NDIS Reportable Incidents: The 5 Categories, 24-Hour Rule & Provider Reporting Workflow
Compliance
7 August 2026
NDIS reportable incidents explained: the 5 priority categories, 24-hour rule, reporting workflow, and the compliance risks providers need to avoid.
Every registered NDIS provider will face a reportable incident at some point. When that moment arrives, the clock starts, and the margin for error is narrow. Understanding exactly which events qualify as NDIS reportable incidents, which timeframe applies, and what your workflow needs to look like is the difference between a compliant response and a breach that lands on the NDIS Commission's public register.
Here's what the rules say, and what a reliable reporting process looks like in practice.
Key Insights
There are six categories of NDIS reportable incidents. Five are "priority" categories requiring notification within 24 hours. The sixth (unauthorised restrictive practices) generally allows 5 business days.
The 24-hour clock starts when the provider (or a manager) becomes aware of the incident, not when it occurred.
An initial notification is followed by a more detailed follow-up report within 5 business days.
All reportable incident notifications are submitted through the My NDIS Provider Portal.
Failing to report within the required timeframe can result in infringement notices, compliance investigations, and enforcement action by the NDIS Commission.
What Are NDIS Reportable Incidents?
A reportable incident is an act or event that has occurred, or is alleged to have occurred, in connection with the delivery of NDIS support or services. Registered NDIS providers must notify the NDIS Commission of all reportable incidents, including those already recorded and responded to within their own internal incident management system.
The critical phrase here is in connection with. Reportable incidents are not limited to events that occur during direct service delivery. They include incidents that occur in connection with the provision of NDIS supports, even if they happen outside a provider's premises or outside business hours.
Not every incident is reportable. Providers must still record all incidents internally, but the obligation to notify the NDIS Commission is triggered only when an event falls into one of the defined categories below.
The 5 Priority Categories of NDIS Reportable Incidents
The NDIS (Incident Management and Reportable Incidents) Rules 2018 define reportable incidents across six categories. The first five are classified as priority incidents, triggering a 24-hour notification obligation.
1. Death of a Participant
Any death of a participant in connection with the delivery of NDIS supports must be reported. This includes deaths from natural causes if they occur while supports are being delivered or in a supported independent living arrangement.
2. Serious Injury of a Participant
A serious injury is one that results in hospitalisation, requires medical treatment, causes ongoing pain or disability, or creates a reasonable likelihood of serious long-term effects. Providers should not wait for a formal medical assessment before reporting. If the injury appears to meet the threshold, notify first.
3. Abuse or Neglect of a Participant
Abuse encompasses physical, psychological, emotional, and sexual abuse. Neglect includes failure to provide adequate care, supervision, or support that results in harm to the participant.
4. Unlawful Sexual or Physical Contact or Assault
Any unlawful sexual or physical contact with, or assault of, a participant connected to the delivery of support. This includes alleged incidents, not only those that have been confirmed.
5. Sexual Misconduct
Sexual misconduct committed against, or in the presence of, a participant, including the grooming of a participant for sexual activity.
The Sixth Category: Unauthorised Restrictive Practices
Unauthorised restrictive practices are reportable incidents and must be reported to the NDIS Commission within 5 business days of the provider becoming aware of the incident. The rules around this category are more complex, depending on state or territory authorisation arrangements and whether a behaviour support plan is in place. If the use of a restrictive practice also results in serious injury to the participant, it falls under the serious injury category, and the 24-hour timeframe applies.
The 24-Hour Rule Explained
The NDIS Commission's reporting requirements establish two tiers of timeframes. The five most serious categories of reportable incidents must be reported to the Commission within 24 hours of the registered provider becoming aware of the incident. The clock starts when the provider (or a person in a managerial role) becomes aware, not when the incident occurred.
An incident may have occurred overnight. If a manager is notified at 8am, the 24-hour window opens at 8am, not at the time of the incident.
Providers often make the mistake of applying subjective judgment to whether an event is "serious enough" to report. The legislation does not allow for that discretion. If an event falls within one of the six categories, it must be reported. When in doubt, report. An incident notification that turns out to be unnecessary carries no penalty. A missed notification does.
The Provider Reporting Workflow
NDIS Commission reportable incidents follow a two-stage notification process.
Stage 1 – Initial Notification (within 24 hours or 5 business days)
Complete and submit the initial notification form within the specified timeframe. In most cases, this is within 24 hours of becoming aware of a reportable incident. This is a preliminary notification and captures the basic facts of what occurred. It does not require a completed investigation.
All notifications are submitted through the My NDIS Provider Portal at provider.ndis.gov.au, using the incident notification section. Providers select the incident category, enter the required information, and submit.
Stage 2 – Follow-Up Report (within 5 business days)
Submit the follow-up form within five business days of becoming aware of a reportable incident. This is where you provide additional information and detail the actions you've taken. If your internal investigation is not yet complete, submit what you have, note that the investigation is ongoing, and include a revised completion date.
Stage 3 – Internal Review and Documentation
In addition to the Commission's notification requirements, providers must maintain a robust internal incident management system. This includes documenting the incident, the immediate response, staff actions, corrective measures, and any follow-up with the participant and their support network. This internal record is what auditors will scrutinise, and gaps here are as damaging as late notifications.
Where Providers Come Unstuck
Compliance risks in NDIS reportable incident reporting tend to cluster around a few consistent patterns.
Delayed awareness reaching management. The 24-hour clock starts when management becomes aware, but if your internal escalation process is slow or unclear, that window can close before anyone has submitted the notification. Frontline workers must know exactly who to notify, and how quickly.
Miscategorisation. Subjectively assessing severity is one of the most common failure points. If an injury might be serious, treat it as serious. You can always update the record; you can't undo a missed notification.
Incomplete follow-up reports. The initial 24-hour notification is only half the obligation. Many providers submit the initial report but don't follow up with adequate 5-business-day notice, particularly for complex incidents where the investigation is still ongoing.
Documentation that doesn't tell the story. The Commission doesn't just assess whether you reported; it assesses whether your response was appropriate. Vague or templated documentation signals to auditors that your incident management culture is weak, even if the notification was technically on time. You can learn more about what surveyors look for during an audit and what they assess beyond the paperwork.
What Non-Compliance Looks Like in Practice
The NDIS Commission's enforcement posture has hardened considerably. In 2023–24, the Commission issued a record $4 million in fines and penalties and actioned more than 1,300 matters involving serious harm to participants.
Providers failing to report NDIS Commission reportable incidents within the 24-hour timeframe face infringement notices, compliance investigations, and in serious cases, Federal Court proceedings. The Federal Court has ordered providers to pay penalties exceeding $2 million in relation to the deaths of NDIS participants. Compliance actions are also published publicly, visible to participants, families, and potential contracting partners.
For providers managing any volume of incidents, the administrative burden of manual reporting processes compounds these risks. Missed notifications frequently stem not from a lack of awareness but from process failures. Incident reporting automation addresses this at the workflow level, reducing the gap between awareness and submission.
Making NDIS Incident Reporting More Manageable
Consistent, compliant reportable incidents NDIS reporting comes down to three things: clear escalation pathways, accurate categorisation, and documentation that holds up under scrutiny.
Providers who rely on spreadsheets and email chains to manage this process are operating without a safety net. Purpose-built incident management software structures the workflow from notification to follow-up, time-stamps every action, and ensures nothing falls through the gaps between a frontline incident and a Commission submission.
For NDIS providers navigating the full scope of compliance obligations (from restrictive practices compliance through to audit readiness), NDIS compliance software from Willow consolidates obligations into a single, auditable system. And if you're working through your broader compliance framework, the NDIS Practice Standards checklist is a useful reference point for where incident management sits within the wider standards picture.
The reporting requirements aren't going away, and the Commission's enforcement activity is only increasing. Getting your incident management process right isn't just about avoiding penalties. It's about being the kind of provider that responds well when something goes wrong.
Written by
James Driscoll
Writer
Community Manager for Willow , heywillow.ai. Helping healthcare, aged care, and NDIS providers ditch the compliance spreadsheets for AI-powered intelligence.
Latest Articles & Guides
Stay informed with the latest guides and news.
Ready to Move From Reactive to Continuous Compliance?
See how Willow supports structured governance, real-time monitoring, and audit-ready operations.