NDIS Key Personnel Requirements: Who They Are and What You Must Report

What is a "key personnel" under NDIS registration?

The concept of "key personnel" is defined in section 11A of the National Disability Insurance Scheme Act 2013 (Cth). It is a legal definition with significant practical consequences: key personnel must pass a suitability assessment before registration is granted, changes to key personnel must be notified to the NDIS Commission, and key personnel who do not meet the suitability requirements can cause a provider's registration to be refused or cancelled.

The Act defines key personnel to include:

• Any person who is a principal officer of the registered provider (typically the CEO, Managing Director, or equivalent)
• Any person who holds a position of authority in the registered provider (directors, board members, company secretaries)
• Any other person who has or exercises significant managerial influence over the whole or a substantial part of the registered provider's operations

The phrase "significant managerial influence" is the one that causes most confusion for small providers. It is not limited to formal title-holders — it captures anyone who effectively controls or significantly influences how the provider operates, regardless of whether they have a formal role or employment relationship with the organisation.

Who qualifies as key personnel?

For most small NDIS providers, identifying key personnel is straightforward: it is the people at the top of the organisational chart who make strategic and operational decisions. The following individuals will almost always qualify:

The test for "significant managerial influence" is applied on the facts. If a person who holds no formal title is the de facto decision-maker — for example, a founding member who handed over the director role but continues to direct the business — they may still qualify as key personnel under the substantive test.

Registered provider vs key personnel: the distinction

The registered provider is the legal entity that holds the NDIS registration — the company, incorporated association, or, in the case of an individual provider, the sole trader. The registration is held by this entity.

Key personnel are the natural persons (individuals) who have roles within that legal entity meeting the criteria above. A company cannot be key personnel — only individuals can hold that status.

This distinction matters because the suitability assessment under the NDIS Act is conducted on the key personnel (individuals), not the registered provider (the entity). The registered provider is assessed for compliance with the Practice Standards during the audit process. Key personnel are assessed for their personal suitability — primarily through a criminal history check and consideration of their history of involvement in NDIS or other regulated services.

Suitability assessment requirements

When a new NDIS provider applies for registration, the NDIS Commission undertakes a suitability assessment of each identified key person. This is also triggered when a new person is appointed as key personnel of an existing registered provider (subject to the mandatory notification requirement).

What the suitability assessment considers

The NDIS Commission's suitability assessment examines:

• Criminal history — particularly convictions involving violence, fraud, sexual offences, or offences against vulnerable persons
• Whether the person has previously been a key person of a registered provider that had its registration cancelled, suspended, or subject to conditions by the Commission
• Whether the person has been banned or prohibited from working with children or vulnerable people in any Australian jurisdiction
• Whether the person has been insolvent under administration (bankruptcy or insolvency)
• Whether the person has been subject to disciplinary action under any professional registration scheme
• Any other information the Commission considers relevant to the person's suitability

How suitability information is provided

As part of the registration application (for new providers) or the notification process (for new key personnel of existing providers), each key person must provide:

• Personal identification information (full legal name, date of birth, residential address)
• Declaration of their role and the nature of their managerial influence
• Disclosure of any criminal history, bankruptcy, or disqualification from positions of authority
• Consent for the Commission to conduct background checks

Providers should complete a Key Personnel Suitability Assessment form internally before lodging a notification or application with the Commission. This internal document records the information gathered and the provider's own assessment, separate from the Commission's formal process.

What makes a person not suitable to be key personnel?

Section 73V of the NDIS Act sets out the grounds on which the Commission may determine that a person is not suitable to be key personnel of a registered provider. These include situations where the person:

• Has been convicted of an offence that is relevant to working with people with disability (particularly offences involving abuse, neglect, exploitation, violence, or fraud)
• Has been involved in the management of an NDIS provider that had its registration cancelled or that received a compliance notice or banning order from the Commission
• Is currently bankrupt or insolvent
• Is subject to a prohibition order, banning order, or similar disqualification in any Australian or overseas jurisdiction
• Has been found by the Commission (or a relevant authority) to have engaged in conduct that posed an unacceptable risk to the safety and wellbeing of people with disability

The Commission exercises a degree of discretion in applying these criteria. A conviction for a minor historical offence may not result in a finding of unsuitability, particularly if it is unrelated to supporting people with disability and significant time has passed. Conversely, more recent or serious findings will weigh heavily against a person's suitability.

Mandatory reporting obligations to the Commission

Registered NDIS providers have ongoing obligations to notify the NDIS Commission of changes to their key personnel. These notification obligations are set out in the NDIS (Provider Registration and Practice Standards) Rules 2018 and the NDIS Commission's operational guidance.

You must notify the Commission when:

• A new person is appointed as key personnel (e.g., a new CEO is hired, a new director is appointed)
• An existing key person leaves the organisation (e.g., a director resigns, the CEO is terminated)
• A key person's role changes such that they no longer qualify as key personnel (e.g., they move from CEO to a non-managerial role)
• A key person's circumstances change in a way that may affect their suitability (e.g., they are charged with a relevant offence)

All notifications are made through the My NDIS Provider Portal. For the appointment of new key personnel, you will need to provide the new person's details and declare that a suitability assessment has been conducted.

Notification timeframes: the 14-day rule

The NDIS Commission's requirements specify that providers must notify changes to key personnel within 14 days of the change occurring. This is a strict timeframe — not 14 business days, but 14 calendar days from the date of the change.

For practical purposes, a "change" occurs on:

• The date a new key person's appointment becomes effective (even if the formal paperwork is completed later)
• The date a key person's resignation or termination takes effect
• The date a key person becomes aware of changed circumstances affecting their suitability

Providers who miss the 14-day notification window do not automatically lose their registration, but failure to notify is a compliance breach that the Commission may take into account in future regulatory actions. It is also evidence of weak governance — which auditors note.

The Commission's key personnel register

The NDIS Commission maintains an internal register of key personnel associated with each registered provider. This register is used by the Commission for regulatory oversight purposes — including cross-referencing key personnel across multiple providers to identify potential risks.

As a registered provider, you must ensure that the Commission's records accurately reflect your current key personnel at all times. Discrepancies between your internal records and the Commission's register — for example, a director who resigned two years ago still appearing as key personnel in Commission records because you never filed a notification — are compliance issues that can complicate audit processes and registration renewals.

Conduct an annual reconciliation between your internal governance records (board resolutions, ASIC filings for company directors) and your records of key personnel notifications to the Commission. Any gaps should be addressed promptly.

Sole trader special rules

When an individual registers as an NDIS provider as a sole trader, they are simultaneously the registered provider and the key person. The sole trader is always their own key personnel — there is no separate entity from the individual.

The practical implications for sole trader providers are:

• The suitability assessment for key personnel is conducted on the sole trader themselves as part of the registration application
• There is no separate notification obligation for changes in key personnel, because the sole trader is the provider — but if the business structure changes (e.g., the sole trader incorporates a company), a new registration application will be required
• The sole trader's death, serious illness, or incapacity effectively ends the registration — there is no automatic transfer to another person

Sole traders considering incorporating their business should seek legal advice before doing so, as incorporating creates a new legal entity that requires a new NDIS registration application.

What happens if key personnel fails suitability requirements?

If the NDIS Commission determines that a person is not suitable to be key personnel of a registered provider, the consequences depend on the circumstances:

• For a new registration application: The Commission may refuse the application, or grant registration subject to conditions (e.g., that the unsuitable key person is removed before registration takes effect)
• For an existing registered provider: The Commission may impose conditions on the registration requiring the provider to remove the unsuitable person from their key personnel role. If the provider fails to comply, the Commission can suspend or cancel the registration.
• For the individual: The Commission may issue a banning order under section 73Z of the NDIS Act, which prevents the person from working in any role as an NDIS key person, or potentially from working in any role with an NDIS provider, for a specified period or indefinitely.

The process includes an opportunity for the key person to make submissions and, in some cases, the right to seek review of the Commission's decision. However, the registration implications can be severe, which is why thorough due diligence on key personnel suitability before appointment — and maintaining ongoing awareness of each key person's circumstances — is essential governance practice.

For SIL providers preparing for the 1 July 2026 registration deadline, governance is assessed under Practice Standard Outcome 2.1. Your SIL Rescue Kit includes a complete Governance Framework Policy and Key Personnel Suitability Assessment form, along with an Organisational Chart template that clearly maps your governance structure for auditors.

Key personnel management is an area where a small administrative gap — a missed notification, an out-of-date register entry — can have disproportionately serious regulatory consequences. Build your key personnel notification obligations into your governance calendar, conduct an annual suitability review for all key personnel, and make sure your Commission records match your internal governance records at all times.