CQC prosecutions: when regulatory concerns become criminal proceedings

A CQC prosecution is one of the most serious forms of enforcement available to the regulator. CQC can prosecute care providers and, in some circumstances, registered managers, directors and other individuals when regulatory failures amount to criminal offences. We explain what CQC can prosecute, how a criminal investigation develops, what happens at a PACE interview and what providers should do when concerns arise.

A poor CQC inspection is one thing. A criminal investigation is quite another.

The Care Quality Commission‘s powers to take civil enforcement action are generally well known to providers and registered managers. These include Warning Notices and Notices of Proposal and Decision, to impose conditions on, suspend or cancel a provider’s registration.

However, CQC also has criminal enforcement powers. It can investigate suspected offences and, where the relevant legal tests are met, prosecute providers and individuals.

For providers facing serious regulatory concerns, an important question is how an incident, inspection finding or other concern can progress into a criminal investigation, and what should be done if that happens.

What is a CQC prosecution?

A CQC prosecution is a criminal prosecution brought by the Care Quality Commission in relation to an offence falling within its regulatory powers.

CQC’s criminal enforcement options include prosecution, simple cautions and fixed penalty notices. Civil regulatory action may also be taken alongside criminal enforcement in appropriate cases.

Importantly, not every breach of the Fundamental Standards is automatically a criminal offence. Whether CQC can prosecute will depend on the particular regulation, the circumstances and, for some offences, whether the necessary harm or risk threshold has been reached.

What offences can CQC prosecute?

CQC’s criminal powers derive principally from the Health and Social Care Act 2008, the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 and the Care Quality Commission (Registration) Regulations 2009.

Offences can include:

• carrying on a regulated activity without the required CQC registration;
• failing to comply with conditions of registration;
• certain failures to provide information, reports or notifications required by CQC;
• breaches of the Duty of Candour;
• specified breaches of certain Fundamental Standards where the breach results in avoidable harm to service users, or service users being exposed to a significant risk of avoidable harm, or financial loss through theft, misuse or misappropriation; and
• other offences created by the legislation CQC is responsible for enforcing.

In our experience, some of the criminal matters most frequently encountered involve breaches of Regulation 12, Safe Care and Treatment, suspected provision of regulated activities without CQC registration, and breaches of conditions of registration.

A breach of Regulation 12, for example, can be prosecuted where a failure to provide safe care and treatment causes avoidable harm or exposes a person using the service to a significant risk of harm.

Can directors and registered managers be prosecuted personally?

Yes, in some circumstances.

CQC’s enforcement activity will often focus on the organisation providing the regulated service, but individuals can also face criminal enforcement.

Registered managers may incur liability under particular regulatory offences. In addition, section 91 of the Health and Social Care Act 2008 provides for personal liability in certain circumstances where an offence committed by a corporate body took place with an individual’s consent or connivance, or was attributable to their neglect.

This can apply to directors, managers, company secretaries and people purporting to act in those capacities.

The possibility of individual liability makes it particularly important for senior people involved in a service to understand where responsibility for regulatory decisions sits, how risks have been managed and what evidence exists of the steps taken in response to concerns.

How does a CQC concern become a criminal prosecution?

CQC’s Enforcement Decision Tree uses a four-stage process when considering enforcement.

Stage 1: Initial assessment

Concerns can emerge in many ways, including through inspections, statutory notifications, complaints, safeguarding information, whistleblowing, RIDDOR reports, incidents or information supplied by members of the public.

CQC will consider the possible breaches, the level of harm or risk involved and what further enquiries or evidence may be required.

At this point, providers should avoid assuming that correspondence from CQC is simply part of an ordinary regulatory process. Where a potentially prosecutable offence may have occurred, information gathered at an early stage could later form part of a criminal investigation.

Stage 2: Legal and evidential review

If concerns progress, CQC may gather a substantial amount of evidence.

Depending on the case, this could include:

• care plans and risk assessments;
• medication records;
• staffing rotas;
• training records;
• incident reports and investigation documents;
• policies and procedures;
• emails and other correspondence;
• CCTV or other recordings; and
• witness evidence.

Providers should preserve relevant records and never make retrospective alterations to historic documents.

Continuing risks should, of course, be addressed. However, there should be a clear distinction between documenting action being taken now and changing the historical evidence of what was in place at the time of the incident.

This is also a point at which obtaining specialist health and social care legal advice can be particularly valuable.

Stage 3: Selecting the appropriate enforcement action

CQC will then consider what form of enforcement action is appropriate.

Factors can include the seriousness of the breach, its actual or potential impact on people using the service, the evidence available and whether criminal proceedings are justified. A provider’s compliance history and the risk of recurrence will also be taken into account. 

Where criminal enforcement is being considered, CQC will assess whether there is sufficient evidence to provide a realistic prospect of conviction and whether prosecution is in the public interest.

Civil and criminal enforcement are not necessarily alternatives. Depending on the circumstances, regulatory action concerning a provider’s registration may run alongside a criminal investigation.

Stage 4: Final review

Before a final enforcement decision is reached, the case is reviewed in accordance with CQC’s enforcement process and priorities.

The period before this decision can be particularly important. Effective legal and evidential representations may influence whether criminal proceedings are pursued at all.

We recently advised a healthcare provider that had received a suspected criminal offence letter relating to section 10 of the Health and Social Care Act 2008. Following detailed representations concerning whether the activities in question required CQC registration, CQC confirmed that it would take no further action and closed the investigation. [Link to CQC Section 10 case study]

What happens during a CQC criminal investigation?

Once criminal enforcement is a possibility, providers need to think carefully about how they respond to CQC.

Requests for documents and information

A provider should establish the legal basis on which information is being requested.

Some CQC requests may be made under statutory information-gathering powers, while other enquiries may form part of an investigation into a suspected criminal offence. Different considerations may therefore apply.

Deadlines should be identified and complied with where required, relevant evidence should be preserved and legal advice should be obtained where there is uncertainty over how best to respond.

Is there a defence to a CQC prosecution?

For certain offences under Regulation 22 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, a statutory defence may be available where the registered person can show that they took all reasonable steps and exercised all due diligence to prevent the breach.

Evidence of what the provider actually did before the incident can therefore become extremely important.

Risk assessments, audits, staff training, policies, supervision, escalation records and action taken when previous concerns arose may all become relevant when establishing whether reasonable preventative steps were taken.

What happens at a CQC PACE interview under caution?

Where CQC suspects that a criminal offence may have been committed, it may invite a provider, registered manager, director or another individual to take part in an interview under caution.

CQC conducts criminal investigations with regard to the principles and codes of practice under the Police and Criminal Evidence Act 1984, commonly known as PACE.

An interview under caution should be treated very differently from an ordinary meeting with an inspector. What is said may subsequently be relied upon as evidence in criminal proceedings.

Specialist advice should therefore be obtained before responding to such a request.

Depending on the circumstances, legal advice may cover whether and how to participate in an interview, the evidence already available, the appropriate response to particular allegations and whether written representations or other submissions should be made instead.

Our health and social care regulatory team, led by Errol Archer, has extensive experience advising providers and individuals during CQC investigations and interviews under caution.

How does CQC decide whether to prosecute?

Before bringing a prosecution, CQC applies the principles contained in the Code for Crown Prosecutors.

There must be sufficient evidence to provide a realistic prospect of conviction and prosecution must be in the public interest.

The fact that CQC is investigating a suspected offence does not therefore mean that a prosecution will inevitably follow.

Depending on the circumstances, alternatives may include a simple caution or fixed penalty notice. CQC may also or instead use its civil enforcement powers.

What are the potential consequences of a CQC prosecution?

The consequences depend on the offence.

Some CQC offences carry unlimited fines. Carrying on a regulated activity without the required registration can also carry a potential custodial sentence.

A court may additionally order a defendant to pay prosecution costs and a victim surcharge.

The wider consequences can be equally important. A prosecution may affect a provider’s reputation, its relationship with commissioners and other stakeholders and future regulatory decisions. For individuals, there may also be implications for their registration or professional position.

What do recent CQC prosecutions tell us?

Recent cases illustrate the range of circumstances in which criminal enforcement can arise.

In June 2026, Gloucestershire Hospitals NHS Foundation Trust was fined £300,000 and ordered to pay a total of £324,143.47 after pleading guilty to failing to provide safe care and treatment. The case concerned a patient who contracted a pseudomonas infection.

Also in June 2026, Woodland Healthcare Limited was fined £50,000 and ordered to pay £68,000 in total following a prosecution relating to a serious fall during a transfer procedure.

In another June 2026 case, care home manager Janice Sowden pleaded guilty to three safe care and treatment offences involving avoidable harm. She was fined £1,900 and ordered to pay £4,090 in total.

In March 2026, Equilibrium Healthcare Limited and its registered manager both pleaded guilty to offences relating to safe care and treatment. The provider was fined £26,800, while the registered manager was fined separately, demonstrating that criminal liability is not necessarily confined to the provider organisation.

In February 2026, Yorklea Limited was prosecuted for breaches of the Duty of Candour after failing to inform the appropriate person about a resident’s deteriorating pressure sore and failing to provide the required apology.

These cases show that CQC prosecutions are not confined to allegations of deliberate mistreatment. Criminal proceedings can arise from failures to identify and manage foreseeable risks, inadequate systems, failures to respond appropriately when risks become known and breaches of specific regulatory obligations. They also demonstrate that CQC can pursue individual managers, not merely provider companies.

What should you do if you receive a CQC investigation or prosecution letter?

If correspondence from CQC indicates that a possible criminal offence is being investigated, act promptly.

Providers should consider:

• preserving all potentially relevant evidence;
• establishing exactly what offence or regulatory breach CQC may be investigating;
• identifying the legal basis of any request for documents or information;
• reviewing the relevant incident and the evidence that existed at the time;
• addressing any continuing risks without altering the historical record;
• potentially conducting an internal investigation if not completed at the time; and
• obtaining specialist legal advice before making substantive representations or taking part in an interview under caution.

If an investigation was not completed at the time of the incident, it may still be appropriate to conduct one. It should, however, be based on the records, evidence and policies that existed at the relevant time and clearly identify any later findings or remedial action.

The period before CQC makes its prosecution decision can be critical. A detailed understanding of the evidence, the applicable offence and any available defence can help providers make focused representations before a final decision is reached.

For directors and registered managers, there is a wider lesson. When a serious incident occurs, it is sensible to consider the regulatory consequences beyond the next inspection and whether actions taken today would withstand scrutiny if the incident later became the subject of a criminal investigation.

Frequently asked questions about CQC prosecutions

Can CQC prosecute a registered manager?

Yes. CQC can prosecute individuals in appropriate circumstances, including registered managers. Individual liability will depend on the particular offence and the person’s involvement. Directors, managers and certain other officers may also incur liability in relation to corporate offences where consent, connivance or neglect can be established.

Does CQC have to issue a Warning Notice before prosecuting?

Not always. For some offences CQC can proceed directly to criminal enforcement. For example, a qualifying breach of Regulation 12 resulting in avoidable harm or a significant risk of harm can be prosecuted without CQC first issuing a Warning Notice.

What happens if I am invited to a CQC interview under caution?

An interview under caution forms part of a criminal investigation. What you say may be used as evidence in subsequent proceedings. You should obtain specialist legal advice before deciding how to respond and before attending an interview.

How long does CQC have to bring a prosecution?

Different considerations can apply depending on the offence, but proceedings for offences under Part 1 of the Health and Social Care Act 2008 are subject to statutory time limits. Proceedings must generally be commenced by CQC within three years of the date of the offence.

Can a CQC criminal investigation end without prosecution?

Yes. An investigation does not automatically lead to court proceedings. CQC must consider the evidence and the public interest before prosecuting. Depending on the case, it may decide not to take further action or may consider another form of enforcement.

When should I obtain legal advice?

It is generally better to obtain advice when criminal enforcement first becomes a realistic possibility rather than waiting for CQC to decide to prosecute. Early advice can help with preserving evidence, understanding CQC’s allegations, responding to information requests, preparing for interviews under caution and making representations before the final prosecution decision.

For further information about CQC investigations, criminal enforcement or other health and social care regulatory matters, please contact Errol Archer, specialist regulatory solicitor, on 07729 421836 or [email protected].

This article is provided for general information only and does not constitute legal advice.