NDIS penalties explained - what providers actually risk in 2026.

What counts as a contravention

Contraventions fall into four practical categories. They overlap - a single incident can sit in more than one - and the Commission is not constrained to charge under just one section. Detail on each row links to the relevant resource entry in our Group F cluster.

• Worker screening and conduct

  Using an unscreened worker, failing to verify a current NDIS Worker Screening, or breaching the NDIS Code of Conduct. The most common contravention surfaced at audit.

  • Active worker without a current NDIS Worker Screening clearance
  • WWCC expired between application and audit, worker still on shift
  • Code of Conduct breach not investigated within the required timeframe
• Reportable incidents

  Failure to notify the Commission of a reportable incident within the prescribed window - five business days for most categories, 24 hours for serious harm.

  • Death or serious injury of a participant not notified within 24 hours
  • Use of a restrictive practice not authorised under a behaviour support plan
  • Allegations of abuse, neglect or sexual misconduct not escalated
• Registration conditions

  Operating outside the registration groups granted, delivering supports without a Practice Standards-aligned system, or failing to maintain conditions imposed at certification.

  • Delivering SIL services without the SIL registration group
  • Failure to maintain audit cycle (no mid-cycle surveillance evidence)
  • Breach of a specific condition placed on the registration at decision
• Quality and Safeguards obligations

  Not meeting the Practice Standards in practice. Most common at certification re-audits and after a complaint-triggered compliance review.

  • No live continuous-improvement register supported by evidence
  • Risk and emergency plans systematically older than 12 months
  • Complaint process exists on paper but no closure or notification trail

Deep-dive resources on each contravention type ship over the next seven days - see How much is an NDIS provider fine?, Reportable incident requirements and The full civil penalties schedule.

The investigation process

Most contraventions surface through one of two paths: a complaint to the Commission or a reportable incident. Either trigger can land outside the scheduled audit cycle. Once an investigation opens, the response window - and the quality of the response - often matters more than the underlying conduct.

1. Step 1

   Trigger

   A complaint to the NDIS Commission, a reportable incident, audit finding referral, or a market-monitoring signal. The Commission is not required to give advance notice before opening an investigation.

2. Step 2

   Notice and information request

   The Commission issues a notice under section 55A of the NDIS Act requiring documents, records or attendance. Response windows are typically 14–28 days. Ignoring or partially complying is itself a contravention.

3. Step 3

   Investigation

   Investigators review evidence, interview workers, participants and management, and may request follow-up information. Typical duration ranges from a few weeks (single incident) to several months (systemic concerns).

4. Step 4

   Finding

   The Commission can issue a compliance notice, an infringement notice, a banning order, an enforceable undertaking, suspend or revoke the registration, or apply to the Federal Court for civil penalty orders.

5. Step 5

   Remedy or penalty

   Civil penalty proceedings happen in the Federal Court. Banning orders and registration variations are administrative - appeal lies with the Administrative Review Tribunal. Public outcomes are published on the Commission register.

Deeper detail in The NDIS Commission complaint process and Investigation timelines.

How providers reduce risk

The pattern across every published enforcement action is the same: the underlying conduct is rarely a single catastrophic event. It is a slow accumulation of small lapses that an audit or a complaint eventually surfaces. The same pattern in reverse is the mitigation - continuous, evidence-backed compliance is far cheaper than a corrective-action sprint after a notice.

Once an information notice arrives, the controllable surface shrinks. The day before the notice, the controllable surface is almost everything. The trade is to invest a small ongoing effort in the controllable side, in exchange for losing the panic-sprint on the day a notice arrives.

Frequently asked questions

These are the questions providers most often search ahead of an audit or a Commission notice. Each one is also the seed for a standalone resource entry in our Group F cluster - published over the seven days following this guide.