NDIS compliance

What is NDIS compliance?

NDIS compliance means meeting the legal obligations that apply to you as an NDIS provider or worker: the NDIS Act and Rules, the NDIS Code of Conduct, NDIS pricing and claiming rules, and — if you are registered — your conditions of registration, including the NDIS Practice Standards. It is not one certificate or one audit. It is the day-to-day work of delivering supports safely, keeping records that prove it, and telling the right body when something goes wrong.

Two regulators are involved. The NDIS Quality and Safeguards Commission regulates the quality and safety of supports and the conduct of providers and workers. The NDIA runs the scheme and pays claims, so it sets the pricing, claiming and payment rules. Both take compliance action, for different things.

People use "NDIS compliance" in three ways:

• The obligations: what the law and rules require of providers and workers.
• The work: the policies, registers, training and checks a provider runs to meet them, often owned by a compliance or quality manager.
• The regulator's response: the Commission's compliance and enforcement action when a provider falls short.

What NDIS compliance covers

Some obligations apply to every provider and worker, registered or not. Others are conditions of registration that apply only to registered providers (NDIS Commission: about registration).

On top of NDIS law, providers must meet the laws every business does: employment law (including the SCHADS Award where it applies), work health and safety, privacy, consumer law and tax. Registration status doesn't change those.

The Code of Conduct: the floor for everyone

The NDIS Code of Conduct requires people delivering NDIS supports to respect rights, privacy and decision-making; provide supports safely and competently; act with integrity, honesty and transparency; promptly raise and act on concerns about quality and safety; take all reasonable steps to prevent and respond to violence, exploitation, neglect, abuse and sexual misconduct; and not charge or represent higher prices for goods for participants without reasonable justification. Anyone can complain to the Commission about a breach, and it can act against registered and unregistered providers.

How NDIS compliance works for registered providers

For a registered provider, compliance runs in a cycle. You show it at audit, keep it running between audits, and report when things go wrong.

1. Meet the Practice Standards. Your registration groups decide whether you are assessed against the Verification module or the Core module plus supplementary modules (NDIS Practice Standards).
2. Pass your audits. A verification audit or certification audit at registration and renewal, plus a mid-term audit around 18 months in for certification providers (quality audit process).
3. Run the core systems every day: incident management, complaints management, risk management, worker screening and training records.
4. Notify on time. Reportable incidents go to the Commission within set timeframes, and certain changes to your organisation must be notified.
5. Keep records. Incident, complaint, restrictive practice and worker screening records are generally kept for 7 years under the relevant Rules (Incident Management Rules, Complaints Rules).
6. Claim correctly. Claims must match the support delivered, the service agreement and the price limits (NDIS pricing arrangements).

What happens when a provider isn't compliant

Most non-compliance is found at audit and fixed through a corrective action plan: a major non-conformity must be closed within 3 months before registration progresses. Beyond audits, the NDIS Act gives the Commission a range of compliance and enforcement powers, from education and warnings through to formal action.

Penalties increased in 2026. Since 9 April 2026, the civil penalty for breaching a condition of registration — such as failing to notify a reportable incident or keep worker screening records — is up to 250 penalty units, or up to 10,000 penalty units for a serious contravention. The NDIA separately recovers payments that were claimed incorrectly and can refer suspected fraud for investigation.

What compliance means for workers and participants

Compliance is not only a management job. Each support worker is personally bound by the Code of Conduct, and a worker can be the subject of a banning order. In a registered provider, workers in risk-assessed roles need a current NDIS worker screening clearance, and every worker is expected to complete the NDIS Worker Orientation Module. Day to day, a worker's part of compliance is practical: write accurate notes, follow the participant's plans, report incidents and concerns promptly, and never claim time that wasn't worked.

For participants and families, compliance is a safeguard you can use. You can ask a provider whether it is registered and for which groups, check the Commission's public Provider Register, and ask how to make a complaint. If a provider doesn't resolve a concern, or you are worried about someone's safety, you can complain to the NDIS Commission directly.

NDIS compliance vs quality and safeguarding

Compliance is the minimum the law requires. Quality is how well supports meet each participant's goals, and safeguarding is how risks to participants are prevented and responded to. The Practice Standards connect them: an auditor rates you from 0 to 3, where 2 means you conform and 3 means you conform with elements of best practice.

A provider can be technically compliant and still deliver poor support, for example by writing progress notes that tick boxes but never record what the participant wanted. Auditors increasingly look for evidence that systems work in practice, such as residents who know how to complain and incidents that led to real changes.

Common NDIS compliance mistakes

• Policies with no records. A procedure no one follows is a finding, not evidence.
• Treating compliance as an audit-week task. Back-filled notes and same-day signatures are easy for auditors to spot.
• Assuming unregistered means unregulated. The Code of Conduct and price limits still apply.
• Missing notification timeframes for reportable incidents. The free reportable incident checker helps staff decide quickly.
• Letting worker screening lapse. Track expiry dates with the worker screening tracker.
• Claiming outside the service agreement or above the current price limits.
• Delivering supports outside your registration groups, including SIL without group 0138 since 1 July 2026.