When NDIS reportable incidents occur under your care, your immediate instinct is to protect the participant. You ensure their physical safety, contact medical personnel, and stabilise the environment. This is exactly what a high-quality NDIS provider should do.
But while your frontline team manages the human crisis, a high-stakes compliance clock ticks in the background.
Under the NDIS Commission reportable incident requirements, registered providers must notify the Commission of most reportable incidents within 24 hours of becoming aware of the incident. A separate 5 Day Form is used to provide additional information and actions taken.
For busy providers juggling participant care and daily operations, this 24-hour rule is one of the most dangerous administrative traps in the industry. Here’s what providers need to know about the NDIS reportable incidents 24 hour rule, what needs to be reported, and how stronger administrative systems can make the process easier to manage.
When Does the Clock Actually Start?
A common misconception among NDIS providers is that the 24-hour countdown begins when the incident occurs. It does not.
The countdown begins when the registered provider becomes aware of the reportable incident. The Commission specifically states that reporting timeframes are calculated from when the provider became aware.
If a support worker witnesses an incident on Saturday night but doesn’t notify a manager until Monday at 9:00 AM, the reporting timeframe starts when the provider becomes aware on Monday.
Because the window is incredibly tight, your internal reporting lines must be flawless. If a team member has any doubt about whether an event qualifies, the safest approach is to escalate it immediately through your organisation’s incident management process rather than allowing uncertainty to delay action.
Your NDIS incident management system should clearly identify how incidents are identified, recorded and reported, who must be notified internally, and who is responsible for notifying the Commission.
What Counts as a Reportable Incident NDIS Providers Must Report?
Not every incident requires a 24-hour turnaround, but the most serious ones do. Registered providers must notify the Commission when a reportable incident involves:
- The death of a person with disability.
- Serious injury of a person with disability.
- Abuse or neglect of a person with disability.
- Unlawful sexual or physical contact with, or assault of a person with disability.
- Sexual misconduct, including grooming for sexual activity.
- Unauthorised use of a restrictive practice, subject to its specific reporting timeframe.
The NDIS Commission confirms that the first five categories generally require notification within 24 hours. An unauthorised restrictive practice generally has a five-business-day timeframe, but where it has resulted in harm to a person with disability, it must be reported within 24 hours.
A reportable incident can also involve an alleged act, not only something that has been conclusively established.
For the full definitions and reporting requirements, providers should refer to the NDIS (Incident Management and Reportable Incidents) Rules 2018 alongside the Commission’s current guidance.
The Two-Step NDIS Incident Reporting Framework
Compliance is not a single, one-and-done event. The NDIS Commission uses a two-stage notification process for most reportable incidents.
Step 1: The 24-Hour Immediate Notification
This is the time-critical stage. Registered providers must submit the Immediate Notification Form through the NDIS Commission Portal within the applicable timeframe, which in most cases is 24 hours from becoming aware of the reportable incident.
- Do not wait for all the facts. If specific information is not available within the initial timeframe, the Commission allows remaining information to be provided within five business days.
- Focus on the basics: State clearly who was involved, what happened, when and where it occurred if known, the impact or harm, and what immediate actions were taken to protect the participant.
Step 2: The 5-Day Comprehensive Report
Once the immediate crisis is handled, the administrative follow-up begins. The provider has five business days from becoming aware of the reportable incident to provide additional information and actions taken.
This may include:
- Further information about the incident.
- Witness details.
- Additional actions taken.
- Proposed actions to address risks and prevent similar incidents.
The important distinction is that providers do not have to complete a full investigation before making the initial notification. The two-stage process allows them to notify promptly and then provide additional information as it becomes available.
The Operational Reality: Why Frontline Teams Struggle
When a serious incident occurs, your core team is stretched to its limit. Support coordinators and managers are busy counselling affected participants, speaking with families, managing staff scheduling changes, and dealing with emergency services.
Expecting a stressed manager to step away from a human crisis to log into a portal, format data, and navigate strict compliance language is a recipe for errors, late entries, and compliance red flags.
This is exactly why an incident management system needs more than a policy sitting in a shared folder. The NDIS Commission requires registered providers to have documented procedures covering how incidents are identified, recorded and reported, who is responsible for notification, how the impacted person is supported, and how corrective action is managed.
How Back-End Administration Saves the Day
To survive the 24-hour rule, successful NDIS providers separate crisis management from administrative management. This is where robust administrative support and dedicated virtual assistant frameworks become a business lifesaver.
By utilising external administrative support, you protect your business in three distinct ways:
- Seamless CRM Management: While your frontline staff handles the physical response, a dedicated virtual admin assistant can immediately log the details into your internal CRM, keeping records clean and auditable.
- Portal Coordination: External admin professionals can assist in gathering the core baseline facts and preparing the administrative information required for the notification, while authorised provider personnel remain responsible for submitting and verifying the report.
- The 5-Day Compilation: Gathering witness statements, organising internal files, and structuring the data for the five-day follow-up requires hours of focused computer work. Delegating this paperwork allows your core team to remain participant-focused without letting compliance drop.
Providers can outsource NDIS incident logging to a support team while keeping incident assessment, safeguarding decisions and regulatory responsibility with authorised internal staff.
An NDIS compliance virtual assistant can therefore support the admin side of the process while your authorised team remains responsible for the incident response and compliance decisions.
How NDIS Reportable Incidents Can Be Managed More Efficiently
The worst time to realise your internal reporting systems are broken is during a major incident. Protecting your NDIS business requires having strong, backend administrative habits in place before an emergency occurs.
A practical system should make it clear:
- Who receives the initial notification internally.
- Where incident information is recorded.
- Who is responsible for Commission notification.
- Where supporting documents are stored.
- Who tracks the five-day follow-up.
- Who reviews corrective actions.
The Commission specifically requires incident management systems to be appropriate for the provider, documented and accessible to relevant workers and people with disability.
By building structured, reliable workflows and leveraging professional support services, you can keep your eyes on the people who matter most while maintaining stronger administrative control.
What Are the Current Penalties for NDIS Compliance Breaches?
The previous $55,000 per breach figure should not be presented as a blanket penalty for late reportable-incident notification.
Current legislation has changed the penalty framework. The National Disability Insurance Scheme Amendment (Integrity and Safeguarding) Act 2026 amended relevant NDIS Act provisions, including section 73J. For the relevant civil penalty provision, the maximum is 10,000 penalty units for a serious contravention and 250 penalty units in other cases.
From 1 July 2026, the Commonwealth penalty unit is $364.
That means:
| Penalty |
Current value |
|
250 penalty units |
$91,000 |
| 10,000 penalty units |
$3.64 million |
These figures represent statutory civil-penalty maximums for the relevant provisions. They do not mean every late report automatically attracts a $91,000 or $3.64 million penalty.
The NDIS Commission states that failing to report a reportable incident within the required timeframe might result in an infringement notice or other compliance action.
The Commission has also published actual enforcement action against providers for failing to notify reportable incidents within 24 hours, demonstrating that late reporting is treated as a genuine compliance issue.
Get Reliable Support Behind Your NDIS Administration
Incident management requires your team’s attention, but the admin work surrounding it doesn’t have to fall entirely on frontline staff.
At NDIS Assist, we support NDIS providers with administrative tasks including documentation, CRM management, records, communication, referrals, onboarding and other day-to-day operational work.
If your team needs help keeping incident records organised and administrative processes on track, connect with NDIS Assist and let’s discuss the support your organisation needs.
FAQs
Q: Does the 24-hour window start when the incident happens or when we find out?
A: It starts when the registered provider becomes aware of the reportable incident, not necessarily when the event physically took place.
Q: Do we need all the facts and investigation results before submitting the 24-hour report?
A: No. Submit the Immediate Notification with the information available. Further information can generally be provided within five business days.
Q: What happens if an incident occurs over the weekend or a public holiday?
A: The 24-hour timeframe is calculated from when the provider becomes aware and does not pause simply because it is a weekend or public holiday.
Q: What are the financial penalties if our business submits a report late?
A: Late reporting can result in an infringement notice or other compliance action. The current NDIS Act also contains civil-penalty provisions of up to 250 penalty units ($91,000) or, for a serious contravention under the relevant provision, 10,000 penalty units ($3.64 million). These are not automatic penalties for every late report.
Q: Should we report an incident if we are unsure it meets the “serious” threshold?
A: If you are unsure whether an event is reportable, follow your incident management procedure and seek appropriate guidance promptly rather than allowing uncertainty to delay a required notification. The Commission’s guidance should be used to determine the applicable reporting obligation.