Skip to main content
All articles
NDIS2 min read21 March 2026

NDIS reportable incidents: categories, timelines, and what your software must do

Reviewed 4 October 2026 against current source guidance.

On this page

Which incidents are reportable

Registered NDIS providers need an incident management system and must notify the NDIS Commission when an incident falls within a reportable category. The Commission lists six categories:

  • Death of a person with disability
  • Serious injury of a person with disability
  • Abuse or neglect of a person with disability
  • Unlawful sexual or physical contact with, or assault of, a person with disability
  • Sexual misconduct against, or in the presence of, a person with disability, including grooming
  • Use of a restrictive practice that is unauthorised or does not follow the person's behaviour support plan

An alleged event can also be reportable.

When the clock starts

The time to notify runs from when the registered provider becomes aware, not from when the event occurred. Most reportable incidents must be notified within 24 hours. Unauthorised restrictive practice without harm has a five-business-day notification window. Record when a worker tells key personnel, their supervisor or manager, or the person responsible for reporting; do not wait for the compliance team to read an email before assessing the deadline.

What to record

For most reportable incidents, the Commission also requires a 5-day form with additional information and actions taken within five business days of awareness. For unauthorised restrictive practice without immediate harm, that is the only form needed. A final report is required only if the Commission asks for one. A workable record shows the person affected, immediate safety response, who was told, when notification occurred and what happened next.

Test the workflow

When evaluating software, demonstrate an out-of-hours report from a frontline worker through to the person responsible for notifying the Commission. Check whether the process works when someone is away, whether the incident is linked to relevant participant records and whether staff can export the history for review. Technology can support the process, but it cannot decide whether an event is reportable.

Need software that supports complex work?

RedRock builds custom software around people, processes and decisions.

Send an enquiry