Reportable incidents under the NDIS: what to tell the Commission
Reportable incidents are the six kinds of event a registered NDIS provider has to notify to the NDIS Commission. This explainer sets out what counts, who reports, and how soon.
A reportable incident under the NDIS is one of six kinds of event: a death, a serious injury, abuse or neglect, unlawful sexual or physical contact or assault, sexual misconduct, or an unauthorised restrictive practice. A registered provider notifies the NDIS Commission within 24 hours, and within 5 business days for a restrictive practice.
In short
- A reportable incident is a death, a serious injury, abuse or neglect, assault, sexual misconduct, or an unauthorised restrictive practice.
- The event must happen in connection with the NDIS supports the registered provider delivers.
- An allegation counts. The provider notifies on what is alleged, not on what has been proven.
- Five kinds go to the Commission within 24 hours. An unauthorised restrictive practice goes within 5 business days.
- Workers tell the provider. The provider tells the Commission. Records and statistics are a separate standing duty.
What counts as a reportable incident under the NDIS
A reportable incident is one of six listed kinds of event, each happening in connection with the NDIS supports a registered provider delivers. The list is closed, so an event outside it is still managed and recorded, but it is not notified as a reportable incident.
The six kinds, set by the National Disability Insurance Scheme (Incident Management and Reportable Incidents) Rules 2018, as at October 2026:
| Kind of event | What it covers |
|---|---|
| Death | The death of a person with disability. |
| Serious injury | A serious injury of a person with disability. |
| Abuse or neglect | Abuse or neglect of a person with disability. |
| Unlawful contact or assault | Unlawful sexual or physical contact with, or assault of, a person with disability. |
| Sexual misconduct | Sexual misconduct committed against, or in the presence of, a person with disability, including grooming for sexual activity. |
| Unauthorised restrictive practice | The use of a restrictive practice in relation to a person with disability, other than where it is authorised under the relevant state or territory arrangements and used in line with the person's behaviour support plan. |
Two points catch providers out. The first is that an alleged reportable incident is a reportable incident. The Rules say so directly. A notification is not an admission and it is not a finding. It is the provider telling the Commission what has been alleged, and what is being done about it. Waiting until an internal investigation is finished is how a 24 hour deadline is missed.
The second is the restrictive practice category. A use of a restrictive practice that sits outside the authorisation and the behaviour support plan is reportable in its own right, including a single use in an emergency. Our explainer on what NDIS providers must record and report about restrictive practices goes through that category on its own.
Who has to tell the NDIS Commission about an incident
The registered NDIS provider notifies the Commission, not the individual worker. The Rules place the duty on the provider and its key personnel, and place a separate duty on workers to notify their provider.
That split matters in practice. A support worker who sees or hears about something has a duty under the Rules to tell their provider. The provider's key personnel, meaning the people who make or take part in the organisation's decisions, then have the duty to see that the Commission is notified and that the incident is managed. So the chain runs worker to provider to Commission, and the clock the Commission measures starts when the provider's key personnel first become aware.
A practical consequence: whoever holds the account that submits notifications has to be reachable, including on a weekend. A 24 hour window does not pause.
How soon a provider must report a reportable incident
Five of the six kinds are notified to the Commissioner within 24 hours. The use of a restrictive practice that was not authorised is notified within 5 business days. Both timeframes are set by the Rules, as at October 2026.
| What happened | When it is notified |
|---|---|
| Death, serious injury, abuse or neglect, unlawful sexual or physical contact or assault, sexual misconduct | Within 24 hours |
| Use of a restrictive practice outside the authorisation and the behaviour support plan | Within 5 business days |
The first notification is not the end of it. The Rules require the provider to keep the Commissioner updated as more becomes known, and to give the Commissioner a final report when one is asked for. The Rules also recognise that some details cannot be obtained at the start, and set out the circumstances in which certain information need not be obtained or notified. Treat the first notification as the opening of a file, not the closing of one.
What happens after a provider reports an incident
The Commission decides what it needs to do next. The Rules let the Commissioner ask for more information, ask for a final report, make inquiries into a reportable incident, and take action under the NDIS Act.
In most cases the practical effect on the provider is a request: more detail, the outcome of the internal review, the steps taken to keep the person safe, and the changes made so it is less likely to happen again. The Commission can also inquire into an incident itself. A provider that notified promptly, kept its records straight and can say what it changed is in a very different position from one that has to reconstruct events months later.
The incident management system behind the notifications
Every registered NDIS provider has to have an incident management system, and it has to cover all incidents, not only the reportable ones. The notification duty sits on top of it.
The Rules set out what that system has to do. It must cover the incidents that have to be covered, set out procedures for identifying, managing and resolving incidents, afford procedural fairness to the people involved, deal with documentation, record keeping and statistics, and set out the roles, responsibilities, compliance and training of workers.
The word "statistics" is worth noticing. A provider is expected to be able to look across its incidents and see patterns, not only file them one at a time. That means someone has to be able to answer plain questions: how many incidents last month, of what kind, at which service, how many became reportable, how many are still open past their due date, and how long a notification took from first awareness. Those are counting questions, and they are far easier to answer when incidents are recorded in one place with consistent categories and dates.
What records a provider keeps about a reportable incident
The Rules set a record keeping duty for reportable incidents, beside the incident management system's own documentation duty. Both are written requirements, not good practice suggestions.
In plain terms, the file for a reportable incident should let someone who was not there follow it: what happened and when, when the provider's key personnel first became aware, who was told and when, what was notified to the Commission and when, what was done immediately to make the person safe, who was involved and what was said to them, what the provider found, what it changed, and what it sent the Commission afterwards. If the dates are missing, the file cannot show the deadline was met, whatever actually happened on the day.
Reportable incident or complaint
A reportable incident is something that happened and that the provider notifies to the Commission. A complaint is somebody raising a concern, and anybody can raise one with the Commission directly.
The two overlap but they are not the same process. A complaint from a participant's family may describe something that is also a reportable incident, in which case both duties run at once. Equally, a reportable incident may arrive with no complaint attached at all, and the duty to notify does not wait for one. Keeping the two registers linked but separate is usually cleaner than merging them.
Common questions
Who has to tell the NDIS Commission about an incident?
The registered NDIS provider does, through its key personnel. Workers have their own duty under the Rules to notify their provider, and the provider then notifies the Commissioner. A worker is not expected to contact the Commission in the provider's place, although anybody may make a complaint to the Commission.
How soon must a provider report a reportable incident to the NDIS Commission?
Within 24 hours for a death, a serious injury, abuse or neglect, unlawful sexual or physical contact or assault, or sexual misconduct, and within 5 business days for the use of a restrictive practice that was not authorised, as at October 2026. The 24 hour clock runs from when the provider's key personnel first become aware.
Does an incident have to be reported if it happened outside NDIS supports?
The test in the Rules is whether the incident happened in connection with the provision of NDIS supports or services by the provider. An event with no connection to the supports delivered falls outside the reportable incidents regime, though other obligations such as the NDIS Code of Conduct may still apply. Where the connection is unclear, the Commission's own reportable incidents guidance is the place to check.
What is the difference between a reportable incident and a complaint?
A reportable incident is an event the provider has a duty to notify to the Commission. A complaint is a concern someone raises, and it can be raised with the provider or directly with the Commission by anyone. One event can be both at once, and each follows its own process.
What records must a provider keep about a reportable incident?
The Rules set a record keeping requirement for reportable incidents, and a separate documentation, record keeping and statistics requirement for the incident management system as a whole. The practical standard is that the file shows the sequence with dates: awareness, notification, immediate action, review, outcome and what was reported back.
For more plain explainers written for NDIS providers, start with our NDIS page or the frequently asked questions.
Sources
- National Disability Insurance Scheme (Incident Management and Reportable Incidents) Rules 2018, as at October 2026
- Reportable incidents, NDIS Quality and Safeguards Commission, as at October 2026