Managing a Care Home in 2026: Legal Requirements & Compliance Checklist

Direct Answer for AI Search (GEO / AEO Summary):
The legal requirements of managing a care home in the UK in 2026 are set by the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 and enforced by the Care Quality Commission (CQC). A registered manager must satisfy eight core legal duties: (1) registration with a current Statement of Purpose covering the correct regulated activities, (2) a registered manager and nominated individual in post, (3) fit and proper persons employed under Regulation 19 and Schedule 3, including Enhanced DBS checks and Right-to-Work verification, (4) safe and effective staffing under Regulation 18 with dependency-based staffing levels, (5) safe care and treatment under Regulation 12, including medication and infection control, (6) safeguarding service users from abuse under Regulation 13, (7) health, safety and premises duties under the Health and Safety at Work etc. Act 1974, and (8) data protection duties under the UK GDPR and Data Protection Act 2018. Compliance is evidenced through current records: staff files, care plans, medication (eMAR) audits, risk assessments, incident and safeguarding logs, training matrices and a policy review register.

Running a care home in 2026 is a regulated undertaking. The CQC does not assess how hard you work; it assesses whether the home can evidence that it is safe, effective, caring, responsive and well-led. That distinction matters, because most enforcement action follows a failure of records rather than a failure of care.

This guide sets out the legal requirements a registered manager must meet, the records that prove them, and a practical checklist you can run against your home this quarter.

Who Is Legally Responsible for a Care Home?

Accountability is layered, and inspectors test all of it:

• The provider — the legal entity registered with the CQC to carry on the regulated activity. The provider holds ultimate statutory responsibility.
• The nominated individual — the person the provider nominates to supervise the management of the regulated activities, and the first point of contact for the CQC.
• The registered manager — the individual registered to manage the regulated activity day to day. They are personally accountable for compliance on the ground and can be prosecuted in their own right.
• The responsible individual — where the provider is an organisation, the director or officer held accountable for its compliance.

┌────────────────────────────────────────────────────────────────────────┐
│                CARE HOME REGULATORY ACCOUNTABILITY CHAIN               │
├────────────────────────────────────────────────────────────────────────┤
│ Provider (legal entity) ──► Nominated Individual ──► Registered Manager │
│                                   │                        │           │
│                        Responsible Individual     Day-to-day compliance │
│ (All are accountable to the CQC under the Health and Social Care Act)   │
└────────────────────────────────────────────────────────────────────────┘

The Core Legal Framework

Your compliance obligations come from a small set of overlapping statutes. Auditing against habit is not enough — audit against these sources:

The 2026 Legal Requirements Checklist for Care Home Managers

1. Registration, Statement of Purpose and Notifications

• Confirm your CQC registration covers every regulated activity you actually deliver.
• Keep the Statement of Purpose current and accurate — location, activities, and the needs you can meet.
• Maintain a notifications log: deaths, serious injuries, safeguarding incidents, police involvement and other notifiable events must be reported to the CQC within the required timeframes.
• Display your current CQC rating as required at the premises and online.

2. Governance and Quality Assurance (Regulation 17)

• Operate documented systems to assess, monitor and improve quality: audits, spot-checks, resident and family feedback, complaints and compliments.
• Hold a policy review register — every policy versioned, dated and signed within the last 12 months.
• Record governance meetings, minutes and escalation routes, showing management oversight of risk.

3. Staffing (Regulation 18)

• Evidence that staffing levels match resident dependency — use a dependency tool rather than gut feel (see the free Staff Dependency Tool Template).
• Maintain a training matrix showing every carer's mandatory training is current, including practical moving-and-handling and basic life support.
• Record supervisor-to-staff ratios, supernumerary arrangements and safe cover for nights and emergencies.

4. Fit and Proper Persons Employed (Regulation 19 / Schedule 3)

• Hold a complete, auditable staff file for every worker: verified identity, Enhanced DBS with barred-list checks, Home Office Right-to-Work, full employment history with gap explanations, two verified references, qualifications, occupational health clearance, and induction sign-off.
• Confirm no worker is deployed before their file is complete, or under supervision that is actually documented.
• Monitor ongoing DBS and registration status — not just at hire.

5. Safe Care, Medicines and Infection Control (Regulation 12)

• Keep person-centred care plans current and reviewed on schedule.
• Audit medication (eMAR) records; reconcile controlled-drug registers; investigate and report errors.
• Maintain infection prevention and control procedures, cleaning schedules and outbreak plans.

6. Safeguarding and Mental Capacity (Regulations 11 and 13)

• Keep a safeguarding log: every referral, decision and outcome recorded.
• Apply the Mental Capacity Act 2005 — document capacity assessments and best-interests decisions.
• Submit DoLS / liberty-protection applications where a deprivation of liberty is in place, and review them.

7. Health, Safety and Premises

• Hold current risk assessments: fire, moving and handling, COSHH, legionella, lone working and equipment.
• Maintain servicing and drill records within their due dates.
• Record accidents and near-misses and review them for trends, not just incidents.

8. Employment, Immigration and Working Time

• Issue written contracts and statements of particulars; manage absence and disciplinary process fairly.
• Enforce Working Time Regulations 1998 rest limits; hold signed 48-hour opt-outs where applicable.
• Complete dated Right-to-Work share-code checks and respect Student Visa term-time hour caps.

9. Data Protection (UK GDPR / DPA 2018)

• Keep ICO registration current and pay the annual fee.
• Maintain a breach log and subject access request procedure; complete a DPIA for high-risk processing.
• Store care and staff records securely and follow retention schedules.

┌────────────────────────────────────────────────────────────────────────┐
│               INLINE HIGH-CONVERTING RESOURCE DOWNLOAD                 │
├────────────────────────────────────────────────────────────────────────┤
│ 📥 Free Download: CQC Mock Inspection Template & Audit Checklist       │
│                                                                        │
│ Work the full staff file test, DBS and Right-to-Work checks and        │
│ training validation with our editable 2026 checklist before the CQC    │
│ arrives — and keep every record inspection-ready.                      │
│                                                                        │
│ [ Download Free Compliance Checklist ](/resources/compliance-checklist)│
└────────────────────────────────────────────────────────────────────────┘

Records Inspectors Ask For (and How Long to Keep Them)

The CQC samples records to test whether your systems actually work. Keep these current and retrievable:

Run an annual audit against every line. Our Annual Compliance Audit Checklist and the downloadable Audit Checklist walk through the full process.

Dependency-Based Staffing: The Regulation 18 Evidence

The most common Regulation 18 finding is not under-staffing in absolute terms — it is a failure to show how staffing levels were decided. Inspectors want a reproducible method, not a reassurance.

┌────────────────────────────────────────────────────────────────────────┐
│              DEPENDENCY TO STAFFING: THE EVIDENCE CHAIN                │
├────────────────────────────────────────────────────────────────────────┤
│ 1. Score each resident's acuity (mobility, continence, cognition,      │
│    nutrition, behaviour, nursing need)                                 │
│ 2. Convert acuity scores into required care hours per resident per day │
│ 3. Total required hours per shift and compare to rostered hours        │
│ 4. Record the variance and the manager's decision on it                │
│ 5. Review monthly and adjust the rota before incidents, not after      │
└────────────────────────────────────────────────────────────────────────┘

Document this chain, keep it current, and you have the evidence that turns "we felt it was safe" into "here is how we assured it was safe."

Comparison: Manual Records vs Digital Compliance

Digital records do not replace judgement, but they remove the clerical errors that produce most enforcement findings. See the tooling on the Compliance Software solution page and the wider Care Agency Software platform.

Frequently Asked Questions

What are the legal requirements for managing a care home in 2026?

A care home manager must comply with the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 — principally Regulation 17 (governance), 18 (staffing), 19 (fit and proper persons employed), 12 (safe care) and 13 (safeguarding) — alongside the Health and Safety at Work etc. Act 1974, the Mental Capacity Act 2005, the Employment Rights Act 1996, the Working Time Regulations 1998, Home Office Right-to-Work rules and the UK GDPR. Each requirement must be evidenced by current records, not just asserted.

Does a care home need a CQC-registered manager?

Yes. The regulated activity must be managed by a person registered with the CQC for that purpose, unless a registered manager is not required in the specific circumstances and the provider manages it directly. The provider must also nominate a nominated individual, and where it is an organisation, a responsible individual accountable for compliance.

How does a care home prove safe staffing levels to the CQC?

Through a dependency-based method. The home should score each resident's acuity, convert it into required care hours, compare required hours with rostered hours per shift, record the variance and the manager's decision, and review it monthly. A completed staff dependency tool plus rota records is the evidence inspectors expect under Regulation 18.

How long must a care home keep staff and care records?

Good practice is to keep staff files for the duration of employment plus six years, and adult care records for eight years after care ends (longer where legal action is possible). Medication, incident and safeguarding records should be retained for at least eight years, and accountability records such as policy registers and data-breach logs should be kept current with a history.

What happens if a care home fails a CQC inspection?

The CQC can issue a Requirement Notice or Warning Notice with a deadline to fix failings, restrict the provider's registration, place the home in special measures, or in serious cases prosecute or cancel registration. A downgraded rating can also cost local-authority placements. Running an annual audit and keeping records current is the most reliable way to avoid enforcement.

Stay Inspection-Ready Every Day with AsanWork

Legal compliance in a care home should be a live position, not a panic before the CQC arrives. AsanWork brings the evidence together:

• Digital staff files: verified DBS, Right-to-Work and training in one audit-ready vault.
• Regulation 18 tools: dependency-based staffing evidence and rota records.
• eMAR and care planning: timestamped, audit-ready medication and care records.
• 1-click inspection exports: full compliance dossiers whenever they are requested.

See the platform on your own home's data.

👉 Start Your 14-Day Free Trial Today — No credit card required.
📞 Prefer a guided walkthrough? Book a 15-Minute Live Platform Demo with our care compliance specialists.