Written by the Provider360 team. Provider360 is Australia’s leading NDIS registration and compliance solution, supporting 3,000+ providers nationally. We support providers through registration and after it, with Provider Hub, our ongoing compliance membership.
Key takeaways
- Your registration is subject to conditions, and the Commission can add its own, shown on your certificate and the NDIS Provider Register.
- The NDIS Code of Conduct binds every provider, registered or not, along with their key personnel and workers.
- Reportable incidents go to the Commission within 24 hours of key personnel becoming aware, with more detail within five business days.
Why doesn’t compliance end when the certificate arrives?
You are a registered NDIS provider because you applied to the Commission, were audited against the relevant NDIS Practice Standards and assessed as meeting them, passed a suitability assessment of your business and its key personnel, and were issued a certificate of registration. That registration is subject to conditions, and they apply for as long as you hold it.
The Commission monitors compliance and investigates non-compliance. It requires you to make sure participants feel safe to raise concerns or complaints, and to manage complaints and respond to incidents effectively. Those are the systems you were audited on, and they have to keep working between audits.
On 4 September 2026, the Commission wrote to more than 285,000 unregistered providers with a reminder: the NDIS Code of Conduct applies to them too. As a registered provider, you carry the same Code, plus every condition of registration.
That is why NDIS compliance after registration works better as an operating rhythm than as a document set: some obligations run all the time, some start when something happens, and some come around on a cycle.
What are the conditions of NDIS registration?
The NDIS Commission lists the conditions every registration is subject to, and the NDIS Act holds the full set. In the Commission’s order, you must:
- Comply with the NDIS Practice Standards that apply to you. Which modules apply depends on the supports you are registered to deliver.
- Comply with the NDIS Code of Conduct. The Commission also expects you to support your workers to understand and follow it.
- Comply with applicable state, territory and Commonwealth laws.
- Keep effective systems for managing complaints and incidents. Reportable incidents go to the Commission within 24 hours of key personnel becoming aware, with further information within five business days.
- Make sure workers in certain roles, including key personnel, hold NDIS Worker Screening clearances. That covers every worker in a risk-assessed role: one likely to have more than incidental contact with a person with disability.
- Meet notification requirements. That means telling the Commission about certain changes and events, including changes to your key personnel, events that might affect their suitability, and events that significantly affect your ability to deliver your registered supports.
- Meet quality audit requirements. Your first audit is not your last: certification-pathway providers have a mid-term audit, and every provider is audited again to re-register.
- Meet behaviour support requirements, if they apply to you. That includes reporting the use of regulated restrictive practices to the Commission.
What changed about notifications in 2026?
The Commission’s 2026 amendments to the provider registration rules shorten the time providers have to notify it about certain events and changes, and add a condition on registration where a business changes ownership. The change applies to all registered providers. Check the current timeframes on the Commission’s reform hub, which links the amended rules and an explanatory document, before you rely on an older checklist or template.
Which obligations apply to your business?
Some obligations switch on only for certain supports or arrangements.
If you hold any NDIS registration, the core conditions apply to you, whatever you deliver: the Practice Standards for your supports, the Code of Conduct, complaints and incident systems, worker screening, notifications and audits.
If you deliver specialist behaviour support or use regulated restrictive practices, behaviour support requirements apply. You must be registered to use regulated restrictive practices at all, and the conditions include reporting their use to the Commission.
If you deliver personal supports in registration group 0107 (assistance with daily personal activities) to a participant who lives alone and gets support from one worker only, you must assess the risks to that participant and monitor the quality of the supports and the participant’s satisfaction with them.
If others deliver supports under your registration, through a brokerage or facilitation arrangement, you answer for everything delivered under it. You must make sure they comply with the conditions of registration, including the Code, and that participants know who is responsible for their supports.
If your certificate lists an additional condition, it binds you too. The Commission can impose additional conditions on a registration, and they appear on your certificate of registration and on the NDIS Provider Register.
If you are newly registered, part of your audit may still be ahead of you. New providers may be required to complete the parts of a quality audit that involve participant engagement, within a set timeframe from when they start delivering supports.
If you deliver supported independent living, the new SIL Practice Standards apply to you as well. Our guide to the NDIS Practice Standards modules covers Module 5A alongside the others.
What are your ongoing NDIS compliance obligations?
Ten obligations, sorted by when each one asks something of you.
| Obligation | When it applies | What it asks of you in practice | Where the detail lives |
|---|---|---|---|
| NDIS Practice Standards | Always on | Keep running the policies and procedures you were audited against, and keep them current as the Standards are reviewed | Practice Standards modules |
| NDIS Code of Conduct | Always on | Workers and key personnel act to the Code, and you support them to understand and follow it | Commission’s Code guidance |
| Worker screening | Always on, at every hire | A clearance for every worker in a risk-assessed role, and for key personnel | Commission: About registration |
| Record keeping | Always on | Keep records of supports and payments for the period the 2026 legislation sets | NDIS changes calendar |
| Complaints management | Always on, and when a complaint arrives | A system that puts the person with disability at the centre, and keeps the person who complained informed and involved | Commission: Provider Pack |
| Incident management and reportable incidents | When something happens | Record and manage incidents; notify reportable ones within 24 hours | Reportable incidents guidance |
| Notifying the Commission | When something changes | Key personnel changes, events that affect your ability to deliver, a change of ownership | Commission reform hub |
| Behaviour support and regulated restrictive practices | If it applies to you | Report the use of regulated restrictive practices to the Commission | Commission: About registration |
| Quality audits | On a cycle | Book and prepare for each audit your pathway and registration period set | NDIS audit process |
| Additional conditions | As imposed | Whatever your certificate of registration states | Commission: About registration |
What happens when a registered provider falls behind?
The Commission monitors providers and investigates when there is evidence that laws or standards have not been followed. The NDIS Act gives it powers including compliance notices, banning orders and court-based outcomes. Its enforcement actions are published: as at 24 September 2026, the Commission’s public register held 4,318 enforcement actions against providers and workers, from compliance notices and enforceable undertakings to banning orders, suspension, revocation and refusal to re-register.
The register records the reasons. Recent revocations state that the Commission formed a reasonable belief the provider was not complying with the NDIS Practice Standards, having regard to the outcomes of an audit. If you disagree with a compliance or enforcement decision, you can ask for it to be reviewed.
Complaints are another route in. Anyone can make a complaint to the Commission, and in response it may require a provider to change its complaints management system, bring behaviour support plans up to date or put management staff through training. Threatening a person with disability for making a complaint can itself lead to compliance action, such as an infringement notice.
What if you have a compliance notice or a non-conformity?
Start with the evidence. Our NDIS Pre-Audit Review checks it against the Practice Standards and delivers a written findings report you can build your corrective action response on.
What do providers ask us about their documentation?
More than half of the providers who approach us already hold a registration they obtained in the past, or bought a documentation pack elsewhere, and have never been our clients. Their first question is whether their documentation is up to date, and whether it still meets the current regulations.
It is a fair question in a period of heavy change for the sector. The Commission’s 2026 reforms alone brought mandatory registration for SIL and platform providers, new SIL Practice Standards and amended registration rules, and the Practice Standards themselves are under review. In our experience, a way to receive document updates automatically would take that worry away: the provider would know their documents are always up to date.
Keep your documentation current after registration
If you haven’t updated your documents since the rules changed, or your renewal is coming up, a Platinum package gives you a current, branded documentation set. Each comes with 12 months of Platinum membership, the top tier of Provider Hub. That’s our ongoing NDIS compliance support: documentation updates, plain-English regulatory alerts and audit preparation resources.
Compare the Platinum packages →Common questions about NDIS compliance after registration
Does the NDIS Code of Conduct apply to unregistered providers?
Yes. The Code applies to all providers, key personnel and workers who deliver NDIS supports or services, including unregistered providers and their workers. Commissioner Louise Glanville put it this way in September 2026: “If you or your business claim funds from an NDIS plan to deliver supports or services, the NDIS Code of Conduct applies to you – whether or not you choose to register with the Commission.” For a registered provider, the conditions of registration sit on top of the Code.
If the NDIS Practice Standards change, do I need new documents?
You need updated documents, which is not the same as a new package. You must meet the Practice Standards relevant to the supports you deliver, and the Commission is reviewing those Standards now, alongside the new SIL Practice Standards. Platinum members of Provider Hub get the ongoing documentation updates at no extra cost and can renew their membership for as long as they want.
How do I know when the NDIS rules change and I need to adapt?
The regulatory alerts in Provider Hub tell you in plain English what changed, what it means for your business and what action to take. Our compliance team writes each one, working from what the NDIS Commission publishes, so you can see which changes ask something of you.
