Client-specific compliance requirements no standard sets

Eighteen registered nurses came off one NHS rota on a Tuesday in July. Every one of them had been checked against the six NHS Employment Check Standards and had completed the extra sign-off their commissioner asked for. The compliance system could not produce the evidence for it inside the day the commissioner allowed.

A protocol document had arrived from the commissioner four months earlier, carrying a line that required every registered nurse on the service to hold a current sign-off on it, renewed every twelve months. Client-specific compliance requirements like that one carry the force of regulation without being regulation, and a compliance system built around the six standards has nowhere to hold them.

What the six standards leave to local policy

NHS Employers publishes six employment check standards, each carrying a last-updated date of 23 July 2026. They fix the type and level of check an employer carries out before someone starts in an NHS post, running from identity and criminal record through to work health, professional registration, right to work and employment history.

What happens after the start date is covered far more thinly, and the requirements of one service or one post are absent altogether. The NHS Employers employment check FAQs, last updated 31 July 2026, show where that silence leads. On periodic criminal record re-checking of existing staff, the page states that "employers may choose to put local policies in place which require this". Local policy is the space the standards leave open, and a commissioner can occupy it.

The FAQs also settle who carries the consequence when work is placed with a supplier. Whatever that supplier has been asked to do, "the overarching responsibility for assuring safe working practice falls to the employing organisation".

How client-specific compliance requirements become binding

NHS England mandates the NHS Standard Contract for use by commissioners across all contracts for healthcare services other than primary care. Version 1 of the 2026/27 service conditions, published in November 2025, carries the mechanism.

Service condition 25 is the route by which a commissioner's own documents enter the contract. On request, either party must send or make available copies of a services guide, a written agreement, a policy, a procedure or a protocol within five Operational Days. Those items are then "deemed incorporated into Schedule 2G (Other Local Agreements, Policies and Procedures) on receipt". SC25.3 states the obligation that follows: "The Parties must comply with their respective obligations under the documents contained or referred to in Schedule 2G (Other Local Agreements, Policies and Procedures)".

A document sent under that route becomes binding at the point it arrives. SC25.2 obliges each party to tell the other about material changes to anything sitting in Schedule 2G, so the schedule keeps moving for as long as the contract runs.

Requirements that are allowed to sit above the regulator's

SC37.2 states the position without qualification: "Nothing in this Contract is intended to prevent this Contract from setting higher quality requirements than those laid down under the Provider Licence (if any) or required by any relevant Regulatory or Supervisory Body".

SC37.3 governs what happens to those requirements between one year and the next. Local quality requirements are agreed before the start of each Contract Year and "must not, except in exceptional circumstances, be lower or less onerous than those for the previous Contract Year", with the agreed set given effect by a variation to the contract.

Read together, the two clauses describe local quality requirements that are permitted to exceed the regulator's and are held at their existing level unless the exception applies. Client-specific compliance requirements arriving by that route carry forward by default.

Training requirements are set per role and audited against the contract

Regulation 18 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 requires that persons employed in a regulated activity "receive such appropriate support, training, professional development, supervision and appraisal as is necessary to enable them to carry out the duties they are employed to perform". Care Quality Commission guidance on that regulation, last updated 16 May 2025, names the category that carries the local layer: "Other mandatory training, as defined by the provider for their role". The provider writes the list, and writes it per role. Neither the regulation nor the guidance supplies one.

The contract then puts a date on the evidence. Under SC32, safeguarding and mental capacity policies must reflect "the local multi-agency policies and any Commissioner safeguarding and MCA requirements", and training runs "for all relevant Staff" with regard to the intercollegiate guidance on safeguarding training. The same service condition obliges the provider to "undertake an annual audit of its conduct and completion of those training programmes". SC21.4 places a separate duty on the same workforce, with the provider using all reasonable endeavours to ensure that "all eligible frontline Staff in contact with Service Users are vaccinated promptly against influenza and/or Covid-19".

One workforce, four sets of client-specific compliance requirements

The provider behind those 18 nurses runs 240 registered nurses across four NHS contracts. That is one workforce carrying four requirement sets on top of the same six standards.

The escalation protocol arrived in March under SC25.1 and bound both parties from receipt. Nothing in the compliance system recorded it, so it went onto a separate list a compliance officer maintained by hand, alongside the client induction another commissioner had asked for.

In July that commissioner asked for evidence on the 61 nurses rostered to the service. The system produced 43 of them inside the day. The remaining 18 existed only in email, and they came off the rota while the evidence was rebuilt around them. Every one of those sign-offs had happened four months earlier, in the week the protocol arrived.

Running the same March as a configuration change

The same protocol, arriving on the same day in March, produces a different set of tasks. It becomes a check in Credentially before the end of that day, carrying its own evidence type and its own twelve-month renewal, attached to that contract and to the registered nurse role. From then on the pre-employment workflow asks each candidate for what their contract and role require and for nothing else, and compliance monitoring holds the twelve-month date against the record and raises an alert before it passes.

Run against 240 records, the check returns 61 in scope, of whom 43 already hold acceptable evidence. The other 18 get a request on their phone with automated reminders behind it, and they photograph a countersigned form between shifts. Medinet, an NHS insourcing provider delivering elective care, has published where it started: candidates completing between 10 and 15 separate forms, and hiring taking 40 to 50 days. On Credentially it reports hiring at 8 days.

By July, the commissioner's request is answered from a report that already exists, and 61 nurses stay on the rota.

The boundary, and where the control sits

Configuration has no view on whether a requirement is reasonable. A commissioner's protocol sign-off is enforceable whether or not anyone believes it adds to patient safety, and SC25 gives it force from the day it arrives. Configuration shortens the interval between a document landing in an inbox and every record it touches being tested against it.

A bespoke check also has a limit on what it can be checked against. A commissioner's own protocol has no register behind it, so the evidence in the record is only as good as the document supplied and the date somebody put against it. Daily re-checks against the professional registers cover the registrations that have one.

The control it does add reaches the rota. A clinician who does not hold a required check can be blocked from booking shifts. For NHS providers and staffing suppliers, that puts the decision about who can work and the evidence answering for it in the same record.

The next Contract Year's requirements are agreed before it starts

Local quality requirements for each Contract Year are settled before that year begins, and SC37.3 does not permit them to be less onerous than the year before. Anything a commissioner adds under SC25 arrives on its own timing and takes effect on receipt. The first of those routes has a date on it and the second arrives whenever a commissioner sends a document, which is the argument for treating client-specific compliance requirements as a standing category inside your own compliance model.

The category can be created before anyone knows what the next requirement will say.

‍

References

1. NHS Employers, Employment standards and regulation. Index of the six NHS Employment Check Standards, each last updated 23 July 2026. https://www.nhsemployers.org/recruitment/employment-standards-and-regulation
2. NHS Employers, Employment check FAQs. Last updated 31 July 2026. Source for "employers may choose to put local policies in place which require this" and for the overarching responsibility of the employing organisation. https://www.nhsemployers.org/articles/employment-check-faqs
3. NHS England, 2026/27 NHS Standard Contract. Source for the contract being mandated for use by commissioners for all contracts for healthcare services other than primary care. https://www.england.nhs.uk/nhs-standard-contract/26-27/
4. NHS England, 2026/27 NHS Standard Contract Service Conditions (Full Length), Version 1, November 2025, publication reference PRN02123. Source for SC21.4, SC25.1 to SC25.3, SC32.4, SC32.5, SC37.2 and SC37.3. https://www.england.nhs.uk/wp-content/uploads/2025/11/03-nhssc-26-27-full-length-service-conditions.pdf
5. The Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, regulation 18. https://www.legislation.gov.uk/uksi/2014/2936/regulation/18
6. CQC, Regulation 18: Staffing. Page last updated 16 May 2025. Source for "Other mandatory training, as defined by the provider for their role". https://www.cqc.org.uk/guidance-regulation/providers/regulations-service-providers-and-managers/health-social-care-act/regulation-18
7. Credentially, Medinet case study. https://www.credentially.io/blogs/case-study-medinet