NDIS Reportable Incidents: The 24-Hour and 5-Business-Day Guide for Providers
A practical, current guide to incident categories, notification deadlines, records and follow-up for registered NDIS providers.
When a serious incident occurs, the first priority is the safety and wellbeing of the person affected. The next challenge is knowing what must be reported, who must be told and how quickly action is required.
For registered NDIS providers, some incidents—and allegations—must be notified to the NDIS Quality and Safeguards Commission within strict timeframes. Most reportable incidents must be notified within 24 hours of the registered provider becoming aware of them. One category, unauthorised use of a restrictive practice that has not resulted in harm, generally has a five-business-day notification timeframe.
Quick answer Do not wait for an internal investigation to finish before deciding whether to notify. Record when the provider became aware, protect the participant, escalate immediately and submit the required notification within the applicable timeframe. |
First: make the person safe and supported
Compliance matters, but it should never displace the immediate response. If anyone is in danger or needs urgent medical assistance, call 000. Take reasonable steps to prevent further harm, preserve relevant evidence and support the person to communicate in their preferred way. Keep them informed and involved, including through a representative or advocate where appropriate.
The NDIS Commission’s incident-management guidance says incidents connected with NDIS supports and services need to be identified, assessed, recorded, managed and resolved while the person with disability feels safe, respected and informed.
Not every NDIS incident is a reportable incident
An incident can include an act, omission, event or circumstance that has—or could have—caused harm to a person with disability. Registered providers must manage incidents through their incident management system, but only the specified reportable-incident categories must be notified to the NDIS Commission.
The reporting obligation applies where the incident occurred, or is alleged to have occurred, in connection with the registered provider’s delivery of NDIS supports or services. The connection is broader than asking whether a worker directly caused the incident. If the classification is unclear, escalate it promptly rather than allowing uncertainty to consume the reporting window.
What incidents must registered NDIS providers report?
The current categories published by the NDIS Commission are:
Death of a person with disability.
Serious injury of a person with disability.
Abuse or neglect of a person with disability.
Unlawful sexual or physical contact or assault involving a person with disability.
Sexual misconduct against, or in the presence of, a person with disability, including grooming for sexual activity.
Unauthorised restrictive practice or use of a restrictive practice that does not follow the person’s behaviour support plan.
These categories include allegations. A provider does not need to establish that the allegation is substantiated before meeting the notification requirement.
The 24-hour and five-business-day deadlines
Incident category | Initial deadline | What follows |
Death; serious injury; abuse or neglect; unlawful sexual or physical contact or assault; sexual misconduct, including grooming | Within 24 hours | Provide additional information through the 5 Day Form within five business days. |
Unauthorised restrictive practice, or restrictive practice not following a behaviour support plan, where harm resulted | Within 24 hours | Complete the required follow-up information within five business days. |
Unauthorised restrictive practice, or restrictive practice not following a behaviour support plan, where no immediate harm resulted | Within 5 business days | The 5 Day Form is the only form required for this category. |
When does the clock start? The published timeframes are calculated from when the registered NDIS provider became aware of the incident—not when an internal review is completed and not when every fact has been confirmed. |
A practical response sequence for providers
Protect safety and wellbeing. Provide first aid or medical support, remove immediate hazards and call emergency services when required. Take a trauma-informed approach.
Record the awareness time. Document the date and time the provider first became aware, who received the information and what was known at that point.
Escalate internally without delay. Contact the manager, key personnel or the person named in your incident management system as responsible for reportable-incident notifications.
Assess reportability. Check the incident or allegation against the six categories, the connection with service delivery and the restrictive-practice rules. If unsure, escalate for urgent advice.
Notify through the NDIS Commission Portal. Submit the Immediate Notification Form or 5 Day Form within the applicable deadline. Do not delay simply because some details are still being gathered.
Continue support, assessment and follow-up. Keep the impacted person informed, manage ongoing risks, preserve records, cooperate with other authorities and complete required follow-up information.
What information should be ready for notification?
The immediate notification should capture the information available at the time, including:
the registered provider’s details and the details of the person making the notification
the people involved, including the impacted person and any subject of an allegation
what happened and, if known, when and where it happened
the impact or harm to the person with disability
immediate actions taken to protect health, safety and wellbeing
medical treatment provided and whether police or another body has been notified
If required information is not available within the initial 24 hours, the NDIS Commission guidance allows remaining information to be provided within five business days. The follow-up information may include witness details, support provided, further actions, risk processes and relevant documents.
What happens after the 5 Day Form?
Not every notification will require a final report. If the NDIS Commission requires one, its detailed guidance states that the report is generally due within 60 business days after the initial notification, unless the Commission extends the period. The final report may need to address the investigation, findings, corrective actions and whether the impacted person or their representative was kept informed.
Reporting to the NDIS Commission may not be the only obligation
An NDIS Commission notification does not replace reporting to police, child protection, work health and safety regulators, insurers, funding bodies or other state and territory authorities where those obligations apply. Restrictive-practice authorisation requirements also vary between jurisdictions.
Your procedure should help staff identify parallel reporting pathways and record what was considered, what was reported, when it was reported and by whom. Obtain legal or specialist advice for complex or high-risk matters.
Incident records: what to keep and for how long
A strong incident record should show the incident description and impact, its reportability, the known date, time and place, the provider’s assessment, the people and witnesses involved, actions taken, consultation with the person affected, investigation details and the person who made the record.
NDIS Commission guidance says incident and allegation records must be stored securely and kept for at least seven years from the date the record is made. Longer retention periods or additional privacy, health-record and child-safety requirements may apply under other laws.
Common mistakes that create avoidable risk
Waiting for certainty.
Allegations can be reportable; notification is not a finding of wrongdoing.
Waiting for the investigation.
The reporting deadline runs while facts are still being gathered.
Missing the awareness time.
Without it, the provider may be unable to demonstrate that the deadline was met.
Treating every incident as Commission-reportable.
All incidents need management, but only specified categories require Commission notification.
Assuming one report covers everything.
Police, child protection, WHS and other notifications may still be required.
Leaving the participant out.
Incident management should keep the impacted person safe, informed and involved.
Using a template unchanged.
A generic form must be tailored to your services, roles, risks, systems and jurisdiction.
Connect incident response with risk management
Incident response is only one part of safer service delivery. Prevention also depends on identifying hazards, documenting controls and reviewing risks when circumstances change. For that broader prevention focus, read Create Effective NDIS Risk Management Plans with NDIS Risk Plan Templates.
A practical starting point for consistent incident action
When staff are under pressure, a clear prompt can reduce missed steps and create more consistent records. The editable NDIS Reportable Incident Management Checklist Template provides a structured starting point for incident assessment, escalation, notification and follow-up.
The template should be reviewed and customised for your organisation’s services, registration conditions, roles, participant needs, state or territory obligations and current NDIS requirements. A template supports a process; it does not replace professional advice or guarantee compliance.
Frequently asked questions
What is a reportable incident under the NDIS?
For a registered provider, it is an incident or alleged incident in a specified category that occurred in connection with delivering NDIS supports or services. The categories include death, serious injury, abuse or neglect, unlawful sexual or physical contact or assault, sexual misconduct including grooming, and certain unauthorised restrictive practices.
How quickly must a registered provider notify the NDIS Commission?
Most reportable incidents must be notified within 24 hours of the registered provider becoming aware. An unauthorised restrictive practice that has not resulted in harm is generally notified within five business days. If it resulted in harm, the deadline is 24 hours.
Is every incident reportable to the NDIS Commission?
No. Incidents connected with NDIS service delivery still need to be identified, recorded, managed and resolved, but only the specified reportable-incident categories must be notified to the Commission.
Do allegations have to be reported?
Yes, where the alleged conduct falls within a reportable-incident category and is connected with the registered provider’s supports or services. The provider should not wait for the allegation to be substantiated before meeting the deadline.
How long should NDIS incident records be kept?
NDIS Commission guidance states a minimum of seven years from the date the record is made. Other laws may require a longer period.
Where can providers find an editable NDIS incident checklist?
WorkSmart Templates offers an editable NDIS Reportable Incident Management Checklist Template. It should be customised and checked against the provider’s current obligations before use.
Official sources and further reading
Important information This article provides general information only and is not legal, regulatory or professional advice. Requirements can change and other Commonwealth, state or territory laws may apply. Check current official guidance and obtain advice for your circumstances. Information checked against official sources on 28 July 2026. |
