"Did I just witness a reportable incident?" is one of the most stressful questions a support worker can face. You're still processing what happened — and now you're trying to remember whether you have 24 hours, 5 days, or no obligation at all.
This guide explains what the NDIS rules actually say — which categories of incidents are reportable, who is responsible for notifying the NDIS Commission, and what good incident documentation looks like — so you're not trying to figure it out in a crisis.
This article is a plain-English summary of the NDIS (Incident Management and Reportable Incidents) Rules 2018. It does not constitute legal or compliance advice. If you are uncertain whether a specific incident is reportable, consult your organisation's incident management procedure or compliance officer.
What is a reportable incident?
Under the NDIS (Incident Management and Reportable Incidents) Rules 2018, a reportable incident is a specific type of incident that registered NDIS providers are legally required to notify the NDIS Quality and Safeguards Commission about.
Not every incident that happens during a support is reportable. A participant who trips and grazes their knee is an incident — but it may not meet the threshold for mandatory notification to the Commission. The rules define six specific categories that do.
The reason for the distinction matters: reporting obligations are serious. Providers who fail to notify the Commission of a reportable incident within the required timeframe face regulatory consequences. At the same time, over-reporting is not the answer — it can overwhelm provider systems and dilute attention to genuine serious incidents.
The 6 categories of reportable incidents
The NDIS Rules define reportable incidents across six categories. The first five are classified as priority incidents — triggering a 24-hour notification obligation. The sixth is non-priority and carries a 5 business day notification window.
Death of a person with disability
The death of a participant in connection with the delivery of supports.
24-hour notificationSerious injury
A physical injury that has a significant impact on a participant's health, welfare, or safety — including broken bones, head injuries, and injuries requiring hospital admission.
24-hour notificationAbuse or neglect
Any form of abuse (physical, psychological, financial, sexual) or neglect of a participant by a worker, another participant, or a third party in connection with the delivery of supports.
24-hour notificationUnlawful sexual or physical contact or assault
Any unlawful physical contact with or assault of a participant, or any sexual contact with a participant.
24-hour notificationSexual misconduct
Sexual misconduct committed against or in the presence of a participant, including grooming behaviours directed at a participant.
24-hour notificationUnauthorised restrictive practice
The use of a restrictive practice in relation to a participant that is not in line with an authorised behaviour support plan.
5 business daysWhether a specific incident meets the threshold for any of these categories is a determination that should be made by your organisation's nominated incident manager or compliance officer — not by a support worker alone. If you are unsure, report it internally first and let the decision be made at the appropriate level.
Notification timeframes
The NDIS rules set out two distinct notification timeframes based on incident category.
For Categories 1–5 (death, serious injury, abuse, neglect, unlawful contact, sexual misconduct), the registered provider must notify the NDIS Commission within 24 hours of becoming aware of the incident. This is an initial notification — a full written report comes later.
For Category 6 (unauthorised restrictive practices), the registered provider must notify the NDIS Commission within 5 business days of becoming aware of the incident.
After the initial priority notification, providers are generally required to submit a full written incident report within 5 business days. This report must include a description of the incident, the circumstances, actions taken, and measures put in place to prevent recurrence.
The NDIS Commission may request further information, conduct an investigation, or require a provider to take specific actions following notification. Providers must cooperate fully with any Commission review.
The 24-hour clock starts from when the provider becomes aware of the incident — not when the incident occurred. If a participant discloses an incident that happened during a previous shift, the clock starts at the point of disclosure.
Who is responsible for reporting?
This is one of the most commonly misunderstood aspects of NDIS incident reporting — and getting it wrong creates real problems.
The registered provider is responsible for notifying the NDIS Commission. Not the individual support worker. The worker's role is to report the incident internally — to their supervisor, team leader, or the person nominated as the incident manager in their organisation — as quickly as possible.
| Role | Responsibility |
|---|---|
| Support worker | Report internally to supervisor/incident manager as soon as possible. Document what happened with as much factual detail as possible, in line with your organisation's incident management procedure. |
| Supervisor / Incident manager | Assess whether the incident meets the threshold for notification. Initiate the Commission notification process if required. |
| Registered provider (organisation) | Legally responsible for notifying the NDIS Commission within the applicable timeframe. |
| NDIS Commission | Receives notifications, may investigate, and can take regulatory action against providers. |
Sole traders and unregistered providers are not subject to the same mandatory reporting obligations under the NDIS Rules. However, they may have obligations under state and territory law — and all workers have general duty of care obligations regardless of registration status.
Internal incidents vs reportable incidents
Every significant incident should be documented in your organisation's internal incident management system — even if it does not meet the threshold for notification to the NDIS Commission. This is what auditors look for: a comprehensive, consistent record of how your organisation identifies, manages, and learns from incidents.
Think of it in two layers:
Every incident involving a participant should be recorded internally — what happened, when, who was present, what was done immediately, and what follow-up occurred. This protects the worker, the participant, and the organisation.
Incidents that fall within the 6 categories above must also be formally notified to the NDIS Quality and Safeguards Commission within the applicable timeframe. Your incident manager makes this determination.
A participant who becomes distressed during a community access activity — no injury, no abuse, resolved quickly — should still be documented internally. It does not necessarily require notification to the Commission. A participant who sustains a broken wrist during a support session likely does.
Incident reports — drafted in minutes
When an incident happens, the last thing you want is a blank page. Notara generates structured incident report drafts based on what you describe in plain English — with documentation flags if the content may warrant further review. You review, adjust as needed, and finalise with your incident manager. 14-day free trial.
Start free — no card requiredWhat your incident documentation should include
Whether or not an incident is reportable to the Commission, the quality of your documentation matters. Thorough, timely, factual incident records protect participants, protect workers, and protect the organisation if questions are raised later.
Why the language in your incident report matters
Incident reports are reviewed by NDIS auditors, Commission investigators, legal teams, and families. The language you use shapes how the incident is understood — and how your response is judged.
Use objective, factual language
Describe what you observed. Do not interpret, speculate, or draw conclusions in the incident report.
| ✗ Avoid this | ✓ Better approach |
|---|---|
| "Participant seemed really upset and was probably in pain." | "Participant stated she was experiencing pain in her right arm. Participant was observed crying and did not respond to verbal reassurance." |
| "The fall happened because the floor was slippery as usual." | "Participant lost footing on the bathroom floor and fell. No non-slip mat was present at the time of the incident." |
| "I don't think this was a big deal but I'm documenting it just in case." | "[Document what happened factually. Do not include your assessment of severity — that is for the incident manager to determine.]" |
| "It was an accident — no one was at fault." | "[Fault and attribution are not for the incident report. Document the facts and let the investigation process determine causation.]" |
Write the report as soon as possible
Memory degrades quickly after a stressful event. The NDIS Commission and auditors understand that post-incident reports are written shortly after the event — they will notice if a report reads like it was written days later with softened language or missing detail. Write it while the details are fresh.
Do not minimise or omit
A common mistake is downplaying an incident in the written record because it feels uncomfortable or because the worker believes it will resolve itself. If it happened, it should be documented accurately. Gaps and omissions in incident records are more damaging — legally and reputationally — than the incident itself.
What happens if a reportable incident is not reported?
Failing to notify the NDIS Commission of a reportable incident is a breach of the NDIS (Incident Management and Reportable Incidents) Rules 2018. The Commission has powers to investigate and take regulatory action, including:
- Issuing compliance notices requiring the provider to take specific actions
- Imposing conditions on a provider's NDIS registration
- Suspending or cancelling a provider's registration
- Taking enforceable undertakings from a provider
- Referring matters to law enforcement or other regulatory bodies
Some providers choose not to report incidents because they believe the Commission won't find out. This is a significant miscalculation. Incidents frequently come to the Commission's attention through participant complaints, family complaints, other workers, hospital records, or police reports — at which point the failure to notify becomes the central issue.
Frequently asked questions
Stop starting incident reports from scratch
Describe what happened in plain English. Notara generates a structured incident report draft — chronological, objective, and structured to support your documentation process. Flags content that may need further review. You read it, adjust it, and finalise with your incident manager. 14-day free trial, no card required.
Try Notara free →