NDIS Reportable Incidents: The 24 Hour and 5 Business Day Rules Explained

A reportable incident is one of six categories of serious event that a registered NDIS provider must notify to the NDIS Quality and Safeguards Commission under the National Disability Insurance Scheme (Incident Management and Reportable Incidents) Rules 2018. Death, serious injury, abuse or neglect, unlawful sexual or physical contact or assault, and sexual misconduct must be notified within 24 hours of the provider becoming aware, with a fuller report within 5 business days. Use of an unauthorised restrictive practice must be notified within 5 business days, or 24 hours if it caused harm. The clock runs from when key personnel become aware, not from when the incident happened.

This is general information current at September 2026. Confirm your position against the current Rules on the Federal Register of Legislation, the NDIS Commission's reportable incidents guidance, and your state or territory laws on mandatory reporting, work health and safety and restrictive practices.

What counts as a reportable incident

Section 73Z(4) of the National Disability Insurance Scheme Act 2013 defines a reportable incident as any of the following, occurring in connection with the provision of supports or services by a registered NDIS provider:

• the death of a person with disability
• serious injury of a person with disability
• abuse or neglect of a person with disability
• unlawful sexual or physical contact with, or assault of, a person with disability
• sexual misconduct committed against, or in the presence of, a person with disability, including grooming for sexual activity
• the use of a restrictive practice in relation to a person with disability, other than where the use is in accordance with a state or territory authorisation.

Three refinements matter. Alleged reportable incidents are reportable incidents: you notify on the allegation, not after proving it. Unlawful physical contact with negligible contact and impact is excluded. And an authorised restrictive practice is still reportable if used outside the behaviour support plan, while use in line with the plan in a jurisdiction with no authorisation process is not reportable. See our guide on restrictive practice authorisation by state and territory.

The timeframes

Within 24 hours

Death, serious injury, abuse or neglect, unlawful sexual or physical contact or assault, and sexual misconduct must be notified within 24 hours of the provider becoming aware. The first notification may be by telephone or in writing and covers who you are, what happened, the impact, the immediate actions taken (including any police report) and the people involved. If you do not yet have everything, give the core details within 24 hours and the rest within 5 business days. The Commission's portal calls this the immediate notification.

The 5 business day follow-up report

Every 24 hour notification must be followed by a written report within 5 business days of becoming aware, covering witnesses, further actions proposed and anything left out of the first notification. The Commission's portal calls this the 5 day notification form.

Within 5 business days: unauthorised restrictive practice

Use of a restrictive practice without the required state or territory authorisation, or outside the behaviour support plan, must be notified in writing, complete, within 5 business days of becoming aware. The Commission's guidance is that if the use resulted in harm, notify within 24 hours, because it then also falls within a 24 hour category.

After the notification, and how to count

Significant new information, such as a change in the kind of incident or a further reportable incident, must be reported as soon as reasonably practicable. The Commissioner may require a final report within 60 business days, remedial action or an investigation. Records are kept for 7 years. Our records guide explains when the seven years starts for a reportable incident, which is a different date from an ordinary incident record. Business days exclude weekends and public holidays. The periods run from when the provider became aware; workers must tell key personnel, a supervisor or the nominated contact as soon as possible, and the Commission expresses the timeframe as running from key personnel becoming aware.

Who has to report

Registered NDIS providers

The duty sits with registered NDIS providers, whether registered through certification or verification, including sole traders on the verification pathway. Key personnel and the nominated contact must take all reasonable steps to ensure notifications are made, and non-compliance is a breach of a condition of registration.

Unregistered providers and independent support workers

Unregistered providers, including independent support workers who are not registered, are not required by the Rules to notify reportable incidents to the Commission. That does not mean nothing applies. The NDIS Code of Conduct binds every NDIS provider and worker, registered or not, and requires all reasonable steps to prevent and respond to violence, exploitation, neglect, abuse and sexual misconduct. In practice that means a written way to record and manage incidents, and informing the participant and their representative. Separate duties may apply: police where a crime may have occurred, child protection mandatory reporting, the work health and safety regulator, and state safeguarding or restrictive practice schemes.

The NDIS Act and the Rules as in force at September 2026 do not extend the duty to unregistered providers. Providers that must now register, such as supported independent living providers from 1 July 2026, take on the duty once registered.

What your incident management system must do

Section 73Y of the Act requires every registered provider to maintain an incident management system appropriate to its size and supports; Part 2 of the Rules sets the content. The Practice Standards outcome, in both the Core and Verification Modules, is that incidents are acknowledged, responded to, well managed and learned from. The system must:

• Cover the right incidents: anything connected with supports that has, or could have, caused harm to a participant; acts by a participant causing serious harm or risk of serious harm to another person; and alleged reportable incidents.
• Identify and record: say how incidents are identified, recorded and reported, and to whom, and keep the minimum record the Rules list for each incident for 7 years.
• Manage: name the person responsible for notifying the Commission, say how affected participants will be supported (including access to advocates) and involved in resolution, and afford procedural fairness.
• Resolve and review: assess every incident for whether it could have been prevented, how well it was managed, what remedial action is needed and whether anyone else must be notified, considering the participant's views.
• Report: route reportable incidents into the Part 3 process and collect statistics so systemic issues can be identified.
• Train and share: set worker roles, provide training, give the documented system in accessible form to participants, workers and families, and review it periodically.

Incident, reportable incident, complaint, notifiable WHS incident

An incident is any act, omission, event or circumstance connected with your supports that caused or could have caused harm to a participant, or in which a participant caused serious harm or risk of serious harm to someone else; it is handled internally. A reportable incident is the subset in the six categories above, which must also be notified to the Commission. A complaint is an expression of dissatisfaction handled under the Complaints Management and Resolution Rules; one event can be both. A notifiable incident under work health and safety law is a death, serious injury or illness, or dangerous incident at a workplace, notified immediately to the state or territory WHS regulator regardless of NDIS registration (Victoria has its own OHS scheme).

A practical sequence when something happens

1. Make everyone safe: call 000 where needed, give first aid, get medical attention.
2. Where a crime may have occurred, contact police and preserve evidence.
3. Tell key personnel or the nominated contact straight away and record the time; this starts the clock.
4. Decide whether it is reportable and which category applies. Alleged incidents count; if in doubt, work to 24 hours.
5. Support the participant: explain what is happening, involve their representative, offer an advocate and arrange follow-up care.
6. Record it in your register with the minimum details the Rules require.
7. Notify the Commission through the portal: immediate notification within 24 hours, or the 5 business day notification for an unauthorised restrictive practice.
8. Consider other notifications: WHS regulator, child protection, state authorisation body, insurer.
9. Submit the 5 business day report and update the Commission on significant new information.
10. Investigate, complete the assessment, take corrective action and close the record.

Common mistakes

• Starting the clock when management decides it is reportable, rather than when key personnel became aware.
• Treating "no injury" as "not reportable": abuse, neglect, unlawful contact and sexual misconduct are reportable with or without injury.
• Missing unauthorised restrictive practices: a locked cupboard, PRN medication used to manage behaviour, or a practice in the plan but not authorised.
• Waiting for the internal investigation, or for every detail, before notifying an allegation.
• Forgetting the 5 business day follow-up after a 24 hour notification, or having no delegate when the nominated contact is on leave.

Templates that support this work

The incident management templates in the MRSS NDIS Provider Core Library follow Parts 2 and 3 of the Rules. The Incident Management Policy and Procedure sets out the system, the NDIS Reportable Incidents Process Guide covers the 24 hour and 5 business day decisions, the NDIS Reportable Incident Notification Form captures what the Commission asks for, the Incident Register holds the minimum record, and the Incident Root Cause Analysis Tool supports the review step. Sole traders on the verification pathway can use the Incident Management Procedure (ISW version), included in the Independent Support Worker Verification Pack.

These are editable Word files with a version control table and approval block. They are a starting point: customise them, train your workers and keep the register, notifications and reviews as evidence. Audit outcomes depend on what you actually do, not on the documents alone.

Frequently asked questions

Does the 24 hours start when the incident happened?

No. The 24 hour and 5 business day periods run from when the registered provider became aware that a reportable incident occurred, which the NDIS Commission's guidance frames as key personnel becoming aware. A worker who becomes aware must tell key personnel, a supervisor or the nominated reportable incidents contact as soon as possible, so the internal delay should be hours, not days. Record the time key personnel were told.

Do unregistered providers and independent support workers have to notify the NDIS Commission of reportable incidents?

No. The reportable incident notification duty in the Rules applies to registered NDIS providers. An unregistered provider or sole trader is still bound by the NDIS Code of Conduct, which requires reasonable steps to prevent and respond to violence, exploitation, neglect, abuse and sexual misconduct, and may have separate duties to police, child protection authorities, the WHS regulator or state bodies. Anyone can complain to the Commission about an unregistered provider.

What if I am not sure whether an incident is reportable?

Treat alleged incidents as reportable. The Rules say a reference to a reportable incident includes one alleged to have occurred, so you do not wait for your own investigation to finish. If the category is unclear, work to the 24 hour timeframe, give the Commission the minimum information you have, and complete the rest within 5 business days. Notifying and later clarifying is better than missing the deadline.

Is every use of a restrictive practice a reportable incident?

No. A restrictive practice used in accordance with a state or territory authorisation and the participant's behaviour support plan is not a reportable incident, although registered implementing providers still report its use to the Commission monthly. It becomes reportable when used without the required authorisation, or with authorisation but outside the behaviour support plan. In a jurisdiction with no authorisation process, use in line with the plan is not reportable.

Sources: National Disability Insurance Scheme (Incident Management and Reportable Incidents) Rules 2018, Parts 2 and 3; National Disability Insurance Scheme Act 2013, sections 73V, 73Y and 73Z (compilation as at 27 August 2026); National Disability Insurance Scheme (Code of Conduct) Rules 2018, sections 5 and 6; National Disability Insurance Scheme (Provider Registration and Practice Standards) Rules 2018, Core Module section 14 and Verification Module section 5 (compilation as at 1 July 2026); Acts Interpretation Act 1901, definition of business day; NDIS Quality and Safeguards Commission portal quick reference guides (Create an Immediate Notification; Complete the 5 day notification form) and reportable incidents guidance; SafeWork NSW and WorkSafe Victoria incident notification guidance; all accessed September 2026.