Reportable incidents and incident management: what NDIS providers need to know

Published 13 October 2026 · For providers · Source checked 13 October 2026

Incidents happen, and how you respond is what is judged. The difference between an incident and a reportable incident, the timeframes, and a simple process to build around them.

An incident and a reportable incident

The Commission defines an incident as an act, omission, event or circumstance that has or could have caused harm to a person with disability, or where a person with disability has caused serious harm or the risk of serious harm to another person. Incidents that happen while supports are delivered need to be identified, assessed, recorded, managed and resolved, while the person feels safe, respected and informed.

A reportable incident is a defined subset: an act or event, or an alleged one, in connection with delivering NDIS supports that must be notified to the Commission by registered providers. That includes incidents you have already recorded and responded to in your own system.

Build a simple incident process

The Commission describes a sequence you can adapt to your size: identify the incident, support the people affected straight away, record what happened and the evidence, report and assess it internally, and then review it so you can learn from it. Immediate safety comes first, including calling 000 if someone needs urgent medical care or a crime may have happened.

Your system should suit your size and the supports you deliver, be written down in an accessible form, and be available to all workers and to the people you support. Records need to be stored so that the privacy and confidentiality of the people affected is kept. A culture in which workers and participants feel comfortable telling you about incidents matters more than any form.

The reporting timeframes

Timeframes run from when the registered provider became aware of the incident. The Commission lists deaths, serious injuries, abuse or neglect, unlawful sexual or physical contact with or assault of a person with disability, and sexual misconduct, including grooming, as incidents that must be notified within 24 hours.

The use of a restrictive practice that is unauthorised by the state or territory, or does not follow a behaviour support plan, must be notified within five business days, unless it resulted in harm, in which case it must be reported within 24 hours. A 24-hour report is an immediate notification; a five-day report adds more information and the actions you have taken.

Not reporting within the timeframes can lead to an infringement notice or other compliance action. A third party report form is also available to tell the Commission about an incident connected to another registered provider’s supports.

The portal change

From 12 October 2026 the Commission runs two portals. New incidents are lodged in the new NDIS Commission Portal, including the 24-hour and five-day reports, and incidents lodged earlier stay in the existing portal for follow-up. The Commission publishes a “which portal do I use” page and quick reference guides, so check them before you need them in a hurry.

If you are not registered

Unregistered providers do not report incidents to the Commission in the same way, but the Commission says all providers should have an incident management system, and the Code of Conduct requires every provider to respond to incidents and to act promptly on concerns about safety and quality. If you work under another provider’s registration, tell them immediately, because their timeframe starts when they become aware. General information only; use the Commission’s current guidance.

Frequently asked questions

What is the difference between an incident and a reportable incident?

An incident is an act, omission, event or circumstance that has or could have caused harm to a person with disability, or where a person with disability has caused serious harm or the risk of serious harm to another person. A reportable incident is a defined subset that must be notified to the Commission by registered providers.

What are the reporting timeframes?

Timeframes run from when the registered provider became aware of the incident. Deaths, serious injuries, abuse or neglect, unlawful sexual or physical contact with or assault of a person with disability, and sexual misconduct, including grooming, must be notified within 24 hours. The use of an unauthorised restrictive practice must be notified within five business days, unless it resulted in harm, in which case it must be reported within 24 hours.

What should an incident process include?

Do unregistered providers have to report incidents?

Keep learning

How to become a registered NDIS provider: the steps and what to prepare: Registration is an application, an independent quality audit and a suitability assessment. Here is the sequence, what to have ready, and where the costs and delays usually sit.
Responding to enquiries: a practical checklist for NDIS and aged care providers: An enquiry is a person asking for information, not a booking. How to reply quickly and respectfully, what to put in a first message, and how to decline well when you cannot help.
Writing a provider profile that helps people choose you: People comparing providers want specific, checkable answers. What to put in a profile, what to keep current, and what to leave out so that your listing is honest and useful.
Handling complaints well: a guide for NDIS providers: A complaint handled well can strengthen a relationship. What the Commission expects, the “four As” approach to resolution, and why procedural fairness matters to everyone involved.

More in our NDIS updates and insights, our step-by-step guides, or the NDIS and aged care provider directory.

Official sources

Source checked 13 October 2026. Rules and guidance can change; verify current details with the responsible agency. How we write and check our guides.