The six types of reportable incident
Under the NDIS (Incident Management and Reportable Incidents) Rules 2018, registered providers must notify the NDIS Commission of these incidents, including alleged ones, when they happen in connection with NDIS supports or services:
- The death of a person with disability
- Serious injury of a person with disability
- Abuse or neglect of a person with disability
- Unlawful sexual or physical contact with, or assault of, a person with disability
- Sexual misconduct against, or in the presence of, a person with disability, including grooming the person for sexual activity
- Use of a restrictive practice that is not authorised by the state or territory, or does not follow the person's behaviour support plan
Reporting timeframes
Timeframes run from when the registered provider became aware of the incident, not from when it happened.
- Death, serious injury, abuse or neglect, unlawful contact or assault, and sexual misconduct: notify within 24 hours
- Unauthorised restrictive practice: notify within 5 business days, unless it caused harm to the person, in which case within 24 hours
- Follow up 5 day report: give more information and the actions you have taken within 5 business days of becoming aware
- Missing a timeframe can lead to an infringement notice or other compliance action
How to report
Since 12 October 2026, all new incidents are lodged in the new NDIS Commission Portal, including the 24 hour report and the 5 day report. Incidents lodged before 12 October stay in the existing portal, where you finish their 5 day reports and requests for information.
In the portal, open the Reportable incidents tab, choose Create reportable incident, read the guidance and select the incident type. For an unauthorised restrictive practice that did not cause immediate harm, the 5 day report is the only form needed. You can also lodge a third party report about an incident involving another registered provider's supports.
Your own incident management system
Reporting to the Commission sits on top of your own incident management. Registered providers must have an incident management system proportionate to their size and supports, record and respond to every incident, and still notify the Commission of reportable ones even if they have already been handled internally.
Good practice is to make sure the person is safe first, call 000 or the police where needed, preserve evidence, support the person affected, and then record and report. Involve the participant and their family in what happens next, and learn from the incident so it does not happen again.
Unregistered providers and participants
The reportable incident scheme applies to registered providers. Unregistered providers and their workers still have to follow the NDIS Code of Conduct, which requires them to raise concerns promptly and take reasonable steps to prevent and respond to abuse, neglect and sexual misconduct.
Participants, families, workers and anyone else can raise a concern or complaint about any provider with the NDIS Commission at any time.
What happens after you report
The Commission reviews the report and may ask for more information, require the provider to investigate or take specific action, or use its compliance powers. Serious or repeated failures can lead to conditions on registration, banning orders or other enforcement action.