Abuse or neglect allegation: NDIS notification timeframes

Why notification timeframes matter for SIL providers

For Supported Independent Living (SIL) providers and any registered NDIS provider delivering supports to people with disability, allegations of abuse or neglect sit at the most serious end of the incident management spectrum. The NDIS Commission's incident management requirements exist to protect participants and to ensure accountability when something goes wrong in a support environment.

Meeting the prescribed notification timeframes is not optional. Late or incomplete notifications are among the most common compliance failures identified during NDIS quality audits, and the consequences — from formal compliance notices through to deregistration — are significant. Understanding exactly what is required, and by when, is an operational necessity for every SIL provider heading into the strengthened 2026 registration framework.

What counts as a reportable allegation of abuse or neglect

Under the NDIS (Incident Management and Reportable Incidents) Rules, certain incidents are classified as reportable incidents and must be notified to the NDIS Commission. Allegations of abuse or neglect of a person with disability fall within this category, regardless of whether the alleged conduct has been proved or is still under investigation.

The key categories relevant to SIL providers include:

• Abuse — including physical, sexual, psychological, emotional, or financial abuse of a participant
• Neglect — including failure to provide adequate care, food, shelter, medical attention, or supervision where the provider has a duty of care
• Unlawful sexual or physical contact with, or assault of, a participant
• Sexual misconduct committed against, or in the presence of, a participant
• Use of a restrictive practice that was not authorised in accordance with the relevant state or territory law

Importantly, an allegation is sufficient to trigger the notification obligation. You do not need to wait for an investigation outcome, a police report, or internal findings before notifying the Commission.

The two-stage notification requirement

The NDIS Commission operates a two-stage notification process for reportable incidents. Both stages carry their own timeframes and both are mandatory for registered providers.

Stage 1: Initial notification — 24 hours

Providers must notify the NDIS Commission within 24 hours of becoming aware that a reportable incident has occurred or is alleged to have occurred. For abuse or neglect allegations, the clock starts at the moment a responsible person in your organisation becomes aware of the allegation — not when it is fully understood, not when internal processes are complete.

The initial notification is submitted through the myNDIS provider portal. It does not need to contain the full account of what happened, but it must include:

• The name and NDIS number of the participant (if known)
• A brief description of the nature of the alleged incident
• When and where the incident is alleged to have occurred
• The current status of the participant (for example, whether they are safe and receiving appropriate care)
• Any immediate actions your organisation has taken in response

Stage 2: Full written report — five business days

Following the initial notification, providers must submit a comprehensive written report to the NDIS Commission within five business days of first becoming aware of the incident. This report must be more detailed and include:

1. A full description of the incident or alleged incident, including a timeline of events as best as can be established
2. Details of all persons involved, including support workers, participants, and any witnesses
3. Actions taken immediately after the incident came to light (for example, participant safety measures, removal of a staff member from duties, engagement of police or emergency services)
4. Whether the incident has been reported to any external authority (police, child protection, the relevant state or territory oversight body)
5. The current investigation or review status and who is leading it
6. Any interim risk management measures put in place to protect the participant and other participants
7. Preliminary assessment of what contributed to the incident or enabled the alleged conduct

If the investigation is still ongoing at the time of the five-day report, you must indicate that and provide updates as findings emerge. The Commission expects providers to keep reportable incidents open in the portal until all actions have been completed and the matter is closed.

Step-by-step: what to do when an allegation is raised

1. Ensure participant safety immediately. Before anything else, take all reasonable steps to protect the participant from further harm. This may include removing the alleged perpetrator from the support environment pending investigation.
2. Record the time and date you became aware. The 24-hour clock starts now. Document who told you, when, and what they said verbatim if possible.
3. Notify your designated internal incident manager. Your incident management policy should designate a responsible person. Escalate immediately according to that chain.
4. Log into the myNDIS provider portal and submit the initial notification. This must be done within 24 hours. Do not delay pending internal investigation.
5. Report to police or emergency services if required. If the alleged abuse or neglect may constitute a criminal offence, your organisation has obligations under state and territory law as well. NDIS notification does not replace mandatory reporting obligations under other legislation.
6. Notify the participant's family or nominee, where appropriate and consistent with the participant's wishes and safety.
7. Commence your internal investigation. Assign an investigator, preserve evidence, and document all steps taken.
8. Submit the full written report within five business days. Even if the investigation is incomplete, this report must be filed. Update the Commission as new information emerges.
9. Review and update your risk management measures. Consider whether other participants in the same setting may be at risk and document that assessment.
10. Close the incident in the portal only when all actions are complete. Premature closure is a common audit finding.

Strengthened 2026 framework: what has changed

The strengthened NDIS Practice Standards and registration framework, progressively coming into effect through 2025 and 2026, place additional obligations on SIL providers. Under the strengthened standards, incident management systems must demonstrate not only that incidents are reported on time but that providers have robust preventive systems — governance, workforce screening, safe environment design, and a culture that encourages workers and participants to raise concerns without fear of retribution.

NDIS quality auditors assessing SIL providers against the strengthened standards will look for evidence that:

• All workers understand their obligation to report internally as soon as an allegation comes to their attention
• The organisation has a documented, trained, and tested incident management procedure
• Timeframes are met consistently, not just in the most serious cases
• Post-incident reviews result in demonstrable system improvements
• The organisation's governance body (board or management) receives regular incident data and acts on it

Consequences of missing the notification timeframes

The NDIS Commission has broad enforcement powers where providers fail to meet their incident reporting obligations. Outcomes for non-compliance include:

• Formal compliance notices requiring the provider to demonstrate corrective action
• Banning orders against individuals found responsible for systemic reporting failures
• Conditions placed on a provider's registration
• Suspension or revocation of registration
• Civil penalty proceedings under the NDIS Act

Beyond regulatory action, providers who fail to notify promptly may also face findings of systemic neglect themselves, particularly where delayed notification contributed to further harm to the participant.

Template: key fields in your initial notification

Getting your documentation audit-ready

NDIS Commission auditors assess not just whether notifications were submitted but whether providers have the policies, training records, and internal logs to demonstrate a functioning incident management system. For SIL providers, this means maintaining a dedicated incident register, evidencing staff training on reporting obligations, and retaining all portal submissions and correspondence.

Providers preparing for their 2026 re-registration audit may find the 74-document audit-ready SIL compliance kit available at ndiscompliant.com.au a practical starting point — it includes incident management policy templates, notification checklists, and training record formats aligned to the strengthened Practice Standards.

Whatever tools you use, the non-negotiable requirement is the same: when an allegation of abuse or neglect is raised, notify the Commission within 24 hours, follow up in writing within five business days, and keep the incident open until every remediation action is closed.