What is a Reportable Incident Under the NDIS?

Understanding Reportable Incidents Under the NDIS

If you are a registered NDIS provider — particularly one delivering Supported Independent Living (SIL) or other high-intensity supports — understanding what constitutes a reportable incident is one of your most fundamental compliance obligations. Getting this wrong carries serious consequences: regulatory action, registration conditions, or, most importantly, preventable harm to participants.

This article explains the legal definition of a reportable incident, what you must report and when, how the NDIS Commission handles notifications, and what the strengthened 2026 Practice Standards framework means for your incident management obligations.

The Legal Definition of a Reportable Incident

The term "reportable incident" is defined in the National Disability Insurance Scheme Act 2013 (Cth) and elaborated through the NDIS (Provider Registration and Practice Standards) Rules. A reportable incident is any of the following events that occurs in connection with the delivery of NDIS supports or services:

• The death of an NDIS participant
• Serious injury of an NDIS participant
• Abuse or neglect of an NDIS participant
• Unlawful sexual or physical contact with, or assault of, an NDIS participant
• Sexual misconduct committed against, or in the presence of, an NDIS participant (including grooming)
• The use of a restrictive practice in relation to an NDIS participant where the practice is not authorised under relevant state or territory law, or where it has not been approved in accordance with the NDIS rules

The definition is deliberately broad. An incident does not need to result in a formal complaint, police report, or court proceeding to be reportable. The obligation arises when the event itself occurs — regardless of intent, outcome, or whether anyone raises a formal concern.

Who Must Report?

The obligation to notify the NDIS Quality and Safeguards Commission falls on registered NDIS providers. If you are a registered provider and a reportable incident occurs in connection with any of your NDIS supports — including supports delivered by your employees, contractors, or subcontractors — you are responsible for reporting.

Unregistered providers do not have a statutory reporting obligation to the Commission under the same framework, but they remain subject to other safeguarding laws, including state and territory laws around mandatory reporting of child abuse and the duty of care under common law.

For SIL providers in particular, the stakes are especially high. SIL environments involve participants with complex support needs living in shared or individual accommodation, often with 24-hour staffing. The proximity and intensity of the support relationship increases both the likelihood of incidents occurring and the importance of responding appropriately.

Notification Timeframes

The NDIS Commission distinguishes between two categories of notification, each with its own timeframe:

Initial Notification

An initial notification must be made to the NDIS Commission as soon as practicable — and in any case within 24 hours of the registered provider becoming aware of the following incident types:

• Death of a participant
• Serious injury of a participant
• Abuse or neglect
• Unlawful sexual or physical contact or assault
• Sexual misconduct
• Unauthorised use of a restrictive practice

For other reportable incidents — those that do not fall into the above categories — initial notification must be made within five business days.

Completed Notification

After the initial notification, you must submit a completed notification within five business days of the initial report. This completed notification provides fuller detail about the incident, the immediate response, and the steps taken to prevent recurrence.

Both notifications are made through the NDIS Commission Portal using the online incident notification form.

What Your Incident Report Must Include

A well-prepared reportable incident notification is not simply a tick-box exercise. The NDIS Commission expects providers to demonstrate that they have taken the incident seriously and acted. Your completed notification should include:

1. Details of the incident: Date, time, location, and a clear factual description of what occurred
2. Participants involved: Identifying information for the participant(s) affected (without unnecessary disclosure to third parties)
3. Workers involved: Role and relationship of any worker(s) connected to the incident
4. Immediate actions taken: First aid, emergency services called, participant and family notified, worker stood down if appropriate
5. Investigation status: Whether an internal investigation has commenced or is planned
6. Corrective actions: Steps being taken or planned to prevent recurrence
7. Restrictive practice information (if applicable): The type of practice used, whether it was authorised, and the circumstances in which it was applied

The 2026 Strengthened Practice Standards and Incident Management

The NDIS Practice Standards were strengthened as part of the broader NDIS reform agenda, with the strengthened standards applying to providers seeking or renewing registration. The strengthened framework places greater emphasis on proactive risk management, participant outcomes, and organisational culture — not just reactive incident reporting.

Under the strengthened standards, registered providers are expected to maintain a robust incident management system that:

• Identifies, records, and analyses all incidents — including near misses — not just those meeting the statutory reportable threshold
• Ensures workers understand their obligations and are trained to identify and escalate incidents promptly
• Supports a just and open culture where workers feel safe to report without fear of blame
• Uses incident data to drive continuous improvement in service delivery
• Demonstrates clear governance and accountability at the leadership level

Quality auditors assessing your organisation against the Practice Standards will look for evidence that your incident management system is genuinely embedded in operations — not simply documented in a policy binder that workers have never read.

Obligations Beyond Notification: Investigation and Worker Screening

Reporting to the NDIS Commission is only the first step. Providers also have obligations to:

• Investigate the incident thoroughly and impartially, reaching findings on what occurred and why
• Take action in response to findings, including changes to policies, procedures, staffing arrangements, or physical environments
• Notify participants and their families in a timely and sensitive manner, consistent with the NDIS Commission's Participant Charter and open disclosure principles
• Consider worker screening and employment action where a worker's conduct may have contributed to or caused the incident — NDIS Worker Screening Checks exist to prevent unsuitable people from working with participants, and providers must act where concerns arise
• Refer to police or other authorities where the incident may constitute a criminal offence

Common Compliance Failures in Incident Reporting

Based on the nature of NDIS Commission regulatory action, the most frequently observed gaps in provider incident management include:

• Failing to recognise that an event met the definition of a reportable incident (particularly for psychological harm, neglect, or low-level physical contact)
• Missing the 24-hour notification deadline because the incident was not escalated promptly from frontline staff to management
• Submitting incomplete or vague notifications that do not demonstrate genuine investigation
• Not notifying participants and families — or notifying them after notifying the Commission rather than simultaneously
• Treating the notification as the end of the process rather than the beginning of an investigation and improvement cycle
• Failing to record internal incidents (near misses, lower-level events) that, while not individually reportable, collectively signal systemic risk

Practical Steps: Building a Compliant Incident Management System

1. Map your definition: Ensure your internal policy states the statutory definition clearly and gives worked examples relevant to your service type
2. Train every worker: All frontline staff — including casuals and contractors — must know what to report and to whom within your organisation
3. Set internal escalation times: Build in a buffer; if staff must notify a manager within two hours, the manager has time to assess and notify the Commission within 24 hours
4. Use the Commission Portal: Familiarise your compliance lead with the portal before an incident occurs — the interface is straightforward but not the moment to learn it under pressure
5. Document everything contemporaneously: Notes made close to the time of the incident carry more evidential weight during an investigation
6. Review and close the loop: After every investigation, document findings and corrective actions, and verify that actions were implemented

If you are preparing for a quality audit or building your incident management system from scratch, the 74-document audit-ready SIL compliance kit available at ndiscompliant.com.au includes a ready-to-use incident management policy, notification checklists, investigation templates, and worker training registers — designed specifically for the strengthened 2026 Practice Standards.

Summary

A reportable incident under the NDIS is any event connected to the delivery of supports that involves the death, serious injury, abuse, neglect, sexual misconduct, unlawful contact, or unauthorised restrictive practice applied to a participant. Registered providers must notify the NDIS Commission within 24 hours (for serious incident types) or five business days (for other types), then submit a completed notification within five business days of that initial report. Beyond notification, providers must investigate, take corrective action, support affected participants, and maintain a culture where incidents are seen as learning opportunities rather than liabilities to manage quietly.