The duty of candour: what CQC Regulation 20 requires, when it applies, and what to record

CQC’s guidance sets three criteria. An incident is notifiable only if it meets all three:

1. It was unintended or unexpected. Apply this to what happened during the care or treatment, not to the outcome. If the care went as intended and expected, an incident may not qualify even if harm followed. Known complications aren’t automatically excluded: the clinicians involved must judge whether anything unexpected or unintended happened.
2. It happened during a regulated activity, meaning the care or treatment you’re registered to provide.
3. It meets the harm threshold in the reasonable opinion of a healthcare professional. The threshold depends on the type of provider.

An incident can meet the threshold for NHS trusts and not for other providers, or the other way round. Use the definition for the type of organisation you work in.

The definitions

• Moderate harm: harm that requires a moderate increase in treatment and is significant but not permanent.
• Moderate increase in treatment: an unplanned return to surgery, an unplanned re-admission, a prolonged episode of care, extra time in hospital or as an outpatient, cancelled treatment, or transfer to another treatment area such as intensive care.
• Severe harm: a permanent lessening of bodily, sensory, motor, physiologic or intellectual functions, including removal of the wrong limb or organ, or brain damage, related directly to the incident.
• Prolonged pain and prolonged psychological harm: experienced, or likely to be experienced, for a continuous period of at least 28 days.

Points that catch providers out

• Fault doesn’t matter. An incident can be notifiable with no error by anyone.
• Consent doesn’t exclude it. An incident can be notifiable even if the person consented to the procedure.
• Near misses aren’t in scope. “Could result in harm” covers harm that appears later. Report near misses anyway, and learn from them.
• A return to theatre isn’t automatic. Moderate harm needs both a moderate increase in treatment and significant, but not permanent, harm.
• Unwitnessed incidents count. A care home resident’s unwitnessed fall happens during the regulated activity, so it can qualify if it meets the harm threshold.
• Incidents found later still count. The duty applies to an incident discovered through a retrospective case review or a patient recall.
• Another provider’s incident: tell the provider where it happened, which runs the procedure, and be open with the person about what you found. Where several providers contributed to the harm, each keeps its own responsibilities.

Start as soon as reasonably practicable after you become aware of the incident. The registered person, the registered manager or provider, is responsible and can delegate the work. The “relevant person” is the person harmed, or someone lawfully acting for them if the person has died, is under 16 and not competent to decide, or is 16 or over and lacks capacity.

1. Tell them in person. One or more of your representatives tells the relevant person that a notifiable safety incident has happened.
2. Apologise. An apology is an expression of sorrow or regret. Give it from the start, even while you’re still investigating.
3. Give a true account of all the facts you know about the incident on that date.
4. Explain the further enquiries you think are appropriate.
5. Give reasonable support throughout, including during the conversation. CQC’s examples: an interpreter, information in accessible formats, adjustments for a physical disability, an advocate, signposting to mental health services, and independent help such as AvMA or Cruse Bereavement Care. With the person’s consent, CQC expects you to involve family and carers.
6. Record the conversation in a written record you keep securely.
7. Follow up in writing with the account you gave, the enquiries you’ll make, the results of those enquiries, and an apology.
8. Keep a copy of all correspondence with the relevant person.

If you can’t contact the person, or they decline to speak to you, the in-person notification and written follow-up don’t apply. Keep a written record of every attempt to contact them, and still report and investigate the incident. If the incident also meets a notification threshold, report it through the system that applies to your sector, such as CQC’s notifications. If you provide NHS-funded care, your PSIRF plan sets how you learn from the incident.

The duty of candour is one of the fundamental standards. CQC looks at it through whether a service is well led, whether it has an open and safe culture, and whether it meets the specific requirements of Regulation 20. CQC doesn’t investigate every notifiable safety incident, and its judgements fall on the registered person, not individual clinicians.

Failing to carry out the in-person notification steps in Regulation 20(2)(a) and (3) is an offence under Regulation 22, and CQC can move directly to prosecution. Its other options include warning notices, requirement notices and conditions on registration. A provider has a defence if it proves it took all reasonable steps and exercised all due diligence to prevent the breach.

The professional duty. Doctors, nurses, midwives, dentists and other registered professionals have a professional duty of candour set by their own regulators. The GMC and NMC publish joint guidance on it. It sits on the individual, and CQC doesn’t regulate it.

Scotland has its own organisational duty of candour, in force since 1 April 2018 under the Duty of Candour Procedure (Scotland) Regulations 2018. The Scottish Government revised its guidance in March 2025.

Wales made the duty of candour a legal requirement for all NHS organisations from April 2023.

Northern Ireland has no statutory organisational duty of candour yet. In September 2025 the Health Minister said he had tasked officials with developing a Bill.