A letter arrives from the NDIS Quality and Safeguards Commission. It asks for incident records, rosters and policies. A support worker receives notice that the Commission is considering a banning order. A provider discovers that a payment review is running alongside an investigation into the safety of its supports.

These are not situations to treat as routine administration. A response may become evidence. Missing a compulsory deadline can create a separate problem. And a decision about registration or a banning order can affect a business's ability to operate, or a worker's ability to earn a living.

An investigation is not a finding of wrongdoing. The immediate task is to protect participants, understand exactly what the regulator is asking and respond on a reliable factual and legal footing.

This guide explains the questions providers, directors, key personnel and workers should ask when the Commission contacts them, and why the particular notice matters more than a general description of the regulator's powers.

01 What can trigger an investigation?

The Commission can receive information from participants, families, advocates, workers, providers, auditors and other agencies. It can also identify concerns through its own monitoring. An investigation does not have to begin with a formal complaint or one particular incident.

  • Incidents and participant safety. Death, serious injury, alleged abuse or neglect, sexual misconduct and unauthorised restrictive practices can lead to regulatory attention. An allegation may need to be reported before its truth has been established.
  • Complaints and worker disclosures. Concerns about the quality, safety or delivery of supports may prompt enquiries. Whistleblower protections have particular statutory conditions; not every workplace grievance automatically attracts every protection.
  • Registration and audit concerns. Audit findings, unsuitable key personnel, failures to meet registration conditions or supports supplied without required registration can lead to action.
  • Reporting and recordkeeping failures. Late notifications, missing records and weaknesses in incident-management systems can be issues in their own right, even where the underlying incident is disputed.
  • Information from the NDIA or another agency. Claiming irregularities, payment reviews or suspected fraud may generate referrals and parallel processes. The regulator's role and the legal basis of each process should be identified separately.

The NDIS Code of Conduct applies to registered and unregistered NDIS providers and their workers. Registration-specific requirements, including the registered-provider reportable-incident framework, do not apply identically to every person in the sector.

02 The Commission's powers: not every letter is the same

The Commission's powers arise principally under the National Disability Insurance Scheme Act 2013 (Cth), including its provider-registration, quality and safeguards provisions, and the Regulatory Powers (Standard Provisions) Act 2014 (Cth), as applied and modified by the NDIS Act.

Those powers include obtaining information and documents, monitoring compliance and investigating suspected contraventions. Powers to enter premises are subject to their legal conditions, including consent or warrant requirements where applicable. The fact that the Commission is investigating does not give it an unrestricted power to enter any premises or demand anything it chooses.

Depending on the statutory basis and the facts, the Commission may:

  • Issue compliance notices and infringement notices.
  • Accept enforceable undertakings.
  • Impose registration conditions, suspend registration or revoke it.
  • Make banning orders within the statutory grounds and scope.
  • Seek civil penalties or injunctions in court.
  • Investigate suspected offences and refer appropriate matters for criminal prosecution.

An infringement notice is not the same thing as a court-imposed penalty. A request for voluntary assistance is not necessarily a compulsory notice. A notice of proposed action is not a final decision. Each calls for a different response.

The Commission publishes specified compliance and enforcement actions on its public search register. Publication can have consequences beyond the immediate proceeding, including for contracts, referrals and recruitment. It does not follow that every enquiry or investigation is made public.

The Commission regulates the quality and safety of NDIS supports. The NDIA administers access, plans, funding and payments, including payment-integrity processes. Their responsibilities can overlap and information may be shared, but a Commission investigation and an NDIA payment review are distinct processes.

Before answering the allegations, identify the document: who must respond, under what power, by when, and with what consequences?

03 Reforms and penalty claims require careful checking

The National Disability Insurance Scheme Amendment (Integrity and Safeguarding) Act 2026 received Royal Assent on 8 April 2026. Its principal Commission enforcement and whistleblower reforms commenced on 9 April 2026. Passage through Parliament, Royal Assent and commencement are different events; in this case, the relevant reforms are law, not just proposals.

Penalty exposure depends on the particular provision, the conduct, whether the recipient is an individual or a company, and the law applicable when the conduct occurred. A headline maximum is not the penalty for every breach, and it is not a prediction of the outcome of a particular investigation.

Specified serious civil contraventions can attract maximum court penalties of 10,000 penalty units for an individual and, applying the corporate multiplier, 50,000 penalty units for a body corporate. The statutory definition of a serious contravention includes a significant failure or a systematic pattern of conduct. These are not universal maxima for every worker or provider breach. Dollar amounts depend on the applicable Commonwealth penalty-unit value and should not be assumed from an older announcement.

The reforms also introduced offences for breaching banning orders and anti-promotion powers. The fault-based banning-order offence carries up to five years' imprisonment, a fine, or both; a separate strict-liability offence and civil-penalty provision also exist. Imprisonment is not an automatic consequence of every breach.

Mandatory-registration amendments for assistance with supported independent living and NDIS digital platform services commenced on 1 July 2026, subject to defined categories and transitional rules. Eligible existing unregistered providers who applied before 1 October 2026 can have a pathway to continue pending the registration decision. Existing registered providers have relevant variation transitions. A general statement that every affected provider had to hold completed registration from 1 July overlooks these arrangements. Check the actual service, application timing and current Rules.

The first legal review should therefore identify the alleged obligation and the applicable legislative version, rather than work backwards from a press release or a maximum-penalty figure.

04 The first response: seven steps that matter

  1. Read the notice and record the deadline. Identify the addressee, statutory power, requested material, response method and due date. If time is insufficient, seek an extension promptly and obtain confirmation. Asking for more time does not itself extend a deadline.
  2. Protect participants immediately. Address urgent safety risks, arrange appropriate support and consider whether emergency services or another authority must be contacted. Do not postpone protective action while preparing the legal response.
  3. Preserve the original evidence. Retain incident reports, progress notes, rosters, emails, messages, CCTV where available, policies, training records and claims data. Suspend routine deletion where relevant. Do not retrospectively rewrite records. Necessary corrections or later notes should be transparent, dated and kept alongside the original.
  4. Separate facts from assumptions. Prepare a chronology, identify who has direct knowledge and distinguish contemporaneous records from later recollections. Avoid presenting an inference as an established fact.
  5. Check privilege and disclosure obligations. Obtain advice about legal professional privilege, confidentiality, self-incrimination and the particular compulsory power before producing material or answering questions. Privacy concerns do not automatically excuse a lawful notice, and privilege should not be assumed simply because a document has been sent to a lawyer.
  6. Give an accurate, scoped response. Answer what is required, identify gaps honestly and explain any qualification. False or misleading material can create separate exposure. Do not guess to make a response look complete.
  7. Coordinate parallel processes. Identify any NDIA payment review, police investigation, employment process, insurer notification or other regulatory matter. Keep responses consistent without assuming one process resolves another.

For a Commission requirement under sections 55A and 56, the ordinary minimum response period is 14 days. A shorter reasonable period is permitted only where the Commissioner reasonably believes that allowing the ordinary period would significantly increase the risk of serious harm to a participant. Other statutory processes have different deadlines. Failure to comply with a valid compulsory requirement can attract penalties, subject to applicable excuses and protections.

An individual may have a reasonable excuse under section 57 where complying with a section 55A requirement might tend to incriminate that individual or expose them to a penalty. Corporations do not have the same privilege against self-incrimination. These protections are not blanket permissions to withhold incident notifications or disregard every compulsory power. Knowingly supplying materially false or misleading information or documents can attract a civil penalty under section 59A; separate criminal offences may also apply.

Nominate a person to coordinate the response and control document versions. Keep a record of what was supplied, when it was supplied and the explanation accompanying it. Preserve evidence of remediation as well as the original incident.

05 Incident reporting does not pause during an investigation

Registered providers must continue complying with the applicable reportable-incident requirements while the Commission investigates. Internal enquiries and uncertainty about an allegation do not automatically stop the notification clock.

Under the registered-provider framework, reportable incidents include specified incidents that occurred, or are alleged to have occurred, in connection with the provision of NDIS supports or services. The categories include death, serious injury, abuse or neglect, unlawful sexual or physical contact or assault, sexual misconduct including grooming, and specified unauthorised restrictive practices.

  • Within 24 hours of provider awareness: death, serious injury, abuse or neglect, unlawful sexual or physical contact or assault, and sexual misconduct generally require notification. Twenty-four hours is not one business day.
  • Within five business days of provider awareness: unauthorised restrictive practices generally require notification. If the incident also falls within a harm category requiring 24-hour notification, the shorter timeframe applies.
  • Follow-up information: the information specified by the Rules following a 24-hour notification must be supplied within five business days of awareness. Specified significant new information must be supplied as soon as reasonably practicable.

Workers of registered providers must notify their provider of a reportable incident as soon as possible. The Commissioner may also require remedial action, an internal or independent investigation, or a final report. A final report is not automatically required in every case; where required under the Rules, the ordinary period is 60 business days after the relevant notification, or a longer specified period.

Not every injury or operational incident is a reportable incident under this framework. That does not remove incident-management, safety or other legal obligations. Where classification is uncertain, resolve it promptly rather than assume that an allegation can wait until the facts are finalised.

Notification to the Commission does not replace contacting police, emergency services, child-protection authorities or another body where the circumstances require it. A provider should also communicate with affected participants appropriately, respecting their rights, support needs and the integrity of the investigation.

06 Responding to proposed action

A show cause notice or notice of intended action is an opportunity to address the allegations and the proposed regulatory response. It should not be answered with a generic denial, a stack of policies or an unsupported assurance that the problem has been fixed.

A useful response usually:

  • Identifies the exact proposed decision and each statutory ground relied on.
  • Addresses the evidence and allegations point by point, correcting factual errors with records.
  • Explains the provider's or worker's actual role, knowledge and actions.
  • Documents immediate safety measures and completed remediation, not just future promises.
  • Addresses ongoing risk, suitability and the effectiveness of supervision, training and governance.
  • Explains why any proposed alternative, such as registration conditions, would address the identified risk where legally available.

Before making a banning order, the Commissioner must ordinarily give the affected person an opportunity to make submissions. Under section 73ZN, that requirement does not apply where the grounds include an immediate danger to the health, safety or wellbeing of a person with disability, or where the Commissioner has revoked that person's registration. An order can therefore be made without a prior show cause opportunity. It must be given to the person with reasons. Registration decisions have their own processes; there is no universal show cause period for every action.

An enforceable undertaking or registration condition is not an alternative the Commission must accept. Remediation can be relevant, but it does not erase past conduct. The response should engage with both the alleged contravention and the present risk.

07 Can a decision be reviewed?

Specified Commission decisions, including relevant registration and banning-order decisions, can be subject to internal review and review by the Administrative Review Tribunal (ART). Not every letter, investigation step or enforcement action is a reviewable decision under the same pathway.

The decision notice should identify available review rights and deadlines. Obtain advice immediately about standing, the appropriate review route and the evidence needed to challenge the decision. Judicial review, where available, addresses legal error rather than simply substituting a preferred merits outcome.

For reviewable decisions under the NDIS Act, a directly affected person generally has three months after receiving notice to request internal review. Following the internal-review decision, an ART application is generally due within 28 days after that decision is given. An extension may be available but should not be assumed. The statutory default internal-review decision period is 90 days, subject to applicable Rules; do not assume that its expiry creates the same deemed-decision pathway for Commission matters as for NDIA matters.

Seeking review does not automatically suspend the decision. If an order or registration decision is already operating, comply with it unless a lawful stay or variation permits otherwise. Any request for interim relief needs separate attention; do not assume filing paperwork authorises continuing supports.

08 Workers, directors and key personnel need their own assessment

An investigation into a provider can also raise questions about individual workers, directors or key personnel. A company structure does not prevent a banning order or other action against an individual where the statutory requirements are met. Conversely, a person's title does not automatically establish liability for everything the provider has done.

A worker's interests may differ from the employer's. There may be disputes about instructions, supervision, staffing levels, records or who knew about an incident. Shared representation is not always appropriate. An individual should consider independent advice before signing a statement prepared for the provider or participating in an interview about their own conduct.

The scope of any banning order matters. Read the prohibited activities, duration, conditions and effective date. Do not assume informal, unpaid, indirect or consulting work is outside the order without checking its terms and the legislation.

For directors and managers, the practical question is whether the business can demonstrate effective oversight: clear reporting lines, reliable incident systems, suitable staffing, documented escalation and action when risks become known.

09 How GopherWood Lawyers can help

We act for NDIS providers, directors, key personnel and individual workers in regulatory matters. We can assist with:

  • Assessing information requests and compulsory notices, deadlines and disclosure obligations.
  • Reviewing incident records, policies, rosters and claims data to identify the issues requiring a response.
  • Preparing evidence-based show cause submissions about proposed banning orders, registration conditions, suspension or revocation.
  • Seeking internal review and, where available, ART review and interim relief.
  • Defending civil penalty proceedings and coordinating responses to parallel Commission, NDIA and police processes.
  • Reviewing incident management, registration obligations and governance arrangements.

If you have received a notice from the NDIS Commission or the NDIA, or are concerned that an incident may lead to regulatory action, call 02 9160 2157 or become a client for a confidential discussion. Learn more about our NDIS regulatory investigations practice.

This article reflects material reviewed on 28 October 2026. It provides general information, not legal advice. Obligations, penalties and review rights depend on the notice, the conduct, the person's role and the legislation in force at the relevant time.

10 Sources and further reading

Become a Client