The request for records was addressed to the provider. Then the questions changed: who received the incident reports, who approved the staffing arrangements and what did management do after the first warning?

For a director or executive, that shift matters. The organisation's registration and finances may still be the main concern, but the individual's conduct can become a separate issue. A response prepared to defend the company may not protect the person who signs it.

A director is not automatically liable because an NDIS provider has breached an obligation. Equally, a company structure does not prevent action against an individual where the law reaches their own conduct. The useful question is not simply whether someone was in charge, but which obligation or power is being relied on and what the evidence establishes about that person.

01 Corporate responsibility is not automatic personal liability

An incorporated provider and its directors are separate legal persons. Section 73J of the National Disability Insurance Scheme Act 2013 (Cth) concerns a registered provider's compliance with registration conditions. A breach by the company does not, without more, establish that every director personally breached that provision.

Personal exposure can nevertheless arise through several different paths:

  • A direct obligation. The NDIS Code of Conduct can apply to covered individuals as well as providers. Their own failure to comply may attract a civil penalty.
  • Involvement in a contravention. Section 92 of the Regulatory Powers (Standard Provisions) Act 2014 (Cth), as applied by the NDIS Act, addresses attempts, aiding, abetting, counselling, procuring, inducing, being knowingly concerned in or party to, and conspiring to effect a civil contravention. Each route has elements to establish, including applicable mental elements; a job title is not enough.
  • A separate regulatory decision. A banning order or a suitability assessment can affect an individual without a criminal conviction or a finding that they personally breached every provider obligation.
  • The person's own prohibited conduct. Misleading a regulator, breaching a banning order or involvement in a payment offence raises separate questions under the relevant provisions.

These routes are not interchangeable. An allegation that a company had inadequate systems should not be treated as proof of every manager's personal liability. But describing a failure as corporate does not answer evidence that an individual knowingly participated in it.

02 The Code reaches beyond frontline workers

Under section 73V and the NDIS Code of Conduct Rules, the Code applies to NDIS providers, their key personnel and persons employed or otherwise engaged by them. Section 11A expressly includes a company director within key personnel. The Code is not limited to registered providers or workers delivering hands-on support.

The Code includes requirements concerning individual rights, privacy, safe and competent services, integrity, promptly raising and acting on safety concerns, and taking all reasonable steps to prevent and respond to violence, abuse, neglect, exploitation and sexual misconduct. Coverage does not itself establish a breach: the particular requirement and the individual's conduct must be examined.

For a manager responsible for several supported independent living homes, evidence about repeated staffing warnings or unresolved incident reports may be important. For a non-executive director, the relevant evidence may concern oversight, escalation and responses to board information rather than daily rostering. Lack of day-to-day involvement is a fact to examine, not a universal immunity.

Ask what the person knew, when they knew it, what authority they had and what they actually did. Were risks investigated? Were instructions followed up? Did the board receive an accurate account? Delegations and organisational charts help explain responsibility, but the real operation of those arrangements matters too.

The provider's systems and the individual's conduct are connected, but they are not the same legal question.

03 Banning orders: a separate and immediate risk

Section 73ZN permits banning orders on specified statutory grounds. Depending on the ground and the terms of the order, a person can be prohibited or restricted from providing NDIS supports or being involved in their provision. The power is not confined to frontline workers.

For current or former employees, engaged persons and key personnel, section 73ZN(2) includes grounds concerning actual or likely contraventions or involvement in another person's contravention, unsuitability under prescribed matters and specified immediate danger to a person with disability. Fraud or dishonesty convictions and insolvency are additional grounds. The applicable category and evidentiary basis must be identified; not every ground requires a prior court finding.

A banning order is a protective regulatory measure, not a criminal conviction. It can nevertheless have substantial consequences for employment, management roles and a person's ability to work in the sector.

Read the actual order: the prohibited activities, conditions, start date and duration. Unpaid work, consultancy arrangements, a changed title or work through another company is not necessarily outside its scope. If the terms are unclear, obtain advice before continuing the activity.

The Commissioner must ordinarily provide an opportunity to make submissions before making an order. Section 73ZN contains exceptions, including specified immediate-danger grounds and where the Commissioner has revoked the person's registration. Do not assume there must always be a warning period.

A response should address the stated ground, the evidence concerning the person's conduct and the current risk. It should also explain any relevant safeguards or factual errors. Remediation may matter, but does not require the Commissioner to accept an alternative outcome.

Specified banning-order decisions are reviewable under the NDIS Act. A directly affected person generally has three months after receiving notice to seek internal review; an ART application following internal review is generally due within 28 days after the review decision is given. Check the decision notice and applicable provisions immediately. Extensions should not be assumed, and seeking review does not automatically stay the order.

An application to vary or revoke an order under section 73ZO is a separate process. It should not be assumed to preserve an internal-review or Tribunal deadline.

04 Inaccurate answers can create a new problem

A response to an investigation should distinguish verified facts, incomplete records and matters still being checked. Pressure to provide a reassuring answer is not a reason to present an assumption as a fact.

Section 59A concerns knowingly false or misleading statements, information or documents supplied to the Commissioner or a Commission officer for the purposes of the Act, including relevant omissions. Registration applications are addressed separately by section 73D. Section 59A provides both criminal and civil penalty consequences and contains defences concerning materiality.

The ordinary criminal maximum under section 59A is 12 months' imprisonment or 120 penalty units, or both. For a serious contravention by an NDIS provider, it is five years or 1,000 penalty units, or both. The corresponding civil maxima are 120 and 10,000 penalty units. A director does not attract the provider-specific higher maximum merely because of their office.

Section 59AB concerns false or misleading material supplied to the NDIA and has its own offence and civil penalty framework. Identifying the recipient and the statutory provision matters; a Commission investigation and an Agency payment enquiry are not the same process.

For example, an executive may be asked when the provider first became aware of an incident. If an earlier email contradicts the date in a draft response, resolve the discrepancy before signing. Explain uncertainty honestly rather than selecting the date that makes compliance look better.

An error is not automatically proof of knowing deception. Equally, deliberately leaving out information that makes an otherwise accurate statement misleading can create exposure. If a material mistake is discovered after submission, obtain advice promptly about an accurate correction and preserve the original response.

05 Civil penalties and criminal allegations are different

Civil proceedings and criminal prosecutions differ in their elements, procedures and standard of proof. Criminal guilt must be established beyond reasonable doubt. A civil penalty proceeding does not itself carry a sentence of imprisonment.

Section 73ZNA, introduced from 9 April 2026, includes civil penalty, fault-based criminal and strict-liability pathways for breaching a banning order, including a condition. The fault-based offence can carry up to five years' imprisonment or 300 penalty units, or both. The separate strict-liability offence carries 150 penalty units, not imprisonment. The civil maxima are 1,000 penalty units ordinarily or 10,000 for a serious contravention by an NDIS provider. These are distinct routes; the order, relevant dates, application rules and required elements must be examined.

The NDIA administers scheme funding and payments, while the Commission regulates quality and safeguards. A payment-integrity investigation may concern supports allegedly not delivered, inaccurate claims or records, or funds obtained without entitlement.

Sections 59AC and 59AD address conduct resulting in payments or amounts becoming payable where the person knows there is no entitlement, or the amount exceeds the entitlement. Section 59AD additionally requires dishonesty, deception or impersonation. A disputed claim or an administrative repayment demand is not, merely for that reason, proof of fraud.

The ordinary section 59AC maximum is 12 months' imprisonment or 120 penalty units, or both, rising to five years or 1,000 penalty units for a serious contravention by an NDIS provider. Under section 59AD, the corresponding maxima are five years or 1,000 penalty units, and ten years or 2,000 penalty units, or both. Section 59AF addresses serious contraventions of specified offences. Again, provider-specific higher maxima do not automatically apply to directors.

The current section 59A and new sections 59AB to 59AF came into operation on 27 August 2026 under separate Securing the NDIS legislation. The date of the alleged conduct and applicable application rules need checking; not all 2026 reforms commenced together.

Where personal criminal allegations are possible, obtain individual advice before an interview or substantive statement. Identify whether the interaction is voluntary or compulsory, what power is being used and what protections apply. Do not obstruct a lawful investigation or assume that an informal conversation has no evidentiary consequences.

06 Documents, interviews and self-incrimination

Board papers, emails, incident escalations, audit reports and delegation records can bring a director directly into an investigation. They may support the person's account or expose a gap between what management knew and what the provider later said.

Sections 55A and 56 govern specified Commission requirements for information or documents. Under section 57, an individual may have a reasonable excuse for non-compliance with a section 55A requirement where compliance might tend to incriminate them or expose them to a penalty. That protection is tied to the power being exercised; it is not a blanket permission to disregard every notice or withhold required incident notifications.

A corporation does not have the same privilege against self-incrimination as an individual. Legal professional privilege is a distinct protection, with its own requirements. A confidential document, a report commissioned during a dispute or an email copied to a lawyer is not automatically privileged.

Obtain advice on the notice's validity, scope, deadline and applicable protections before producing material. Make any lawful claim properly and within the response process. Do not alter or delete evidence. Keep necessary corrections dated and transparent alongside the original records.

07 When the provider and the individual need separate advice

A provider may say an incident resulted from a manager's failure to follow procedures. The manager may say the procedures could not be implemented because the company repeatedly refused staffing or resources. Both accounts cannot simply be blended into one comfortable statement.

Conflicts can also arise during settlement. The company may be prepared to admit systemic failings while an executive disputes receiving the reports said to establish personal knowledge. Proposed agreed facts deserve individual scrutiny before anyone signs.

Ask who the lawyer acts for and whether advice can be shared. A company's lawyer does not automatically represent its directors or employees. Separate representation may be necessary where factual positions or legal interests diverge.

Review relevant insurance arrangements and notification requirements. Cover for legal expenses, civil penalties or criminal allegations depends on policy wording, applicable law and the circumstances. Company payment of legal expenses can also require separate consideration.

08 A practical checklist for directors and executives

  1. Identify your status. Are you a witness, the recipient of a compulsory notice, the subject of proposed regulatory action or a named respondent?
  2. Read every document. Confirm the allegations, power, deadline and any restrictions already operating.
  3. Preserve your evidence. Retain messages, board records, incident escalations and relevant instructions without changing them.
  4. Map your actual role. Record your responsibilities, delegations, information received, authority and actions taken at the relevant time.
  5. Check conflicts early. Assess whether the provider's account or proposed admissions affect your position.
  6. Obtain advice before signing or speaking. Understand privilege, self-incrimination and the consequences of any statement or interview.
  7. Keep safety and compliance moving. Address current risks and comply with effective orders unless lawful relief changes them.

These steps do not guarantee an outcome. They help prevent an already serious matter from being made worse by lost records, missed deadlines or an inaccurate response.

For the provider's court response, read the companion article on defending NDIS civil penalty proceedings. Our NDIS investigation guide covers information notices, reporting and proposed action.

09 How GopherWood Lawyers can assist

We assist NDIS providers, directors, executives and other individuals with regulatory investigations, civil penalty proceedings, proposed banning orders and related disputes. The response should address each client's actual position, rather than assume the organisation and everyone within it face the same case.

If you have received a notice, been served with proceedings or been asked to sign a statement about your own conduct, bring the documents and relevant deadlines to the first discussion. Call 02 9160 2157 or enquire about an NDIS regulatory matter. See our NDIS regulatory investigations page for further information.

This article reflects material reviewed on 30 October 2026. It provides general information, not legal advice. Personal exposure depends on the person's conduct, the applicable obligation and the law in force at the relevant time.

10 Sources and further reading

Become a Client