification is not in fact required (the threshold was misread, the event was outside the regulated activity, the patient was not actually a service user under CQC's definition), the record closes as Not Applicable with reasoning of at least 50 characters explaining why. The reasoning is the defence at inspection.
  9. Health-service-body disapplication. For NHS-funded providers where the event has been reported to NHS England, the Reg 18 duty to CQC is disapplied per Reg 18(4A). The Notification Lead records the NHS England reference so the disapplication is auditable.
  10. Pattern review. The aggregate notification pattern (count by category, time-from-trigger-to-file, late submissions, not-applicable closures) is reviewed at the monthly governance meeting.

6. Training requirement

Training records held in the tenant's training matrix register.

7. Audit

Compliance with this policy is monitored by the Registered Manager:

Audit findings recorded in the tenant's audit register; actions logged in the improvement-actions register.

8. Record-keeping

Notification records (the platform record, the regulator-facing wording filed, the CQC reference number returned, any confirmation correspondence) are held for a minimum of 8 years from the date of the last entry per the NHS Code of Practice on Records Management. Notifications relating to children are retained until the child reaches the age of 25. Notifications related to safeguarding follow the safeguarding retention layered on top.

Verivius preserves the per-record audit trail indefinitely while the workspace is active.

9. Related policies in this pack

10. Sources and further reading

This template is based on CQC's guidance for providers and managers, the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, and other topic-specific legislation and guidance listed below. It is a starting point for adaptation, not a substitute for legal, clinical, HR, safeguarding or specialist professional advice.

11. When to seek further advice

Seek specialist advice where the issue involves serious harm, safeguarding, deprivation of liberty, restraint, children, professional misconduct, controlled drugs, radiation, termination of pregnancy, infection outbreak, water safety, employment dismissal, DBS barring referral, or regulatory enforcement.

12. Document control

Version Date Author Changes
v1 2026-05-19 Verivius (sample) Initial sample template.
v1.1 2026-06-01 Verivius (sample) Filled out Sections 3 to 8 with concrete content. Section 4 names the Notification Lead role with the trigger-recognition responsibility. Section 5 expanded to a 10-step Reg 18 lifecycle (trigger recognition, direct triggers, acknowledge, draft, file, confirm, close, not-applicable, NHS England disapplication, pattern review) tied to the platform's notification engine. Section 6 names training tiers. Section 7 names the per-incident sign-off audit and the quarterly pattern review. Section 8 references the NHS Code of Practice.
v1, 2026-06-10 2026-06-10 Verivius (sample) Re-conformed to the current Verivius policy standard, preserving the original content. Added the verbatim "What the regulation says" blockquotes with cite labels, the plain-English summary, the policy owner / applies-to line, and the standard Sources and further reading and When to seek further advice blocks. The original scope, roles, procedure, training, audit, record-keeping and related-policy content is preserved unchanged.

This sample policy template was issued by Verivius as part of the Mock Inspection design partner onboarding pack. It is a template, not a substitute for legal advice or the tenant's own policy-development process. Where this template and live law or regulator guidance diverge, the live source wins.

What good looks like here

Written from an ex-CQC inspector's chair, but the point is safe, well-led care your team can stand behind. Each row shows what strong evidence looks like, what thin evidence looks like, and where the expectation comes from.

The failure mode here is almost never a missed deadline. It is a missed recognition. A qualifying event, abuse or an allegation of abuse, an injury that in the reasonable opinion of a health care professional has impaired function, changed the structure of the body, caused prolonged pain or prolonged psychological harm or shortened life, or a service so short of staff or so badly damaged that it can no longer operate safely, gets logged as an ordinary incident, screened by nobody against the notification triggers, and closed. The person who was harmed still gets their review and their apology, so internally the event feels handled. What is lost is external. Nobody outside the service ever sees the pattern those notifications would have formed, so a service that is quietly drifting keeps drifting, and the people using it carry a problem that stayed in-house. This is the rare policy where the strongest evidence is often a decision not to notify. A trail showing each qualifying event was actively considered and consciously ruled out is what tells the service itself, well before it tells anybody else, that recognition is still working rather than resting on one person's memory.

  1. Every incident, complaint and safeguarding concern is screened for a notification trigger at log-time and the decision recorded, not just the notifications that were obviously required. Regulation 18 is missed on recognition (the team not realising the event qualified), so the decision trail that matters most sits on the events that did NOT result in a notification.

    Strong evidence: The per-incident sign-off (every incident, complaint and safeguarding concern closed in the trailing month checked for the Reg 18 trigger call) and the notification register showing a recorded decision against each possible notification (event date, identification date, decision date).

    Weak evidence: A register that lists only the events you did notify, with no line for the far larger set of incidents, complaints and safeguarding concerns you screened and judged not notifiable. Missing identification dates, so nobody can tell whether the trigger call was made when the event was logged or reconstructed later at audit.

    Our recommended baseline. Not a legal or regulatory requirement, but a sensible standard we suggest where the rules leave the detail to you. Adapt it to your service.

  2. Any abuse or allegation of abuse in relation to a service user generates a CQC notification in its own right. A referral to the local-authority safeguarding team and a statutory notification to CQC under the Care Quality Commission (Registration) Regulations 2009 are separate and independent duties, and neither discharges the other, so the notification decision is made against the abuse allegation itself, not against whether a safeguarding referral was made.

    Strong evidence: The safeguarding sample with its notification decision and the notification register entry filed under the abuse or allegation-of-abuse trigger (Reg 18(2)(e)).

    Weak evidence: A safeguarding file that proves a local-authority referral was made but is silent on whether a separate CQC notification was even considered, with the two decisions collapsed into one line. The register carries no entry under the abuse or allegation-of-abuse trigger, so the record reads as 'we referred, so CQC was covered'.

    A legal duty. This comes from legislation that applies to your service, so meeting it is not optional. The exact provision is cited beneath the badge.

    Care Quality Commission (Registration) Regulations 2009 (SI 2009/3112), reg 18(2)(e)

  3. Events meeting the serious-harm threshold are recognised as notifiable in the reasonable opinion of a health care professional. The failure that costs people is the injury recorded as an incident and closed there, never held against the serious-harm categories, so the harm is never counted and the pattern behind it is never seen.

    Strong evidence: The incident sample with its notification decision, screened against the Reg 18 serious-harm categories (impairment of the sensory, motor or intellectual functions not likely to be temporary; changes to the structure of the body; the service user experiencing prolonged pain or prolonged psychological harm; the shortening of life expectancy).

    Weak evidence: An injury logged as an incident and graded for internal severity but never held against the serious-harm categories, with no named health care professional recorded as forming the opinion. A fracture or a pressure injury closed on the incident system with nothing asking whether function was impaired other than temporarily, the structure of the body changed, the person experienced prolonged pain or prolonged psychological harm, or life expectancy was shortened.

    A legal duty. This comes from legislation that applies to your service, so meeting it is not optional. The exact provision is cited beneath the badge.

    Care Quality Commission (Registration) Regulations 2009 (SI 2009/3112), reg 18(2)(a)(i)-(iv)

  4. Each filed notification carries its submission evidence, not just an assertion that CQC was told. Without the confirmation and the wording actually filed, the colleague who picks the case up next cannot tell what CQC was told or whether it matched the source record.

    Strong evidence: The notification record with the CQC reference number returned, the submitter's name, the submission timestamp and a screenshot or PDF of the confirmation, with the submitted wording checked against the source record for accuracy.

    Weak evidence: A tick or a free-text note reading 'notified CQC' with no reference number returned, no submitter named and no screenshot or PDF of the confirmation. Asked to produce the wording actually filed, you can only describe it from memory rather than show it against the source record.

    Our recommended baseline. Not a legal or regulatory requirement, but a sensible standard we suggest where the rules leave the detail to you. Adapt it to your service.

  5. A trigger that fired but was closed without a notification carries recorded reasoning for why the threshold was not met, not a silent decision. That reasoning is what lets the next person re-open the call if the judgement was wrong, and it is what the service stands on when the decision is later questioned.

    Strong evidence: The not-applicable closure record with reasoning (the threshold was misread, the event fell outside the regulated activity, or the person was not a service user under CQC's definition), with borderline decisions showing Registered Manager or senior review.

    Weak evidence: A trigger that fired and was then quietly closed with the status set to not applicable and the reasoning box left blank or filled with 'N/A'. Nothing showing which threshold was misread or why the person fell outside scope, and no senior or Registered Manager review recorded on the borderline calls.

    Our recommended baseline. Not a legal or regulatory requirement, but a sensible standard we suggest where the rules leave the detail to you. Adapt it to your service.

  6. Where a health service body relies on the disapplication because the event was reported to NHS England, the NHS England reference is recorded so the decision not to notify CQC is auditable, not an unevidenced assumption that reporting elsewhere covered it. The disapplication turns on the provider being a health service body, not on the care being NHS-funded, so a registered person who is not a health service body notifies CQC in the ordinary way.

    Strong evidence: The notification record capturing the NHS England reference under the health-service-body disapplication (Reg 18(4A)).

    Weak evidence: A note that the incident 'went to NHS England' or was 'on the national system', with no reference number captured, so the decision not to notify CQC rests on an unevidenced assumption. Nothing on the record establishes that the service is a health service body, which is what the disapplication actually turns on, rather than simply NHS-funded, and nothing lets a reviewer confirm the report reached NHS England at all.

    Our recommended baseline. Not a legal or regulatory requirement, but a sensible standard we suggest where the rules leave the detail to you. Adapt it to your service.

Related

Last verified 20 July 2026

Audit this policy

Statutory notifications procedure checklist

A policy is the intent; the evidence is what a CQC inspector actually asks to see. This matching checklist turns the policy above into the records to keep, the audit to run, and the places small services most often fall short.

Open the Statutory notifications procedure checklist

Spotted something to improve?

These are sample templates, not the last word. If you would change a wording, or want to help us confirm a detail, tell us and we will look at it.

Related Verivius content

Want help adapting this to your service?

A Verivius consultant can read your adapted policy against the live regulation and your service shape. The work fits inside a Mock Inspection engagement or a shorter consulting brief. A 20-minute conversation is the fastest way to find out whether the fit is right.

Get started free

Free to start, no card. A 14-day trial when you subscribe.

Last reviewed 10 June 2026