The CQC framework is changing. Your recruitment files are not.

On 24 March 2026, CQC published four draft sector-specific assessment frameworks, covering adult social care, mental health care, primary care and community services, and hospitals. They replace the Single Assessment Framework, which CQC rolled out in phases from November 2023 and extended to all regions by early 2024. The consultation closed on 12 June 2026, and CQC will pilot and refine the frameworks over the summer, with final versions and implementation to follow.

Most of the commentary has focused on what compliance teams lose. Two years of evidence architecture, built around the 34 quality statements, is being dismantled. That is a real cost, and it is worth naming.

The more useful point is what does not change. Your legal duties on staff fitness come from regulation, not from the assessment format. Regulation 19 still requires that you employ only fit and proper people, that the Schedule 3 checks are complete before someone starts, and that you monitor fitness while they are employed. Regulation 18 still requires sufficient numbers of suitably qualified and competent staff. The NHS Employment Check Standards still set the spine for NHS-facing providers. None of that changed on 24 March, and none of it changes when the new frameworks land.

The framework change is a reason to test one thing: whether the system you already run can answer a harder question, and answer it more often.

What the 2026 CQC assessment framework actually changes

The structure beneath the five key questions

Safe, Effective, Caring, Responsive and Well-led remain, and so do the four rating levels. What changes is the layer between them.

The 34 quality statements are being replaced by key lines of enquiry, framed as structured questions that describe what assessors will actively look for. Quality statements were declarations of intent, written from the provider’s perspective. Key lines of enquiry are questions put to you. Under the old model you demonstrated that you do something. Under the new one you answer a specific question by showing how.

Scoring is going

CQC is removing numerical scoring from its methodology. Rating judgements will be made directly at key-question level, supported by published rating characteristics that describe what outstanding, good, requires improvement and inadequate look like within each sector.

This follows Dr Penny Dash’s review of CQC’s operational effectiveness and Professor Sir Mike Richards’ review of the Single Assessment Framework and its implementation, both of which CQC accepted. Richards recommended retaining the five key questions and removing the evidence-category scoring. That is what has happened.

The commercial read is straightforward. Aggregated percentages gave providers something to optimise against. Rating characteristics give an assessor something to judge against, which shifts the weight onto evidence quality rather than volume.

Assessment volume is rising

CQC committed in its 2025/26 business plan to publishing 9,000 assessments by the end of September 2026, including just over 5,000 in adult social care. That number is worth putting in context. It spans April 2025 to September 2026, and it is low by historical standards: in 2005/06 the Commission for Social Care Inspection completed more than 41,000 inspections.

Low or not, it is a step change from the post-pandemic backlog. If your rating is two or more years old, your odds of an assessment in the next twelve months are materially higher than they have been in years.

Where providers fail on safe recruitment

Recruitment and staffing shortfalls are a recurring theme in CQC findings against Regulations 18 and 19, and most of them are avoidable. The same patterns come up.

• Point-in-time DBS certificates. A DBS check issued two or three years ago and not registered with the Update Service tells you what was true then. Assessors want current verification.
• Right-to-work gaps. A scanned passport without an online share-code check for a non-UK national is a direct breach, with Home Office consequences alongside the CQC ones. Time-limited permissions that nobody tracks to expiry are the same failure with a delay on it.
• Unexplained employment gaps. A brief written explanation signed by the applicant is all that is required. The fact that it is so easy to obtain is exactly why its absence signals a process that did not probe.
• Starting before clearance. Deploying a worker into regulated activity before Schedule 3 is complete breaches Regulation 19, however urgent the rota gap was.
• Agency workers treated as someone else’s problem. Responsibility does not transfer to the staffing agency. If you accept a worker into your service, CQC expects you to be satisfied the checks were done.

There is a common cause under all five. The document was on file, so the document was treated as true. A scanned certificate is a claim made by a candidate. It is not verification, and it does not tell you whether the GMC, the NMC or the DBS agree.

That gap is the opening fraud exploits. The failure modes are well known: a locum working under another clinician’s registration number, or a doctored DBS PDF waved through without a source check. Occasionally it is a clinician disciplined overseas who is still practising here. Each one traces back to the same missing step, a check against the source rather than the paperwork.

What good looks like now

Readiness under the new frameworks is not a project you run before an assessment. It is the state your records are in on any given day. In practice, that means four things.

• One record per clinician. Identity, right to work, professional registration, DBS and references held in a single place, for permanent, bank and agency staff alike.
• Verification against the source. Checks validated against primary sources such as the GMC, the NMC and the DBS, rather than against the PDF someone emailed in.
• Expiry tracked forward. Credentials flagged before they lapse, not discovered after. A system that catches expiries before they lapse, rather than after they surface in an assessment, is a governance argument in itself: it puts you ahead of the questions an assessor asks under safe and well-led.
• Ongoing monitoring, not annual panic. Regulation 19 requires that staff remain fit while employed. Continuous is the only sensible reading of that word.

The part most providers get wrong

The instinct when a framework changes is to buy a new system and migrate everything into it. That is usually the wrong call. Your ATS or CRM already works as your system of record, and your clinician app is where candidates already are. The compliance rules are yours, built around your service. The intelligence layer sits on top of those systems and leaves them in place.

Compliance checks trigger from the ATS you already run. The system measures the delta against records you already hold, carries valid credentials forward, and orders only the gap, so you stop paying to re-run checks you already have. It verifies against the primary sources and auto-approves the document types you choose, with a human stepping in below your accuracy threshold rather than reviewing everything by default.

The measurable result is time. Manual onboarding across the sector runs at around 60 days, most of it checks queuing behind other checks. Running the platform-managed steps in parallel and carrying valid credentials forward brings that stage down to as few as 5 days, alongside longer external checks such as DBS that continue in the background. Ison Nursing cut onboarding from three weeks to a single day on this model.

The commercial case for faster onboarding

Faster onboarding is a revenue argument before it is a compliance one. Every day a clinician waits on checks is a shift covered at premium agency rates, or a candidate who accepted a faster offer elsewhere. Credentially data shows candidate dropout falling by up to 80% where onboarding is embedded and automated, and administrative time down by 68% against previously manual processes.

The compliance argument is the other half of the same system. Evidence stays current because the process keeps it current, rather than because someone spent a fortnight assembling it.

The pilots run this summer and the new frameworks follow. The date that decides your rating is whichever day an assessor arrives, so the practical step is to check your recruitment files against Regulations 18 and 19 now, while the assessment is still hypothetical, working through each Schedule 3 requirement against your current records for permanent, bank and agency staff alike. The customer case studies show how providers have closed those gaps before an assessor arrived.

‍

Frequently asked questions

When does the 2026 CQC assessment framework take effect? CQC published the four draft sector-specific frameworks on 24 March 2026 and closed consultation on 12 June 2026. It will pilot and refine them over summer 2026, with final versions and implementation to follow. No single switch-over date has been confirmed, so the practical assumption is that any assessment from late 2026 onwards could run under the new approach.

Does the new framework change Regulation 19? No. Regulation 19 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 sits in legislation, not in the assessment framework. Your duties to employ only fit and proper people, complete the Schedule 3 checks before someone starts, and monitor fitness on an ongoing basis are unchanged.

What replaces the 34 quality statements? Key lines of enquiry, framed as structured questions that describe what assessors will look for. The five key questions and the four rating levels remain; the layer beneath them changes from provider-written statements of intent to questions put directly to the provider.

Will there still be ratings under the 2026 CQC assessment framework? Yes. The four rating levels stay. What goes is numerical scoring: judgements will be made directly at key-question level against published rating characteristics rather than aggregated percentages.

‍