Behaviour of concern: NDIS notification timeframes

Who needs to understand NDIS notification timeframes for behaviours of concern?

If you operate a Supported Independent Living (SIL) service or any registered NDIS support, understanding when and how to notify the NDIS Quality and Safeguards Commission about behaviours of concern is not optional — it is a Practice Standards obligation. The strengthened NDIS Practice Standards framework reinforces this, making incident management and timely reporting a frontline compliance requirement for every registered provider, behaviour support practitioner, and SIL house manager.

This article explains exactly what counts as a reportable behaviour of concern, which notification timeframes apply, what your report must include, and what happens if you miss the deadline.

What is a "behaviour of concern" in the NDIS context?

A behaviour of concern (sometimes called a "challenging behaviour") is any behaviour by a person with disability that causes harm or risk of harm to themselves or others, or that significantly disrupts the ability to participate in everyday activities. Under the NDIS framework, the term matters because it frequently triggers two separate obligations: the behaviour support pathway and the incident reporting pathway.

Not every behaviour of concern becomes a reportable incident. However, it becomes reportable when it:

• Results in a regulated restrictive practice being used (even if that practice is authorised).
• Causes injury requiring medical attention, or creates a risk of serious injury.
• Involves the use of an unauthorised restrictive practice.
• Results in, or there are reasonable grounds to suspect, abuse or neglect.
• Involves a death or unexplained absence of a participant.

The NDIS Commission's incident management rules apply to registered providers only, but the behaviour support rules also place obligations on behaviour support practitioners, including obligations that feed directly into incident timelines.

The two-tier notification system: preliminary and full reports

The NDIS (Incident Management and Reportable Incidents) Rules set out a two-tier reporting structure. Understanding which tier applies — and when the clock starts — is the most common source of compliance errors in SIL settings.

Tier 1: Preliminary notification (within 24 hours)

A preliminary notification is required within 24 hours of a registered provider becoming aware of a reportable incident that falls into a prescribed serious category. These categories include:

• Death of a participant.
• Serious injury of a participant.
• Abuse or neglect of a participant.
• Unlawful sexual or physical contact, or a sexual offence against a participant.
• Use of a restrictive practice that is not in accordance with an authorised behaviour support plan, or any unauthorised restrictive practice.
• Unexplained absence of a participant from a residential setting.

The preliminary report does not need to be comprehensive. Its purpose is to alert the NDIS Commission quickly so it can assess risk, direct the provider if needed, and decide whether to exercise its compliance or investigative powers. The report is submitted through the myNDIS provider portal.

Tier 2: Full (five-day) notification

A complete incident report must be submitted within 5 business days of the provider becoming aware of any reportable incident. This applies to both the serious incidents that already triggered a preliminary notification, and to less serious reportable incidents that did not require a 24-hour report.

The five-day report must include:

1. A description of what occurred, including date, time, and location.
2. The names and roles of all staff involved or present.
3. Details of any immediate action taken to support the participant and ensure safety.
4. Whether a restrictive practice was used, and whether it was authorised under the participant's behaviour support plan.
5. Whether the incident has been, or will be, reported to police, a coroner, or another government authority.
6. What follow-up actions have been or will be taken.

When does the clock start?

One of the most contested questions in practice is exactly when the notification period begins. The rules specify that time runs from when the provider becomes aware of the incident — not when it is formally confirmed, escalated through management, or documented in your internal system. This means:

• If a support worker witnesses a behaviour of concern incident at 9 pm and documents it in the shift handover, the provider is generally considered aware from that point.
• If a manager is not told until the next morning, that does not reset the clock unless your governance structure genuinely ensures awareness only occurs at management level.
• Internal investigation delays do not pause the notification obligation.

SIL providers should train all staff that awareness triggers the clock, not sign-off by a supervisor. Your incident management policy should reflect this clearly and be reflected in staff induction materials.

Behaviours of concern and restrictive practices: the intersection

In SIL settings, behaviours of concern frequently involve the use of regulated restrictive practices — physical restraint, environmental restraint, mechanical restraint, chemical restraint, or seclusion. The NDIS Practice Standards require that any use of a restrictive practice, even where authorised, be recorded and reported as an incident.

The strengthened Practice Standards, which build on the framework introduced from 2021 and continuing into the 2026 registration renewal cycle, place heightened expectations on SIL providers to:

• Have a current, NDIS-Commission-approved behaviour support plan in place before any regulated restrictive practice is used.
• Report every use of a regulated restrictive practice as a reportable incident, with no exceptions for "minor" or "brief" uses.
• Ensure the behaviour support practitioner is notified promptly so they can review the plan if needed.
• Track trends across all incidents to identify whether a participant's support environment or plan requires review.

Failure to report an authorised restrictive practice is itself a breach — separate from any question of whether the practice was appropriate.

Step-by-step: what your process should look like

1. Incident occurs or is discovered — staff document immediately in your incident management system, noting date, time, and nature of behaviour of concern.
2. Triage within the hour — a senior staff member (or on-call manager) reviews whether the incident meets the threshold for a 24-hour preliminary notification.
3. Submit preliminary notification if required — via the myNDIS provider portal within 24 hours of awareness.
4. Internal investigation commences — gather witness accounts, review CCTV if applicable, check behaviour support plan currency.
5. Complete full incident report — submit through the portal within 5 business days of first becoming aware.
6. Notify behaviour support practitioner — if a restrictive practice was used or the behaviour indicates a plan review is warranted.
7. Review and trend-analyse — log the incident in your register, check for patterns, and update the participant's risk documentation as needed.

Consequences of late or missed notification

The NDIS Commission has broad powers to respond to non-compliance with incident reporting obligations. These include issuing a compliance notice, imposing additional conditions on your registration, initiating a compliance investigation, or in serious cases recommending referral for banning order proceedings. In the 2026 mandatory registration environment, providers with poor incident reporting histories face additional scrutiny at audit.

Beyond regulatory consequence, late reporting also undermines your legal protections. A prompt, accurate report to the Commission signals good faith and a functioning governance system. A pattern of late or incomplete reports signals the opposite.

Practical resources and audit readiness

Auditors reviewing your incident management system under the NDIS Practice Standards will expect to see a written incident management policy, a log of all reportable incidents with submission dates, evidence of staff training on reporting obligations, and examples of completed incident reports. If your documentation is scattered across different systems or your staff are unclear on what triggers the 24-hour versus five-day timeline, that is a non-conformance waiting to happen.

Providers preparing for their 2026 registration audit may find it useful to review the ndiscompliant.com.au 74-document SIL compliance kit, which includes incident management policy templates, staff training registers, and restrictive practice documentation tools built around current Commission requirements.

Summary: key timeframes at a glance