CQC Compliance Explained: the Clinical Governance Essentials

If you run or manage a healthcare service in England, CQC compliance isn't optional. The Care Quality Commission (CQC) is the independent regulator of health and social care in England, and whether you're a GP practice, a private clinic, or a healthtech company delivering care, understanding what CQC requires of you is fundamental.

This guide covers what the CQC is, who needs to register, what compliance actually involves, and what happens if you get it wrong. It's the first in our series on CQC compliance across different types of healthcare providers.

What is the Care Quality Commission (CQC)?

The Care Quality Commission (CQC) is the independent regulator for health and adult social care services in England.* It's an independent executive non-departmental public body, sponsored by the Department of Health and Social Care (DHSC) and set up under the Health and Social Care Act 2008. Its job is to ensure health and social care services providing Regulated Activities are safe, effective, caring, responsive, and well-led.

The CQC registers providers, inspects services, publishes ratings, and can take enforcement action when standards aren't met. If a service receives a "Requires Improvement" or "Inadequate" rating, the consequences can be serious: from reputational damage and increased scrutiny through to suspension or cancellation of registration.

* It's worth noting that the CQC does not have regulatory jurisdiction beyond England - including the devolved nations. If you are looking to provide care elsewhere in the UK you will need to look at separately fulfilling individual countries’ compliance requirements, which may require separately registering with their regulatory body.

Should I Register with the CQC?

If you provide regulated activities in England, you need to be registered with the CQC. This applies to a wide range of services, including (but not limited to):

• GP practices and primary care services
• Healthtech companies that deliver regulated activities
• Private hospitals and clinics
• Dental practices
• Mental health services
• Community health services
• Ambulances
• Care homes and domiciliary care
• Diagnostic and screening services

The key question is whether your service involves carrying out a "regulated activity" as defined in the Health and Social Care Act 2008. If it does, registration is a legal requirement.

What is a "Regulated Activity" as defined by CQC?

Determining whether your service is a Regulated Activity can be confusing!

There are 14 Regulated Activities:

You can check the full list of regulated activities, with detail on exactly what is included and who has to do CQC registration, here.

What does CQC compliance actually mean?

CQC compliance means demonstrating that your service consistently meets the Fundamental Standards set out in the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014.

The CQC assesses services against five key questions:

• Safe: Are people protected from abuse and avoidable harm?
• Effective: Does care, treatment, and support achieve good outcomes?
• Caring: Do staff involve and treat people with compassion, kindness, dignity, and respect?
• Responsive: Are services organised so they meet people's needs?
• Well-led: Is the leadership, management, and governance of the organisation assuring and improving the delivery of high-quality, person-centred care?

These five areas sit at the heart of every CQC inspection. If you're preparing for registration or an inspection, everything you do should map back to demonstrating performance against these questions.

How does CQC inspection work?

The CQC inspects registered services on an ongoing basis. The frequency and focus of inspections depends on the type of service you provide, your existing rating, and any concerns raised about your service.

CQC typically states that all newly registered providers will have their first ratings inspection within 12 months of registration. In reality, there have been backlogs with inspections.

Inspections can be announced or unannounced, in-person (the CQC have an explicit legal right to enter and inspect a registered location), or remote. During an inspection, the CQC may:

• Review your policies and procedures
• Speak to staff and patients
• Observe care being delivered
• Review records, evidence, and documentation
• Assess your governance and leadership structures

After the inspection, the CQC publishes its findings and assigns 1 of 4 ratings:

• Outstanding
• Good
• Requires Improvement
• Inadequate

These ratings are publicly available on the CQC’s website, so they directly affect your reputation and your patients' confidence in your service.

What evidence do you need for CQC compliance?

This is where a lot of providers struggle. The CQC doesn't just want to hear that you have good intentions: it wants evidence. That means documented policies, completed audits, records of staff training, clinical notes, incident logs, patient feedback, and governance processes that you can point to clearly during an inspection.

The categories of evidence you'll typically need include:

• Policies and procedures covering areas like safeguarding, infection control, medicines management, and consent
• Staff records including DBS and right to work checks, training records, and competency assessments
• Risk assessments and evidence of how risks are managed
• Audit trails showing that you regularly review and improve your processes
• Patient, partner and staff feedback and evidence of how complaints and incidents are handled as well as how general feedback is adopted
• Governance documentation including board-level oversight and clinical leadership structures

Getting this evidence organised, current, and inspection-ready is genuinely time-consuming, particularly for growing services or those managing compliance across multiple sites or teams.

How do you prepare for CQC registration or inspection?

Whether you're registering for the first time or preparing for an upcoming inspection, the approach is similar. Start by understanding which regulated activities apply to your service and what the CQC expects to see for each of the five key questions.

Then map your current position honestly against those requirements, identify the gaps, and work systematically to close them.

What happens if you're not compliant?

The CQC has a range of enforcement powers it can use when providers fail to meet the Fundamental Standards. These include:

• Warning notices requiring improvement by a set deadline
• Conditions on your registration (restricting what you can do)
• Suspension of registration
• Cancellation of registration
• Criminal prosecution in serious cases

Beyond formal enforcement, a poor CQC rating affects your ability to attract patients, commissioners, and staff. For private providers especially, a public "Inadequate" rating can have a direct commercial impact.

Changes to the CQC Assessment Approach

Correct as of 11th August 2026. CQC's reform programme is ongoing, so check cqc.org.uk for the current position.

Anyone preparing for a CQC assessment in 2026 needs to hold two frameworks in mind: the one you're assessed against today, and the one replacing it.

Where things stand now. Since January 2024, CQC has assessed all providers against a single assessment framework, built on the five key questions and underpinned by 34 quality statements and six evidence categories. This is still the framework in force, and ratings are reached through a numerical scoring methodology.

What's changing. Following its Better regulation, better care consultation, CQC confirmed in its March 2026 update that it is moving away from a single cross-sector framework. It has published four draft sector-specific frameworks covering adult social care, mental health care, primary care and community services, and hospitals (secondary and specialist care). Three changes matter:

• Key lines of enquiry replace quality statements. The new KLOEs are framed as structured questions describing what CQC will look for during an assessment. It's a return to language many providers will recognise from before 2024.
• Rating characteristics return. Each sector framework will describe what outstanding, good, requires improvement and inadequate care looks like in practice for that sector.
• Scoring is removed. Rating judgements will be made directly at key question level rather than derived from numerical scores.

Timeline. Consultation on the draft frameworks closed on 12 June 2026. CQC has said it will refine each framework and pilot and test them in practice over summer 2026. It hasn't yet published final frameworks or confirmed an implementation date. Until it does, the current framework, quality statements and scoring methodology continue to apply.

We'll publish a full breakdown of the sector-specific frameworks and what each one means for your service once CQC confirms the final versions.

How Assuric Can Help with CQC Registration & Ongoing Compliance

CQC compliance involves a lot of moving parts, and keeping on top of it alongside running a service is genuinely hard. Assuric is built to make that manageable.

→ Gap analysis against CQC standards. Map your current position against CQC requirements so you can see exactly where you stand and what needs attention, without working through the guidance line by line yourself.

→ Staff compliance and training. Role-based training matrices, read-and-acknowledge sign-offs and automated reminders, so you can see who's trained, who's overdue, and where new starters have got to. Registered Managers get a single view across the whole team.

→ Incidents, feedback and complaints. Log incidents, complaints and feedback in one place and track them against the timelines you're held to, so acknowledgements, responses and actions happen on time. You can then show CQC not just what happened, but what you changed as a result.

→ Automated audits. Schedule recurring audits, assign owners and get reminders when they fall due, so audit activity is continuous rather than a scramble in the weeks before an inspection.

→ Risk management. Keep risk assessments and mitigations live and reviewed, with a clear record of who owns each risk and when it was last looked at.

→ Policy templates and a policy library. CQC policy templates written by our advisors that you can adapt for your service, kept up to date as requirements change.

→ Evidence mapped to the five key questions. Controlled documents with version control and approvals, plus a full audit trail, so your evidence is organised against Safe, Effective, Caring, Responsive and Well-led and is inspection-ready when you need it.

If you're preparing for CQC registration or an upcoming inspection, we'd love to show you how Assuric can help. Head here to read more about what CQC expects and how Assuric supports each requirement.

This is the first post in our CQC compliance series. Coming up: CQC compliance for healthtech companies, CQC compliance for NHS and GP practices, and CQC compliance for private healthcare providers.