Implementing provider

What is an implementing provider?

An implementing provider is an NDIS provider whose workers use a regulated restrictive practice, or carry out a behaviour support plan, when delivering supports to a participant. The behaviour support practitioner writes the plan; the implementing provider puts it into practice day to day. Implementing providers that use regulated restrictive practices must be registered with the NDIS Commission.

The term is not defined in NDIS legislation. The NDIS Commission introduced it to separate the provider that develops a behaviour support plan (the specialist behaviour support provider) from the providers that implement it. A participant can have several implementing providers at once, for example a SIL provider, a day program and a respite service, each with its own obligations.

Typical implementing providers include:

• SIL and shared-living providers
• day and community participation programs
• short-term accommodation and respite services
• in-home support and personal care providers
• transport or employment supports where a practice is used

What an implementing provider must do

The obligations come from Part 2 of the NDIS (Restrictive Practices and Behaviour Support) Rules 2018 and Module 2A of the NDIS Practice Standards. Each condition in the Rules is a condition of registration. The Commission's rules for implementing providers summarise them:

1. Don't use prohibited practices. If the state or territory prohibits a practice, the provider must not use it (s8).
2. Get authorisation. Where the state or territory has an authorisation process, use must be authorised (other than a single emergency use), and the provider lodges evidence with the Commission (s9).
3. Use practices only as the plan says, and tell the specialist behaviour support provider when a change in circumstances needs a plan review (s10).
4. Facilitate plans after first use. If a practice is used without a plan and will continue, take all reasonable steps to have an interim plan within 1 month and a comprehensive plan within 6 months (ss11–13).
5. Report every month on use of regulated restrictive practices, or every 2 weeks under a state short-term approval (s14).
6. Keep records of each use for 7 years (s15).
7. Notify reportable incidents, including any unauthorised restrictive practice.

Module 2A adds the practice expectations auditors check: policies for implementing plans, training workers in the plan's strategies and in the safe use of restrictive practices, performance management to confirm strategies are followed, collaboration with other providers, feeding data back to the practitioner, and debriefing after any unauthorised use.

Which rule applies to a given use

Sections 10 to 13 of the Rules cover four situations, and section 16 of the Incident Management and Reportable Incidents Rules decides which uses are reportable incidents. Work out which row you are in before you act:

Reportable uses are notified within 5 business days of key personnel becoming aware, or within 24 hours for any part involving serious injury, abuse or neglect. The free reportable incident checker works out the dates.

Implementing provider vs specialist behaviour support provider

The roles meet at two points. First, the plan: the implementing provider supports the practitioner to gather information for the functional behavioural assessment and contributes to reviews. Second, the deadlines: the implementing provider's 1-month and 6-month clocks run from first use, while the practitioner's run from when they are engaged. Engaging a behaviour support practitioner late leaves them little time.

Registration and audit

The Commission says providers that implement regulated restrictive practices must be registered, and are assessed against Module 2A through a certification audit. According to the Commission's registration requirements guidance, they register for the type of support they provide and do not need to register for specialist behaviour support. An unregistered provider cannot lawfully take on this role.

Using contractors does not move the responsibility. The Commission's February 2026 position statement says a registered provider that engages contractors to deliver supports involving regulated restrictive practices remains responsible at all times for compliance with the Rules and Module 2A.

The stakes rose in 2026. Since the Integrity and Safeguarding Act 2026 took effect in April 2026, breaching a condition of registration can attract a civil penalty of up to 250 penalty units, or up to 10,000 penalty units for a serious contravention.

State and territory differences

The implementing provider is the party that seeks authorisation, and the process depends on where the participant receives supports. The pattern, from the 2025 national frameworks summary: provider-convened panels in NSW and WA; Authorised Program Officers within providers in Victoria and South Australia, with a Senior Practitioner or Senior Authorising Officer for higher-risk practices; guardians, the department and QCAT in Queensland; and a Senior Practitioner in Tasmania and the NT, with the ACT Senior Practitioner registering panel-approved plans. Authorisations are usually time-limited, so track expiry dates.

Common mistakes

• Thinking the practitioner handles compliance. Authorisation evidence, monthly reports, records and incident notifications are the implementing provider's job.
• Not activating the plan in the portal, so monthly reporting can't happen against it.
• Rostering untrained staff, including relief and agency workers, to support someone with a restrictive practice protocol.
• Each provider assuming another one reported. Every implementing provider reports its own use.
• Missing nil months. Months with no use still need a report.

The free restrictive practice checker builds an obligation timeline from the date of first use.