Do we have to report near misses to the NDIS Commission?

No. Only incidents that meet one of the six reportable incident categories need to be notified to the NDIS Commission, within the specified timeframe. A near miss that didn't result in one of those outcomes isn't a reportable incident — but it should still be recorded and reviewed in your internal incident management system, because near misses are often the earliest warning sign of a systemic problem, and auditors expect to see that your system captures them.

When does the 24-hour clock actually start?

When your organisation becomes aware of the incident, not when the incident occurred. The Commission's timeframes are explicitly calculated from the point the registered provider became aware. So if a family member tells you about something days after it happened, the deadline runs from when their report reached your organisation. Record both the date the incident occurred and the date you became aware — they are often different, and auditors specifically check the gap.

Does an individual support worker report to the Commission, or does the provider?

The duty to notify the NDIS Commission sits with the registered provider, not the individual worker. A worker's obligation is internal: report the incident to the provider straight away, following the provider's incident management procedures and the NDIS Code of Conduct. The provider's incident management system must name the person responsible for notifying the Commission. Workers should never assume they need to contact the Commission directly.

What happens after we submit the 24-hour notification?

For serious-harm categories you first submit the Immediate Notification Form within 24 hours, then a 5 Day Form providing additional information and the actions you have taken, within five business days of becoming aware. The 24-hour form is the initial alert; the 5 Day Form is where you show what you did about it. For an unauthorised restrictive practice that did not cause immediate harm, only the 5 Day Form is required — there is no 24-hour step.

We deliver both NDIS supports and aged care — do we report the same incident twice?

Potentially, yes. NDIS reportable incidents go to the NDIS Quality and Safeguards Commission; SIRS incidents go to the Aged Care Quality and Safety Commission. They are separate schemes with separate categories and timeframes, so one event can create obligations to both regulators. Determining NDIS reportable status does not settle SIRS classification, and vice versa. Run both checks on any relevant incident — see our SIRS guide for the aged-care side.

Do unregistered providers have to report reportable incidents?

The obligation to have an incident management system as a condition of registration and to notify the Commission of reportable incidents applies to registered NDIS providers. The Commission's guidance says all providers should have an incident management system, and unregistered providers remain bound by the NDIS Code of Conduct and the complaints regime. If you are unregistered, confirm your specific obligations directly with the NDIS Commission.

Guides

NDIS Incident Reporting: Reportable Incidents, Deadlines & Rules

Last reviewed: July 2026

Key takeaways

Registered NDIS providers must notify the NDIS Commission of every reportable incident; the notification duty sits with the provider, not the individual worker.
There are six reportable incident categories — five carry a 24-hour deadline; the sixth, unauthorised restrictive practice, carries 5 business days unless it caused harm, then 24 hours.
All reporting timeframes are calculated from when the provider became aware of the incident, not when it occurred.
Serious-harm incidents need an Immediate Notification Form within 24 hours, followed by a 5 Day Form with additional information and actions taken.
An incident management system is a condition of registration under section 73Y of the NDIS Act 2013 and is examined at audit and renewal.
Reporting late or failing to report can result in an infringement notice or other compliance action from the NDIS Commission.

For a registered NDIS provider, incident reporting is not an administrative afterthought — it is one of the conditions you agreed to when you registered, and it is one of the first things a quality auditor examines at renewal. Getting it wrong (missing the 24-hour window, misjudging what is reportable, or keeping records that don’t stand up) is among the most common and most consequential compliance failures in the sector. This guide covers what counts as a reportable incident, the exact deadlines and how the clock is measured, what your incident management system must do under section 73Y of the NDIS Act, and how NDIS reporting interacts with SIRS for providers who deliver both.

What counts as a reportable incident

The NDIS Commission defines a reportable incident as an act or event that has happened — or is alleged to have happened — in connection with delivering NDIS supports or services. Registered NDIS providers must notify the Commission of all reportable incidents, including ones you have already recorded and responded to inside your own incident management system.

There are six reportable incident categories:

Death of a person with disability
Serious injury of a person with disability
Abuse or neglect of a person with disability
Unlawful sexual or physical contact with, or assault of, a person with disability
Sexual misconduct against, or in the presence of, a person with disability, including grooming of the person for sexual activity
Use of a restrictive practice that is unauthorised by your state or territory, or that does not follow the person’s behaviour support plan

The sixth category is a single reportable type that covers two triggers — a restrictive practice can be reportable either because it is unauthorised by your state or territory, or because it departs from the person’s behaviour support plan. (Some incident forms, including our own template, split these into two checkboxes for clarity; the Commission treats them as one reportable category.)

Both alleged and confirmed events count. You do not wait for proof before the reporting obligation attaches — an allegation in connection with the delivery of supports can itself be reportable.

Source: NDIS Quality and Safeguards Commission — Reportable incidents

Reporting deadlines — and when the clock starts

Every timeframe below is calculated from when the registered provider became aware of the incident, not from when the incident occurred. This is the single most important thing to get right, because the two dates are often different — an incident discovered days later still runs its deadline from the moment you became aware.

Reportable incident	Notify the Commission within
Death of a person with disability	24 hours
Serious injury of a person with disability	24 hours
Abuse or neglect of a person with disability	24 hours
Unlawful sexual or physical contact / assault	24 hours
Sexual misconduct (including grooming)	24 hours
Unauthorised restrictive practice	5 business days — unless it resulted in harm, then 24 hours

Two reporting forms sit behind these timeframes, and they do different jobs:

Immediate Notification Form — for the serious-harm categories, submitted within the specified timeframe, in most cases within 24 hours of becoming aware. This is the initial alert.
5 Day Form — additional information and the actions you have taken, submitted within five business days of becoming aware. For the serious-harm categories this is a follow-up to the 24-hour notification, so a single serious incident typically produces both forms.

The one exception to that two-step flow: for an unauthorised restrictive practice that has not caused immediate harm to the person, the 5 Day Form is the only form required — there is no 24-hour step. But if that restrictive-practice incident did cause harm, it moves to the 24-hour timeframe like the other serious-harm categories. Check the harm trigger every time rather than defaulting all restrictive-practice incidents to five days; assuming five days without checking is a recurring audit finding.

Reportable incidents are notified through the NDIS Commission Portal, under “My Reportable Incidents”.

Source: NDIS Quality and Safeguards Commission — Reportable incidents

The incident management system requirement (s73Y)

Having an incident management system is not optional for registered providers — under section 73Y of the National Disability Insurance Scheme Act 2013 it is a condition of registration. An incident management system is a dedicated set of processes and procedures that set out the actions and responsibilities of workers, the provider, and other stakeholders during the management of an incident, with the safety and wellbeing of the person with disability at the centre.

The Commission expects your system to:

be appropriate for your size and for the classes of supports or services you deliver
be documented in an accessible form
be accessible to all workers you employ or engage, and to the people with disability you support

Beyond those overarching qualities, your incident management system must include written procedures describing:

how incidents are identified, recorded and reported
who incidents must be reported to
the person responsible for notifying reportable incidents to the NDIS Commission
how you provide support and assistance to the impacted person (including access to advocates and supports)
how the impacted person is involved in the management and resolution of the incident
the details and nature of any investigation conducted into an incident’s causes, effect and contributing operational issues
when corrective action is required, and the nature of that action

This is precisely what an auditor examines at renewal. They do not just check that a policy exists in a folder — they check your actual incident records: do they exist, are they complete, were reportable incidents actually reported, and were they reported within the deadline. A well-written policy with no real incident history behind it reads as a red flag, not a pass, because it suggests incidents are happening but not being captured.

Source: NDIS Quality and Safeguards Commission — Incident management; registration-condition context: NDIS Act 2013 s73Y (Incident management system)

Step by step: what to do when an incident occurs

The Commission frames incident management as six stages. Work through them in order — the first two protect the person and are always immediate; notification to the Commission comes only after you have assessed reportable status.

Identify the incident. Incidents surface in different ways — a worker witnesses it, the person tells you, or a third party informs you. Not every incident is obvious; indirect indicators such as a change in behaviour or physical evidence can be the first sign. A culture where workers and participants feel comfortable reporting is what makes the rest of the system work.
Immediately support the impacted person. Make sure anyone affected — the person with disability, workers or others — is safe and well. Call 000 without delay if there is a need for immediate medical care or you suspect a criminal offence. This step never waits on paperwork.
Record the incident. Capture the details and any evidence, and store the record so it protects the privacy and confidentiality of those affected. Good practice is an electronic record completed within 24 hours, while the facts are fresh — including, separately, the date and time the incident occurred and the date and time you became aware.
Assess and report internally. A staff member assesses the incident: why it occurred, whether it could have been prevented, how well it was managed, what will stop it recurring, and — critically — whether anyone else needs to be notified, including the NDIS Commission. This is the point where reportable status and the applicable deadline are confirmed, and where the 24-hour or 5-business-day clock is managed against the date you became aware.
Investigate if needed. If the initial assessment can’t establish what you need — or if the Commission requires it — conduct an investigation to establish the cause, determine the impact, and identify operational issues that contributed.
Capture the learnings. Feed the record, assessment and any investigation back into process changes that improve the safety of your services. Closing this loop — corrective action assigned to an owner, with a follow-up review — is what distinguishes a working system from a paper one, and it is what auditors look for.

Source: NDIS Quality and Safeguards Commission — Incident management

NDIS reporting vs SIRS for dual providers

Some organisations deliver both NDIS-funded disability supports and Commonwealth-funded aged care — for example, a provider that supports both younger people with disability and older people at home. For these dual providers, a single incident can trigger obligations to two separate regulators with two separate classification systems and timeframes. Determining NDIS reportable status does not settle SIRS classification, and determining SIRS priority does not settle NDIS status.

	NDIS reportable incidents (NDIS Quality and Safeguards Commission)	SIRS (Aged Care Quality and Safety Commission)
Categories	6 reportable types (death, serious injury, abuse/neglect, unlawful sexual/physical contact, sexual misconduct, unauthorised restrictive practice)	8 defined types
Fastest deadline	24 hours (five of the six categories)	24 hours (Priority 1)
Slower deadline	5 business days (unauthorised restrictive practice, unless harm caused — then 24 hours)	30 days (Priority 2)
Follow-up report	5 Day Form (additional information and actions taken)	Single report
Clock starts	When the provider becomes aware	When the provider becomes aware
Legal basis	NDIS Act 2013, ss 73Y–73Z	Aged Care Act / SIRS framework

The safe operational approach is a single intake process that checks every relevant incident against both frameworks at the point it is logged, rather than assuming one classification implies the other. For the aged-care side of this — the eight SIRS categories, the Priority 1/Priority 2 split and a step-by-step decision flow — see our SIRS reporting guide.

Source: NDIS Quality and Safeguards Commission — Reportable incidents; Aged Care Quality and Safety Commission — Serious Incident Response Scheme

Consequences of not reporting, or not having a system

If you do not report a reportable incident within the required timeframe, the Commission may issue an infringement notice or take other compliance action. That exposure is immediate and specific to the individual late report.

The deeper risk is systemic. Because the incident management system is a condition of registration under s73Y, a pattern of late or missing reports — or an inability to produce complete records at audit — signals that the underlying system isn’t functioning as required. That is the finding that puts registration itself in question, and with it your ability to continue delivering NDIS supports. It is also the finding most within your control to prevent: the difference between a clean audit and a damaging one is usually whether incidents were captured as living, timestamped records from the moment they occurred, rather than written up after the fact when the deadline had already passed.

That is exactly the gap a static form struggles to close and a lightweight digital system is built for. Our free NDIS incident report template gives you the auditor-ready structure to start with today.

Sources

NDIS Quality and Safeguards Commission — Reportable incidents
NDIS Quality and Safeguards Commission — Incident management
NDIS Quality and Safeguards Commission — Reportable incidents and incident management
National Disability Insurance Scheme Act 2013 (Cth), s73Y (Incident management system) and s73Z (Reportable incidents)
Aged Care Quality and Safety Commission — Serious Incident Response Scheme

This guide provides general information about NDIS incident reporting obligations for registered providers and does not constitute legal advice. Confirm current reportable incident categories, timeframes and registration conditions directly with the NDIS Quality and Safeguards Commission, as requirements can be updated.

Frequently asked questions

Do we have to report near misses to the NDIS Commission?: No. Only incidents that meet one of the six reportable incident categories need to be notified to the NDIS Commission, within the specified timeframe. A near miss that didn't result in one of those outcomes isn't a reportable incident — but it should still be recorded and reviewed in your internal incident management system, because near misses are often the earliest warning sign of a systemic problem, and auditors expect to see that your system captures them.
When does the 24-hour clock actually start?: When your organisation becomes aware of the incident, not when the incident occurred. The Commission's timeframes are explicitly calculated from the point the registered provider became aware. So if a family member tells you about something days after it happened, the deadline runs from when their report reached your organisation. Record both the date the incident occurred and the date you became aware — they are often different, and auditors specifically check the gap.
Does an individual support worker report to the Commission, or does the provider?: The duty to notify the NDIS Commission sits with the registered provider, not the individual worker. A worker's obligation is internal: report the incident to the provider straight away, following the provider's incident management procedures and the NDIS Code of Conduct. The provider's incident management system must name the person responsible for notifying the Commission. Workers should never assume they need to contact the Commission directly.
What happens after we submit the 24-hour notification?: For serious-harm categories you first submit the Immediate Notification Form within 24 hours, then a 5 Day Form providing additional information and the actions you have taken, within five business days of becoming aware. The 24-hour form is the initial alert; the 5 Day Form is where you show what you did about it. For an unauthorised restrictive practice that did not cause immediate harm, only the 5 Day Form is required — there is no 24-hour step.
We deliver both NDIS supports and aged care — do we report the same incident twice?: Potentially, yes. NDIS reportable incidents go to the NDIS Quality and Safeguards Commission; SIRS incidents go to the Aged Care Quality and Safety Commission. They are separate schemes with separate categories and timeframes, so one event can create obligations to both regulators. Determining NDIS reportable status does not settle SIRS classification, and vice versa. Run both checks on any relevant incident — see our SIRS guide for the aged-care side.
Do unregistered providers have to report reportable incidents?: The obligation to have an incident management system as a condition of registration and to notify the Commission of reportable incidents applies to registered NDIS providers. The Commission's guidance says all providers should have an incident management system, and unregistered providers remain bound by the NDIS Code of Conduct and the complaints regime. If you are unregistered, confirm your specific obligations directly with the NDIS Commission.