For registered NDIS providers, reportable incident notification is one of the most consequential obligations under the NDIS (Incident Management and Reportable Incidents) Rules 2018. Fail to notify, notify late, or misclassify an incident, and you risk regulatory action from the NDIS Quality and Safeguards Commission, up to suspension or cancellation of your registration. This guide sets out what is reportable, the exact timeframes, and how to lodge a notification correctly.
A reportable incident is a specific type of serious incident that has, or is alleged to have, occurred in connection with the provision of NDIS supports or services. There are six categories:
The Commission defines "serious" as something major or lasting, significant enough to require protective action such as emergency service involvement, major medical treatment, hospitalisation or surgery.
An incident is only reportable when it occurs in connection with the delivery of NDIS supports or services. This covers incidents during a shift, on your premises, or that arise from the way a support was, or was not, delivered. The obligation is not limited to incidents caused by your own workers.
The clock starts when your key personnel become aware of a reportable incident or allegation, not when the incident occurred. Key personnel are the people responsible for executive decisions, or who have authority over planning, directing or controlling your organisation. This is why fast internal escalation matters: a delay in your team becoming aware does not pause the deadline.
An Immediate Notification must be lodged within 24 hours of key personnel becoming aware, for:
If some required information is not available within 24 hours, you still lodge the Immediate Notification on time and provide the outstanding details within five business days. The Commission acknowledges receipt of a notification within 24 hours.
The unauthorised use of a restrictive practice that does not cause serious injury must be notified within five business days of key personnel becoming aware.
After the initial notification, you must provide a final report to the Commission within 60 business days. The final report covers any internal or external investigation, your findings, the actions taken to support the impacted person, and what you have changed to prevent a recurrence. The Commission may extend this period on request.
Notifying the NDIS Commission does not replace your other obligations. You must still report crimes to police, meet any mandatory child protection reporting duties, and comply with relevant state or territory requirements.
Reportable incidents are lodged through the NDIS Commission Portal at ndiscommission.gov.au, using the appropriate form: the Immediate Notification, the Five Day Notification, or the Final Report. Each captures the date, time and location, a description of what occurred, the people involved, the immediate actions taken, whether police or emergency services were contacted, and whether the impacted person and their representative have been informed.
The Rules require every registered provider to maintain an incident management system appropriate to your size and the supports you deliver. In practice, a compliant system needs:
Paper and spreadsheet systems make the 24 hour clock dangerous, because an incident written in a notebook on a night shift may not reach a manager for days. A digital incident system timestamps the report the moment it is created, escalates it to the right person automatically, tracks the notification deadlines, and lets you produce a Commission ready record on demand.
CareIQ logs every incident with a timestamped audit trail, escalates it to your management team, and tracks your reportable timeframes, so nothing slips past the 24 hour or five business day deadline. Start your free CareIQ trial, built for Australian care providers.