CQC Framework Overhaul: What Healthcare Businesses Must Do Before 12 June 2026

The Care Quality Commission's consultation on its Single Assessment Framework (SAF) overhaul closes on 12 June 2026 — 11 days from now. If you run a care home, GP practice, dental practice, private clinic, domiciliary care agency, or any other registered health or social care business in England, this is arguably the most important regulatory document you'll read this month. The new framework will reshape how the CQC inspects your business, what evidence you need to provide, and how your rating is calculated. Missing the consultation window means the new rules land on your doorstep without your voice having shaped them.

This guide explains what's changing, why the CQC has been forced to reform its inspection framework, what the surge in assessments means for your business in the second half of 2026, and what you need to do before 12 June. We'll also cover two additional compliance pressures that hit healthcare businesses hardest in the coming weeks: the Data (Use and Access) Act formal complaints procedure (19 June) and the Fair Work Agency's active enforcement programme — both of which healthcare businesses are disproportionately exposed to.

What Is the CQC Single Assessment Framework?

The CQC introduced the Single Assessment Framework in November 2023, replacing the previous Key Lines of Enquiry (KLOEs) system that had been in place since 2017. The idea was sound: rather than large set-piece inspections every few years, the SAF was designed to enable continuous monitoring through "quality statements" — 34 individual statements across the five key questions (Safe, Effective, Caring, Responsive, Well-led) against which providers are rated.

Under the new model, the CQC assesses providers using a mix of:

• Onsite inspection activity
• Offsite intelligence gathering (notifications, complaints, staff surveys)
• Provider-submitted evidence
• Feedback from people using services
• Data from partner organisations

Each quality statement is scored on a four-point scale (Outstanding, Good, Requires Improvement, Inadequate), and these scores are aggregated into an overall rating. The aggregation methodology — specifically how the scores combine to produce a key question rating, and how key question ratings combine to produce an overall rating — is at the heart of the current controversy.

Why the CQC Was Forced to Reform

The honest answer: the SAF as implemented has been operationally chaotic. A highly critical independent review published in October 2024 found significant problems with the CQC's ability to consistently apply the framework. The review identified issues including IT system failures that left inspection data stranded, inconsistent scoring between inspection teams, and a scoring aggregation model that produced anomalous results — providers with strong performance in 30 out of 34 quality statements receiving "Requires Improvement" overall due to a weak score in one area.

The CQC itself acknowledged in December 2024 that it had paused updating ratings for some providers due to data quality concerns. That admission was significant: a regulator publicly acknowledging it cannot reliably operate its own assessment system is extraordinary. Throughout 2025, the CQC worked on remediation, and the consultation launched in April 2026 represents the formal process to reform the framework before re-escalating inspection activity in the second half of the year.

The key problems the consultation seeks to address:

• Aggregation methodology — how quality statement scores combine into key question ratings
• Evidence weighting — what counts, how much, and whether provider-submitted evidence is sufficiently considered
• Consistency — reducing variation between inspection teams in how they apply quality statements
• Transparency — giving providers clearer sight of what evidence has contributed to their rating
• Appeal process — streamlining the factual accuracy check and formal challenge process

For healthcare business owners, this matters because the outcome of this consultation directly determines how you'll be assessed from late 2026 onwards. Providers who respond — and particularly those who submit evidence of how the current framework has produced anomalous results for their business — can directly influence the final methodology.

What the Overhaul Proposes to Change

The consultation document sets out several proposed changes that healthcare businesses need to understand. The most significant are:

Revised aggregation model

The proposed new model introduces a threshold-based aggregation system rather than the current weighted average. Under the proposal, a provider can only receive an "Outstanding" overall rating if the majority of key questions are rated Outstanding. Critically, a single "Inadequate" key question rating would automatically trigger an overall "Requires Improvement" — removing the current ability for strong scores in other areas to mask a weak one.

This is a double-edged sword. For providers who have been dragged down by anomalous scores, the clearer methodology brings consistency. For providers who have relied on aggregate averaging to maintain a "Good" overall rating despite one weak key question, the new model creates new risk.

Evidence submission window

The consultation proposes a formal structured evidence submission window — typically 28 days before a planned assessment — in which providers can submit up to 30 pages of evidence directly addressing the quality statements. This would replace the current ad hoc process, where providers can submit evidence but there's no formal structure for when and how it's considered.

Real-time provider portal

A significant proposal is a live provider portal allowing registered managers to see, in real time, the evidence and intelligence the CQC holds about their service — and to flag inaccuracies before they feed into an assessment. Currently, providers often learn of damaging intelligence only when they see a draft inspection report.

Inspection team consistency

The consultation proposes mandatory cross-team calibration sessions before assessments, with inspection leads required to document how quality statements have been applied and why. This is a direct response to the independent review finding that identical services in different CQC regions were receiving materially different scores.

The 9,000-Assessment Surge: What It Means for You

Here is the operational reality that every registered healthcare business in England needs to understand: the CQC has a backlog. Following the pause on rating updates in 2024–25, the CQC has committed to completing 9,000 assessments by September 2026. That is a significant acceleration from the 2024–25 run rate, and it means the probability of your business being assessed in the next six months is materially higher than in any recent period.

The sectors being prioritised for assessment are:

• Residential adult social care (care homes, nursing homes)
• Domiciliary and home care agencies
• GP practices currently rated "Requires Improvement" or with outstanding actions from previous inspections
• Independent acute hospitals and private clinics that haven't been assessed under the SAF
• Mental health and learning disability services

The consequence of an "Inadequate" rating is not just reputational. It triggers a mandatory improvement notice, intensified monitoring, and — in the most serious cases — enforcement action up to and including cancellation of registration. CQC inadequate ratings are publicly searchable and appear in Google results for your business name. For a private clinic competing for self-paying patients, or a care home competing for local authority placements, a public "Inadequate" rating can be existential.

A care home rated "Inadequate" in the recent Winchley assessment cycle had 73% of its publicly visible enquiries drop within 30 days of the rating being published. The inspection itself was announced with five days' notice.

The DUAA Deadline Healthcare Businesses Are Missing

On 19 June 2026 — just 18 days after the CQC consultation closes — a second major compliance obligation lands specifically hard on healthcare businesses: the formal data complaints procedure under the Data (Use and Access) Act 2025.

Under Section 103 of the DUAA, all data controllers must have a formally documented complaints procedure for data protection complaints by 19 June. This is not a general data protection obligation — the ICO has confirmed this is a new, separate requirement for a specific written process that:

• Sets out how data protection complaints will be received and acknowledged
• Defines who handles the complaint internally
• Commits to a response timeline (the ICO expects 30 days maximum)
• Documents the escalation path to the ICO if the complainant is unsatisfied

Healthcare businesses handle some of the most sensitive personal data in existence — health records, diagnoses, mental health notes, medication records. They are also among the most common targets for data protection complaints. The ICO's maximum fine under DUAA is £17.5 million or 4% of global turnover. Most healthcare SMBs have no formal complaints procedure in place. This is a straightforward fix — a single document — but it needs to be done.

Fair Work Agency: Healthcare Is a Primary Enforcement Target

The Fair Work Agency (FWA) launched on 7 April 2026 and is now in active enforcement mode. The FWA enforces National Minimum Wage, Statutory Sick Pay, and holiday pay compliance — and healthcare is one of its stated priority sectors.

The reason: the care sector has historically been one of the highest-risk sectors for National Minimum Wage underpayment. The specific mechanisms are well-documented:

• Sleep-in shifts: Care workers on overnight sleep-in shifts who are paid a flat allowance rather than the full NMW for all hours slept may be underpaid. Post the Royal Mencap v Tomlinson-Blake Supreme Court ruling, this area remains contested, but the FWA has indicated it will pursue cases where workers are being paid below NMW for time spent awake and responding to calls.
• Unpaid uniform time / travel between clients: Care workers who travel between clients and are not paid for travel time, or who are required to wear a uniform and spend time changing at the start/end of shifts without pay, may have legitimate underpayment claims.
• Sick pay: SSP must be paid from day one of illness for qualifying workers — a requirement in force since April 2026. Many small care businesses and GP practices still operate a "three-day wait" policy, which is no longer lawful.

The National Living Wage from April 2026 is £12.71 per hour for workers aged 21 and over. For care businesses paying care assistants at or near the minimum, any deductions or unpaid time create underpayment exposure.

The FWA has enforcement powers including naming and shaming, fines of 200% of underpayment, and referral for criminal prosecution in the most serious cases. It can investigate anonymously-reported cases without a formal complainant.

What to Do Before 12 June 2026

You have 11 days until the CQC consultation closes. Here is what your business should do:

1. Respond to the CQC consultation

The consultation is open to all registered providers and stakeholders. You don't need a solicitor to respond. The CQC consultation portal accepts individual responses and trade body submissions. If you have experienced anomalous scoring under the current SAF — strong quality statements producing a lower-than-expected overall rating — submitting evidence of this directly influences the new methodology. The consultation closes at midnight on 12 June 2026. Access it via cqc.org.uk/get-involved/consultations.

2. Prepare for an assessment in H2 2026

With 9,000 assessments planned by September, assume you could be assessed with 5–10 days' notice. Your preparation checklist:

• Check your last rating and any outstanding actions — address them now
• Compile your evidence pack for each of the 34 quality statements
• Update your policies and procedures — particularly safe staffing, medication management, and safeguarding
• Brief your registered manager on the SAF evidence requirements
• Check your CQC provider portal is up to date with current notifications
• Run a mock quality statement self-assessment — score yourself honestly

3. Implement your DUAA data complaints procedure by 19 June

This is a one-document fix. Create a written procedure that covers: receipt of complaint, acknowledgment timeline, internal handler, response standard, and escalation to ICO. Publish it on your website or make it available to patients/clients on request. Document that it exists. Done.

4. Audit your Fair Work Agency exposure

Review your pay practices against NMW (£12.71/hr for 21+), SSP from day one, and holiday pay for all workers including those on variable hours. If you have care workers on sleep-in shifts, get specialist legal advice. The FWA is not issuing warnings — it is investigating and enforcing.

5. Get CQC regulation monitoring in place

The CQC framework, DUAA rules, and FWA enforcement guidance are all actively evolving. Tracking changes manually — reading CQC updates, ICO guidance, and FWA enforcement notices — takes hours every week. ComplianceAlert monitors all three in real time and sends you plain-English alerts when anything changes that affects your business.

Frequently Asked Questions

Do I have to respond to the CQC consultation?

No, it's optional. But if you are a registered CQC provider, the consultation outcome will directly affect how your business is assessed from late 2026. Providers who respond — particularly with evidence of specific problems under the current framework — directly influence the final methodology. It takes under an hour to submit a response. The consultation closes midnight 12 June 2026.

What if the CQC arrives for an assessment before the new framework is finalised?

The current SAF remains in force until the CQC formally publishes the revised framework, expected in autumn 2026. Any assessment completed before then will use the current methodology. The 9,000-assessment target runs to September 2026, meaning most of the surge will be conducted under the current rules. Prepare for a current-framework assessment now — and benefit from the reformed framework when it arrives.

When does the DUAA formal complaints procedure come into force?

Section 103 of the Data (Use and Access) Act 2025 requires all data controllers to have a formal data protection complaints procedure in place from 19 June 2026. This is mandatory for all organisations that process personal data — including all CQC-registered healthcare businesses. The ICO has published guidance on what the procedure must include.

Are sleep-in shifts covered by the National Minimum Wage?

This remains complex following Royal Mencap v Tomlinson-Blake [2021] UKSC 8, which found that workers genuinely sleeping (not on call) during sleep-in shifts are not entitled to NMW for those sleeping hours. However, time spent awake responding to care needs must be paid at NMW. The FWA is actively examining how the ruling is being applied in practice. Get specialist advice for your specific arrangements.

What is the CQC Single Assessment Framework consultation link?

Access the consultation at cqc.org.uk/get-involved/consultations. You'll need to create a CQC account to submit a formal response. You can also respond via your trade association if they are coordinating a sector response.

Key dates at a glance:

• 12 June 2026: CQC SAF overhaul consultation closes
• 19 June 2026: DUAA formal data complaints procedure mandatory
• September 2026: CQC targets 9,000 assessments completed
• Autumn 2026: Revised CQC framework expected to be published

Healthcare businesses are facing more simultaneous regulatory pressure right now than at any point in the past decade. The CQC is accelerating inspections while reforming its framework. The FWA is actively enforcing wage and sick pay compliance. DUAA creates a new data protection obligation in 18 days. None of these can be managed by checking a government website once a month.

ComplianceAlert was built specifically for this problem: automated monitoring of all UK regulatory changes, plain-English alerts when something changes, and a document library of 43+ compliance templates to implement changes quickly. Start free at compliancealert.co.uk/healthcare — no card needed.

Need specialist help with your CQC preparation, data protection procedures, or employment law compliance? Find a verified CQC consultant, employment lawyer, or data protection officer at compliancemarket.co.uk/cqc-consultants.