NDIS Compliance in 2026: 10 Priorities for Registered Providers

What's Changed in 2026

Mandatory registration has started. Following reviews that identified higher risks to participant safety and quality in some services, SIL and NDIS digital platform providers must now be registered to deliver those supports. Registration means meeting the NDIS Practice Standards, worker screening requirements and passing an independent quality audit. Mandatory registration for support coordination was also flagged, but that reform is paused.

New Practice Standards for SIL. SIL providers now work to four additional standards covering supported decision-making, safeguarding, governance, and tenancy, housing and support arrangements - on top of the core Practice Standards.

Bigger penalties. The Getting the NDIS Back on Track amendments introduced a tiered civil penalty regime and the concept of a "serious contravention" - one involving a significant failure or a systematic pattern of conduct. Maximum penalties for a body corporate now reach $16.5 million.

More reform is coming. A graduated, risk-proportionate registration model has been proposed, matching the depth of oversight to the risk of each support. The direction is clear: more providers will be expected to show stronger, more consistent evidence of quality and safety.

10 Compliance Priorities for NDIS Providers

1. Confirm your registration position

Check whether any support you deliver now requires registration, and which registration group and audit type (verification or certification) applies. If you deliver SIL or operate a digital platform and haven't registered or applied, seek advice immediately.

2. Make reportable incident notification foolproof

Most reportable incidents - including death, serious injury, abuse or neglect, unlawful sexual or physical contact, and sexual misconduct - must be notified to the NDIS Commission within 24 hours of key personnel becoming aware, with more detail within five business days. Unauthorised use of a restrictive practice generally has five business days, unless it caused harm, when it's 24 hours. Everyone on shift needs to know what to report, to whom, and how fast.

3. Record every incident, not just the reportable ones

Auditors expect a complete incident register, including near-misses and minor incidents. Informal handling of "small" incidents is one of the most common audit gaps, and it hides patterns you need to see.

4. Close the loop on investigations

An incident isn't finished when it's reported. Record the investigation, the actions taken, who owns each action and when it was completed. Then review trends regularly and show what changed.

5. Run a real complaints system

Providers must have a complaints management and resolution system that participants can actually use. Log every complaint, track the response and connect outcomes to improvements.

6. Keep worker screening and training current

Workers in risk assessed roles need a current NDIS Worker Screening Check, and all workers must understand the NDIS Code of Conduct. Track screening, qualifications and mandatory training with expiry reminders, not a spreadsheet someone checks occasionally.

7. Treat restrictive practices with extra care

Regulated restrictive practices must be authorised and used in line with a behaviour support plan, and their use must be reported. This is an area of close Commission attention, so documentation needs to be complete and current.

8. Keep policies alive

Policies need owners, review dates and version control - and staff need to be working from the current version. A policy that hasn't been reviewed since the last audit is a finding waiting to happen.

9. Maintain a risk register that reflects reality

The Practice Standards expect risk management to be part of how the organisation is governed: participant risks, operational risks, workforce risks, and business continuity. Review risks regularly and link them to controls and actions.

10. Be audit-ready all year, not audit-week ready

Build the evidence as you go. When incidents, complaints, training, policies and risks are all recorded in one place with an audit trail, an audit becomes a matter of showing your work - not reconstructing it.

Doing It With a Small Team

Most NDIS providers don't have a dedicated compliance department. The answer isn't more paperwork - it's fewer places to look. A single system that every support worker can use to report an incident, read a policy or complete training, and that managers can use to track actions and report to the board, removes most of the friction that causes gaps.

Two things matter when choosing that system. First, cost: per-seat pricing pushes providers to limit access, which is the opposite of what incident reporting needs. Second, where the data lives: participant information is highly sensitive, and Australian hosting keeps it under Australian law.

Pali GRC helps NDIS providers manage incidents, complaints, worker records, policies and Practice Standards evidence in one Australian-hosted platform, with no per-seat fees. See how Pali GRC works for NDIS providers, or contact us to arrange a demo.

This information is correct to the best of our knowledge at the time of publication. Readers should check current requirements with the NDIS Commission and should not rely on it for legal advice.