Key Takeaways
- Regulated restrictive practices are the NDIS Quality and Safeguards Commission's number one compliance priority for 2025-26, with enforcement actions up 214% year on year.
- There are five types of regulated restrictive practices: chemical restraint, environmental restraint, mechanical restraint, physical restraint, and seclusion. Using any of them without a current, NDIS-compliant Behaviour Support Plan is an unauthorised restrictive practice and a reportable incident.
- Behaviour Support Plans must be developed by a registered specialist behaviour support provider (registration group 0110). Implementing providers who carry out restrictive practices cannot write their own plans.
- Most states and territories require authorisation from an external decision-maker, such as a guardian or tribunal, before certain regulated restrictive practices can be lawfully used. Providers operating without this authorisation are exposed to both NDIS and state-based enforcement.
- Unauthorised use of a restrictive practice must be reported to the NDIS Commission within five business days as a reportable incident. All registered implementing providers must also submit monthly data reports on regulated restrictive practice use.
- Common enforcement findings include practices used without a current Behaviour Support Plan, plans that are out of date or not implemented as written, and failures to report unauthorised use within required timeframes.
The NDIS Quality and Safeguards Commission has made regulated restrictive practices its explicit number one regulatory priority for the 2025-26 financial year. Enforcement actions in this area increased by 214% year on year, with deregistrations, banning orders, and civil penalties all being applied to providers found to be using restrictive practices outside the regulatory framework. If your organisation supports participants with complex needs and challenging behaviour, this is the compliance area that poses the greatest risk of serious regulatory action right now. This guide covers what the rules require, where providers most commonly fall short, and how to ensure your practice is fully compliant.
What the Commission Means by Regulated Restrictive Practices
The term "restrictive practice" in the NDIS context has a specific legal meaning set out in the NDIS Act 2013 and the NDIS (Restrictive Practices and Behaviour Support) Rules 2018. Not every physical or environmental intervention qualifies as a regulated restrictive practice. Understanding what is and is not regulated is the first step to compliance.
A regulated restrictive practice is any practice or intervention that restricts the rights or freedom of movement of an NDIS participant and falls within one of the five defined categories. General therapeutic techniques, clinical procedures, or everyday prompts do not automatically constitute regulated restrictive practices, but providers frequently misclassify their practice in both directions: either failing to recognise that what they do constitutes a regulated practice, or applying the framework to interventions that are not regulated at all.
The distinction matters. Using something that is a regulated restrictive practice without the required framework in place is a reportable incident and a compliance breach. But incorrectly labelling a support as a regulated restrictive practice and triggering unnecessary authorisation processes creates its own administrative and clinical problems.
The Five Types of Regulated Restrictive Practices
Chemical restraint is the use of medication or a chemical substance for the primary purpose of influencing a person's behaviour, not for a therapeutic or medical purpose. The distinction between chemical restraint and legitimate clinical medication is critical and sometimes contested. PRN (as-needed) medication prescribed to manage distress or behavioural episodes can constitute chemical restraint if the primary purpose is behavioural management rather than treatment of a diagnosed medical condition. Providers relying on PRN medication protocols in behavioural contexts should have these specifically reviewed in the Behaviour Support Plan by the prescribing clinician and the behaviour support practitioner.
Environmental restraint involves restricting freedom of movement through the physical environment. Examples include locked doors that a participant cannot independently open, barriers that restrict access to areas of the home, or restrictions on access to certain rooms or spaces as a behavioural management strategy. Routine WHS measures and appropriate environmental design for safety reasons are not automatically environmental restraints, but if an environmental restriction is being used specifically to manage a participant's behaviour, it falls within the definition.
Mechanical restraint is the use of a device, material, or equipment to restrict free movement and that is not for a therapeutic or medical purpose. Wheelchair lap belts used to prevent a participant from falling, for example, are not mechanical restraints when used for postural support. The same belt used to prevent a participant from leaving a wheelchair for behavioural reasons is a mechanical restraint and must be regulated accordingly.
Physical restraint involves using body contact to restrict the free movement of a participant. This includes hand-over-hand guidance that prevents a participant from moving, holds used to prevent self-injurious behaviour, and manual restrictions used in response to agitated or dangerous behaviour. De-escalation techniques, therapeutic handling for clinical purposes, and brief physical guidance that does not restrict movement are not physical restraints.
Seclusion is the confinement of a participant, alone, in a room or area from which they cannot freely exit. Seclusion does not require locking a person in. If a participant cannot leave a space because of physical barriers, supervision, or social pressure and they are alone in that space, it may constitute seclusion. Time-out strategies that involve separating a participant in a way they cannot freely exit are typically seclusion and must be regulated.
Specialist Behaviour Support Providers vs Implementing Providers
Understanding the distinction between these two roles is fundamental to compliance. These are separate responsibilities, and in some situations separate organisations, with distinct obligations under the NDIS rules.
Specialist behaviour support providers are registered with the NDIS Commission under registration group 0110 (Specialist Behaviour Support). This registration group covers the assessment, development, and review of Behaviour Support Plans. Only a registered specialist behaviour support provider can develop an NDIS-compliant Behaviour Support Plan. An implementing provider cannot write its own plan, even if it employs qualified behaviour support practitioners, unless it holds this specific registration.
Implementing providers are registered NDIS providers who carry out regulated restrictive practices in the course of delivering supports. This includes SIL providers, day program operators, community access providers, and others whose support workers may use regulated restrictive practices as part of day-to-day service delivery. Implementing providers must be registered and must only use regulated restrictive practices that are authorised in a current, Commission-compliant Behaviour Support Plan developed by a registered specialist behaviour support provider.
The implementing provider is responsible for ensuring that support workers are trained in the specific practices authorised in the Behaviour Support Plan, that the plan is accessible to all workers delivering supports to the participant, that any variation from what the plan authorises is reported as an unauthorised practice, and that monthly data on regulated restrictive practice use is submitted to the Commission. The specialist behaviour support provider is responsible for developing and reviewing the plan, including recommending the reduction or elimination of regulated restrictive practices over time. Both carry obligations and both face enforcement risk.
For allied health providers and therapy practices that also deliver disability supports, check carefully whether your current registration scope captures the supports you are delivering. Providing therapeutic supports that include regulated restrictive practices under a registration group that does not authorise implementing provider status is a compliance gap that auditors are specifically looking for in 2025-26.
Behaviour Support Plans: What a Compliant Plan Must Include
A Behaviour Support Plan is not a generic behaviour management document. The NDIS Commission has specific requirements for what a compliant plan must contain, and auditors assess plans against these requirements during certification audits and compliance reviews.
A compliant Behaviour Support Plan must document the participant's assessed support needs and the factors contributing to behaviours of concern. It must identify all regulated restrictive practices that are authorised for use with the participant, with a clear description of each practice, the specific circumstances in which it may be used, who may use it, and what alternatives must be tried first. The plan must include positive behaviour support strategies that address the underlying causes of the behaviour and must include a clear pathway for reducing or eliminating regulated restrictive practices over time. Plans without a reduction pathway are regularly identified as non-compliant.
The plan must reflect current state or territory authorisation for any practices that require external authorisation in the relevant jurisdiction. A plan that authorises practices beyond what the state decision-maker has approved is non-compliant, as is a plan based on authorisation that has expired.
Behaviour Support Plans must be reviewed at least annually, or sooner if the participant's circumstances change significantly, if a restrictive practice is used in an unauthorised way, or if there are repeated or escalating incidents. Implementing providers operating under a plan that has not been reviewed within 12 months are using an out-of-date plan, which constitutes use of a regulated restrictive practice without a compliant authorisation framework.
If you need NDIS policy templates to support your compliance documentation, ClinicComply offers free NDIS policy templates covering every Core Module 1 requirement, which implementing providers can use as a foundation alongside their Behaviour Support Plan documentation.
State and Territory Authorisation Requirements
One of the most complex aspects of NDIS restrictive practices compliance is that the NDIS framework operates alongside, not instead of, state and territory guardianship and disability laws. In most jurisdictions, certain regulated restrictive practices require authorisation from an external decision-maker, such as a guardianship tribunal, an appointed guardian, or another authorised body, before they can be lawfully used.
The requirements vary significantly across jurisdictions and are not uniform for all five types of regulated restrictive practices. In most states, seclusion and physical restraint require external authorisation from a guardian or tribunal for participants who cannot consent on their own behalf. Chemical restraint arrangements often require the oversight of a prescribing clinician and, in some jurisdictions, external authorisation. Environmental and mechanical restraints similarly vary by state.
What is consistent across jurisdictions is this: the NDIS Commission requires that any state or territory authorisation needed for a regulated restrictive practice must be in place and current before the practice is used. A Behaviour Support Plan that authorises the use of a regulated restrictive practice for which the relevant state or territory authorisation has not been obtained, or has lapsed, is itself non-compliant. The Commission's auditors check for documentation of current authorisation for every regulated restrictive practice listed in a plan.
Providers operating across multiple states need to be particularly careful. A participant moving from Queensland to Victoria, or being supported by a provider that operates across both states, brings a new jurisdiction's authorisation requirements into play. The Behaviour Support Plan must be updated to reflect the requirements of the state in which the participant is receiving supports.
Incident Reporting and Monthly Reporting Obligations
Implementing providers have two separate reporting obligations to the NDIS Commission in relation to regulated restrictive practices.
Incident reporting for unauthorised practices. Any use of a regulated restrictive practice that is not authorised in the participant's current Behaviour Support Plan, or that is used outside the conditions specified in the plan, is an unauthorised restrictive practice. This is a reportable incident under the NDIS (Incident Management and Reportable Incidents) Rules 2018. Providers must notify the NDIS Commission within five business days of becoming aware of an unauthorised restrictive practice. The notification must include details of the incident, the practice used, the circumstances, and the initial corrective actions taken.
Failure to report unauthorised restrictive practices within the required timeframe is itself a non-conformity. The Commission tracks reporting rates and uses delays in notification as an indicator of broader compliance culture problems within a provider. Under the expanded enforcement framework introduced by the NDIS Amendment (Integrity and Safeguarding) Bill 2025, non-reporting of serious incidents now carries substantially higher civil penalty exposure. For detail on how the Bill's expanded penalty regime affects providers, see our NDIS Amendment Bill 2025 guide.
Monthly data reporting. All registered implementing providers must submit monthly reports to the Commission through the NDIS Commission's provider portal. These reports capture the regulated restrictive practices used during the month, the participants for whom they were used, and whether use was authorised or unauthorised. The Commission uses this data to identify patterns and risk indicators at a provider level, and to inform compliance monitoring decisions.
Providers that fail to submit monthly reports on time or that submit reports with incomplete data are flagged for follow-up. If your practice has not been submitting monthly reports, this is a compliance gap that needs to be addressed immediately, as the Commission's data analytics team actively identifies non-submitting providers as part of its intelligence-led compliance monitoring approach.
For a full breakdown of the incident management requirements that sit alongside restrictive practices reporting, including timeframes for other reportable incident types, see our NDIS audit preparation checklist.
The Commission's 2025-26 Enforcement Approach
The NDIS Commission's 2025-26 compliance and enforcement priorities document identifies regulated restrictive practices as the single highest priority for the year. Enforcement actions in this area have increased by 214% year on year, and the Commission has made clear it will use its full toolkit, including compliance notices, conditions on registration, suspension, deregistration, and civil penalties, against providers found to be operating outside the framework.
The Commission's enforcement data shows a consistent pattern of findings across deregistrations and compliance actions in this space: practices used without a current Behaviour Support Plan, plans that have not been reviewed and are out of date, implementing providers whose workers are not trained in the authorised practices, failure to report unauthorised practices within the five-business-day window, and no documented pathway for reducing or eliminating restrictive practices over time.
The cases that have resulted in the most serious enforcement outcomes are those where restricted practices were used without any plan in place at all, particularly in SIL and group home settings. The Commission's compliance data identifies providers in residential settings as the highest-risk cohort, followed by day program operators. Allied health and therapy providers that are implementing providers are also an area of increasing Commission focus, particularly where PRN medication arrangements are being used for behavioural management without proper Behaviour Support Plan coverage.
For context on the broader enforcement environment the Commission is operating in, including the Taskforce actions against fraudulent and unsafe providers driving the regulatory upgrade, see our NDIS fraud crackdown guide.
What Every Implementing Provider Must Have in Place
Regardless of the size of your organisation, if you are a registered implementing provider, the Commission expects the following to be in place and demonstrable.
A current Behaviour Support Plan for every participant for whom you use regulated restrictive practices. The plan must have been developed by a registered specialist behaviour support provider, must be dated within the last 12 months (or sooner if circumstances have changed), and must document state or territory authorisation where required.
Worker training records. Every support worker who uses a regulated restrictive practice in the course of their work must be trained in that specific practice, in the conditions under which it is authorised, and in the alternatives they must attempt first. Training must be documented. Generic WHS or manual handling training does not satisfy this requirement.
An incident management system that captures unauthorised restrictive practice use in real time. Workers must understand what constitutes an unauthorised restrictive practice and know how to report it immediately. Delayed reporting, or systems that aggregate incidents at end of week rather than in real time, routinely produce five-business-day reporting failures.
Monthly reporting submitted on time. Assign one person as responsible for submitting the Commission's monthly restrictive practices data report and build a calendar reminder for the submission deadline each month.
A reduction pathway in every Behaviour Support Plan. Plans without a documented strategy for reducing or eliminating regulated restrictive practices are flagged by the Commission as non-compliant. Work with your specialist behaviour support providers to ensure every plan includes specific, measurable reduction goals.
ClinicComply tracks NDIS Practice Standard requirements, including the obligations specific to implementing providers, across a live compliance dashboard. You can assign tasks, upload evidence of Behaviour Support Plans, record worker training completions, and set automated reminders for plan review dates so that out-of-date plans do not slip through. Use our NDIS Compliance Quiz to get a fast assessment of where your practice currently stands, or our NDIS Audit Cost Estimator to understand what your next audit cycle is likely to cost.
How ClinicComply Helps
Restrictive practices compliance requires coordination across multiple systems: Behaviour Support Plans maintained by an external specialist, state authorisation records, worker training logs, incident management, and monthly Commission reporting. For most providers, these are currently tracked across separate spreadsheets, shared drives, and individual worker records, which is exactly the environment in which compliance gaps emerge.
ClinicComply brings the full NDIS Practice Standards framework into one dashboard, including the specific requirements relevant to implementing providers and specialist behaviour support providers. You can track Behaviour Support Plan currency, set review reminders, upload authorisation documentation, log incidents in real time, and link evidence to specific Practice Standard requirements so your next audit has clear and accessible documentation rather than a reconstruction exercise.
For providers approaching their registration renewal or facing a mid-term audit, getting compliance documentation centralised before the auditor arrives is the single most effective preparation step. Our NDIS provider registration guide covers the full audit process step by step, and our NDIS audit preparation checklist gives you the specific evidence requirements for each audit area.
Start your free 30-day trial at cliniccomply.com.au and get your restrictive practices compliance documentation organised before the Commission comes to you.
Frequently Asked Questions
What are regulated restrictive practices under the NDIS?
Regulated restrictive practices are defined in the NDIS Act 2013 and the NDIS (Restrictive Practices and Behaviour Support) Rules 2018. There are five types: chemical restraint (using medication or a chemical substance primarily to influence behaviour rather than for a therapeutic purpose), environmental restraint (restricting movement through the physical environment), mechanical restraint (using a device or equipment to restrict movement for behavioural purposes), physical restraint (using body contact to restrict movement), and seclusion (confining a person alone in a space they cannot freely exit). Using any of these without a current, NDIS-compliant Behaviour Support Plan is an unauthorised restrictive practice and a reportable incident.
Who can write an NDIS Behaviour Support Plan?
Only a registered specialist behaviour support provider, registered under registration group 0110 with the NDIS Commission, can develop an NDIS-compliant Behaviour Support Plan. Implementing providers, including SIL providers, day programs, and other organisations that carry out regulated restrictive practices, cannot write their own plans, even if they employ qualified practitioners. The Behaviour Support Plan must be developed by an external registered specialist behaviour support provider.
What is the difference between a specialist behaviour support provider and an implementing provider?
A specialist behaviour support provider holds registration group 0110 and is responsible for assessing the participant's support needs, developing the Behaviour Support Plan, and reviewing it over time with a pathway to reduce or eliminate restrictive practices. An implementing provider is a registered NDIS provider whose workers carry out regulated restrictive practices in the course of delivering supports. These can be different organisations, or the same organisation holding both registration groups. Each has distinct obligations under the NDIS rules.
When must an unauthorised restrictive practice be reported to the NDIS Commission?
An unauthorised restrictive practice must be reported to the NDIS Commission within five business days of the implementing provider becoming aware of the incident. An unauthorised restrictive practice is any use of a regulated restrictive practice that is not authorised in the participant's current Behaviour Support Plan, or that is used outside the specific conditions the plan authorises. Failure to report within the five-business-day window is itself a compliance breach and is actively monitored by the Commission through its data systems.
Do all NDIS regulated restrictive practices require state or territory authorisation?
Most regulated restrictive practices require state or territory authorisation for participants who cannot consent on their own behalf, but the specific requirements vary by jurisdiction and practice type. In most states, seclusion and physical restraint require external authorisation from a guardian or tribunal. Chemical restraint arrangements require oversight from the prescribing clinician and, in many jurisdictions, additional external authorisation. Environmental and mechanical restraints vary by state. The NDIS Commission requires current state or territory authorisation to be documented in the Behaviour Support Plan before any practice that requires authorisation can be used.
What do implementing providers need to report to the NDIS Commission each month?
All registered implementing providers must submit monthly data reports to the NDIS Commission through the provider portal. These reports capture which regulated restrictive practices were used during the month, which participants they were used with, and whether each use was authorised or unauthorised. The Commission uses this data to monitor compliance patterns and identify providers for further scrutiny. Non-submitting providers are identified through the Commission's data systems and followed up.
How often must a Behaviour Support Plan be reviewed?
A Behaviour Support Plan must be reviewed at least every 12 months. It must also be reviewed sooner if the participant's circumstances change significantly, if a regulated restrictive practice is used in an unauthorised way, or if there are repeated or escalating incidents. An implementing provider using a plan that has not been reviewed within the past 12 months is considered to be operating without a compliant authorisation framework, which constitutes use of a regulated restrictive practice outside the required conditions.
What are the most common NDIS restrictive practices compliance failures?
The most common findings in Commission enforcement actions are: regulated restrictive practices used without any current Behaviour Support Plan, Behaviour Support Plans that have not been reviewed within 12 months and are out of date, plans without a documented pathway for reducing or eliminating restrictive practices over time, support workers not trained in the specific practices authorised in the plan, failure to report unauthorised practices within the five-business-day timeframe, and monthly data reports not submitted on time or at all. Providers in residential settings, particularly SIL and group homes, are the most frequently investigated cohort.
What does the NDIS Commission do when it finds restrictive practices non-compliance?
The Commission's enforcement toolkit includes compliance notices, conditions on registration, suspension of registration, deregistration, and civil penalties. Under the NDIS Amendment (Integrity and Safeguarding) Bill 2025, which passed Parliament on 31 March 2026, civil penalties for serious contraventions have increased substantially, with the maximum for incidents involving participant injury now exceeding $15 million. Banning orders can be issued against individuals involved in restrictive practices non-compliance, and these now extend to consultants and advisors as well as direct service staff.
What is chemical restraint in the NDIS context, and how does it differ from clinical medication?
Chemical restraint is the use of medication or a chemical substance for the primary purpose of influencing a person's behaviour rather than for a therapeutic or medical purpose. PRN (as-needed) medication that is prescribed and administered primarily to manage behavioural episodes, rather than to treat a diagnosed medical condition, can constitute chemical restraint and must be included in the participant's Behaviour Support Plan. The line between clinical medication and chemical restraint is often contested and requires careful documentation. The prescribing clinician's documented clinical rationale, reviewed by the specialist behaviour support practitioner, is the key to managing this classification correctly.
Is there a tool to help assess my NDIS compliance status before an audit?
Yes. ClinicComply's NDIS Compliance Quiz gives you a rapid assessment of where your organisation stands against key NDIS Practice Standard requirements, and the NDIS Audit Cost Estimator helps you understand what your next audit is likely to cost based on your provider profile. For a full guide to what auditors look for, see our NDIS audit preparation checklist.