NDIS Reportable Incidents: The 24-Hour and 5-Day Rules

The short version

If you're a registered NDIS provider, three things decide whether you get reportable incidents right:

• Six kinds of incident are reportable. Death, serious injury, abuse or neglect, unlawful sexual or physical contact or assault, sexual misconduct, and a restrictive practice used without authorisation or outside a behaviour support plan. Allegations count too.
• Two clocks. The first five types go to the NDIS Commission within 24 hours, followed by a 5-day form. An unauthorised restrictive practice that hurt no one only needs the 5-day form, within 5 business days.
• The clock starts early. It runs from when your organisation becomes aware, which in practice is when a worker tells a supervisor, a manager or key personnel. Not when the paperwork reaches the boss.

The law is the NDIS (Incident Management and Reportable Incidents) Rules 2018. Where the Commission's guidance differs, we say so and go with the Rules. This is general information, not legal advice. If you're unsure, the Commission says you can ask it (Reportable incidents guidance).

What counts as a reportable incident

The NDIS Act lists six kinds of reportable incident, and section 16 of the Rules fine-tunes them (Incident Management Rules, s 16). The Commission's timeframes for each (NDIS Commission, Reportable incidents):

Two conditions have to be met. The incident has to be one of those six, and it has to have happened, or be alleged to have happened, "in connection with" supports or services from a registered provider (Reportable incidents guidance).

The fine print

• Allegations count. A reportable incident includes one that is only alleged to have happened (s 17). You report it even if you think you handled it well (Incident Management Rules; guidance).
• Negligible contact is out. Unlawful physical contact isn't reportable if the contact with, and impact on, the person is negligible (s 16(2)).
• Authorised isn't enough. A restrictive practice that the state or territory has authorised is still reportable if it isn't used in line with the person's behaviour support plan (s 16(3)). That includes having no plan, or a practice missing from the plan or used against it (guidance).
• One exception. Where a state or territory has no authorisation process for that practice, and it's used in line with the behaviour support plan, it isn't reportable (s 16(4)).
• Emergency use counts. The guidance says emergency use of a restrictive practice without authorisation must be notified (guidance).

"In connection with" is broad

The Commission says it covers incidents during a service, arising from providing, changing or withdrawing it, or traced back to it later. You don't need to decide your service caused it before you report (guidance).

A speech pathologist's eating and drinking plan can be connected to a later choking injury. A roof tile falling on someone leaving a physio appointment is not. In supported accommodation, most reportable incidents in the house will be connected, because the provider is usually responsible for residents' safety.

What "serious injury" means

The guidance lists fractures, burns, deep cuts, extensive bruising (one large bruise or several small ones), head or brain injuries such as concussion or loss of consciousness, and any other injury needing hospitalisation. Presenting at an emergency department for the injury counts as hospitalisation (guidance).

Abuse and neglect

The guidance covers physical, emotional, financial and systemic abuse, and neglect such as grossly inadequate care, failure to get medical care and supervisory neglect. Repeated small incidents can add up to a pattern of abuse, which your system must be able to spot and report as one incident (guidance).

Low-level negative interactions between participants aren't reportable. Handle them through your own incident management.

Who has to report

Registered providers. The duty to notify the Commission sits with registered NDIS providers. Key personnel, and the person your system names as responsible for notifying, must take all reasonable steps to make sure it happens (s 18). Workers must tell key personnel, their supervisor or manager, or that named person as soon as possible (s 19) (Incident Management Rules).

Unregistered providers. The Rules don't require you to notify reportable incidents. But the Commission says all NDIS providers should have an incident management system, and that the NDIS Code of Conduct requires all providers to respond to incidents (NDIS Commission, Incident management). Registered or not, you have to follow the Code (NDIS Commission, Mandatory registration).

Anyone using regulated restrictive practices has to be registered in the first place (NDIS Commission, SIL transition pathways).

When it's another provider's incident. If you see an incident that isn't connected to your own service, such as another provider's worker mistreating a participant, the guidance says to raise it with the Commission's reportable incidents team by phone or email as "provider non-reporting", not as a reportable incident (guidance).

Reporting to the Commission doesn't replace telling police, child protection or a coroner where other laws require it.

When the clock starts

The Rules count from when the provider "becomes aware" (ss 20 and 21). The guidance says a provider is assumed to be aware once a worker has told key personnel, a supervisor or manager, or the person named in your system (guidance). So a team leader hearing about it on a Friday night starts the clock.

The 24 hours are real hours, weekends included. The Rules set the other deadlines in business days. Under the Acts Interpretation Act, a business day is a day that isn't a Saturday, Sunday or public holiday in the place concerned (Acts Interpretation Act 1901, s 2B).

Sources: Incident Management Rules, ss 20, 21, 23, 24; NDIS Commission, Reportable incidents.

Miss them and the Commission says you may get an infringement notice or other compliance action (NDIS Commission, Reportable incidents). Failing to comply with the Rules is a breach of your conditions of registration (Incident Management Rules, s 15).

What goes in each form

Immediate notification (24 hours)

Section 20(2) of the Rules requires (Incident Management Rules):

1. Your organisation's name and contact details.
2. A description of the incident.
3. The impact on, or harm caused to, the person (not needed for a death).
4. Immediate actions taken, including to keep the person safe, and whether it's been reported to police or another body.
5. The name and contact details of the person notifying.
6. If known, the time, date and place.
7. The names and contact details of the people involved.
8. Anything else the Commission requires.

If you can't get everything inside 24 hours, items 1 to 5 must still go in on time, and the rest within 5 business days (s 20(3)). The guidance adds that "people involved" includes the participant affected and anyone who is the subject of an allegation.

The 5-day form

For incidents already notified within 24 hours, the Rules require the names and contact details of witnesses and any further actions you plan to take, within 5 business days (s 20(4)). For an unauthorised restrictive practice, the 5-day form is the whole notification and has to cover all the details in section 21(3) (Incident Management Rules).

The guidance says the form also asks for the participant's support person, the subject of any allegation, support and action planned for both, and your risk processes. Attach incident reports, file notes, risk assessments, the behaviour support plan and correspondence (guidance).

Final report

The Commission may require a final report within 60 business days (s 24). It covers any internal or external investigation: who ran it and their position, when, the findings, corrective action taken, a copy of the investigation report, and whether the participant or their representative has been kept informed (Incident Management Rules).

The Commission can also refer the incident to another body, require remedial action, require an internal investigation, or make you pay for an independent expert to investigate (s 26).

Updates and holding information back

If you learn something significant after notifying, and it changes the kind of incident or reveals a further incident, tell the Commission in writing as soon as reasonably practicable (s 23). The guidance says you can upload it to the notification or email incidentintake@ndiscommission.gov.au.

You don't have to gather or give certain details if doing so would prejudice a criminal investigation or put a person with disability at risk of harm. You still notify (s 22).

How to lodge: the Commission portal

Today you log in to the NDIS Commission Portal, go to "My Reportable Incidents", and submit the Immediate Notification Form and then the 5 Day Form (NDIS Commission, Reportable incidents). Help is on incidentintake@ndiscommission.gov.au or 1800 035 544 (guidance).

A new portal is coming. The Commission says it is "expected to be available in October 2026", and during the transition you'll use both portals depending on the task. Incident forms will ask questions by incident category, drafts save for up to 30 days, many free-text fields become tick boxes, and third-party reports get their own form (NDIS Commission, What's changing in the new portal). Saving a draft won't stop the clock.

Incident management systems

Registered providers must keep an incident management system that suits their size and the supports they deliver (Incident Management Rules, s 8). Under sections 9 to 13 it has to:

• cover incidents that harmed or could have harmed a participant, a participant's acts that seriously harmed someone else or risked it, and alleged reportable incidents
• set out how incidents are identified, recorded and reported, who they're reported to, and who notifies the Commission
• say how affected participants are supported (including access to advocates) and involved in resolving it
• say when you investigate and when corrective action is needed
• assess every incident: was it preventable, how well was it handled, what stops a repeat, who else needs telling
• give people procedural fairness
• be documented, given in an accessible form to participants, workers and families, and reviewed periodically
• record set details for each incident, including whether it's reportable, kept for 7 years
• collect statistics to spot systemic issues, and train workers to follow it

Unregistered providers should have one too, says the Commission. Its Incident Management Systems: Detailed Guidance for Registered NDIS Providers (PDF) is written for registered providers but it says it's useful for unregistered ones (NDIS Commission, Incident management).

What changed in 2025 and 2026

Confirmed:

• The Rules themselves haven't changed. The Federal Register lists no amendments to the 2018 Rules as at 2 October 2026 (Federal Register of Legislation, F2018L00633).
• SIL and digital platform providers must now register. Announced in December 2025, from 1 July 2026. They take on the same requirements as other registered providers, including managing incidents (NDIS Commission, Mandatory registration). Unregistered SIL providers had to apply by 1 October 2026 to keep delivering during assessment (SIL unregistered pathway). Once registered, reportable incident duties apply.
• The Commission republished its reportable incidents guidance in February 2026, though the cover still says June 2019 (NDIS Commission, Reportable incidents).
• The new portal, expected October 2026 (above).

Announced, not yet in force:

• Mandatory registration for providers of higher-risk supports such as personal care, daily living and supports in closed settings, rolling out from 1 July 2027, with everyone in scope registered by December 2030. The list of high-risk supports hasn't been published yet (DHDA, About the changes to the NDIS). If that catches you, reportable incident duties come with it.

Where the sources disagree

• Restrictive practice with harm. The Commission's web page says an unauthorised restrictive practice that "resulted in harm" goes in within 24 hours. The guidance mostly says "serious injury". The Rules put restrictive practices on the 5-day track, but a harmful one will often also be a serious injury, abuse or assault, which is on the 24-hour track. Our advice: if anyone was hurt, notify within 24 hours.
• Phone or portal. The Rules let the 24-hour notification be given by phone or in writing (s 20(5)). The guidance says notifications "must be made via the registered provider portal". Use the portal. If it's down, ring and email, then lodge the form.
• Whose awareness. The guidance overview says 24 hours from "key personnel becoming aware". The Rules say the provider, and the guidance's own Part 4 treats the provider as aware once a worker tells a supervisor or manager. Plan for the earlier one.
• Final report clock. The guidance says 60 business days "following the initial notification". The Rules count from the 5-day notification. Aim for the earlier date.

Worked examples

All people and providers here are made up.

A fall on a Friday night

Kirra lives in a registered provider's SIL house. At 7pm on Friday 9 October 2026 she falls in the bathroom and is taken to hospital with a broken wrist. The worker rings the house team leader at 7.10pm.

• Serious injury, so it's 24-hour reportable. The clock started at 7.10pm Friday.
• Immediate notification by 7.10pm Saturday 10 October. Weekends don't stop it.
• 5-day form with witnesses and planned actions: five business days after Friday is Friday 16 October, assuming no public holiday.

A locked pantry

Liam's behaviour support plan has no environmental restraints. A new worker locks the pantry to stop him snacking before dinner. Nobody is hurt.

• An unauthorised restrictive practice with no harm. Only the 5-day form is needed, within 5 business days, with all the details in section 21(3).
• Then fix the cause: training, and a plan review with his behaviour support practitioner.

Bruises nobody can explain

During personal care, a worker notices large bruises on Mei's upper arms. Mei can't say how they happened.

• The Commission treats unexplained bruising as possible abuse or neglect (NDIS Commission, Incident management). That's 24-hour reportable, even though nothing is proven.
• Don't interview anyone accused. The guidance says workers should write down what they saw and heard, in the person's own words where they can, without opinions.

Housemates who don't get on

Two housemates, Sam and Josh, sometimes pinch each other when they're frustrated. No one is injured.

• On the guidance's own example, this is a low-level negative interaction, not reportable. Record it and deal with it internally, and reassess if it escalates.

Checklist

1. Name the person who notifies the Commission, and a backup for nights and weekends.
2. Tell workers to report to a supervisor or manager as soon as possible. That starts the clock.
3. Keep the six types and the two clocks on one page every team leader can see.
4. Check your notifier can log in to the portal, old and new.
5. Get the 24-hour minimum in: your details, what happened, the harm, immediate actions and who's notifying.
6. Lodge the 5-day form every time, with witnesses, planned actions and supporting documents.
7. Record every incident, reportable or not, and keep records for 7 years.
8. Assess and investigate, involve the participant, and keep them informed.
9. Check your restrictive practices against the authorisation and the behaviour support plan, line by line.
10. Review the system periodically and look for patterns across incidents.

If incident reports live in paper forms and inboxes, the clock gets away from you. In Orangised, workers file incident and ABC reports from the shift in the app, with a body map, and admins get an email and an in-app alert the moment one comes in. Every report lands in the incident register, where the office records whether it's notifiable, who needs telling and the investigation before publishing it. Lodging with the Commission still happens in the Commission's own portal.