NDIS Quality and Safeguards Commission

Why this matters for your practice

The NDIS Commission used 1,005 statutory enforcement tools during 2024-25, a 214 per cent increase on the 320 used in 2023-24, against a target of a 20 per cent increase. On 4 September 2026 it wrote to more than 285,000 unregistered NDIS providers across Australia, reminding them of their obligations under the NDIS Code of Conduct and the penalties for non-compliance. Commissioner Louise Glanville said in that announcement: "The NDIS Commission regulates both registered and unregistered providers and we will take action against providers that breach the Code." If you claim NDIS money, the Commission's reach extends to you whether or not you hold a certificate of registration.

What is the NDIS Quality and Safeguards Commission?

The Commission describes itself this way: "The NDIS Commission is an independent Australian Government regulator. We regulate the NDIS using a nationally-consistent approach to promote safe practices and improve the quality and diversity of providers' services." It is established by section 181A of the National Disability Insurance Scheme Act 2013, in Chapter 6A of that Act, and consists of the Commissioner and the staff of the Commission. A note to section 181A records that the Commission does not have a legal identity separate from the Commonwealth.

The statutory powers sit with the Commissioner, not with the Commission as a body. Section 181B states the Commission's function in a single sentence: "The Commission's function is to assist the Commissioner in the performance of the Commissioner's functions." The Commissioner's functions under section 181D(1) fall into four groups: the core functions (set out in section 181E across nine paragraphs, from upholding the rights of people with disability receiving supports to NDIS market oversight), the registration and reportable incident functions (section 181F), the complaints functions (section 181G), and the behaviour support function (section 181H). The Commissioner is appointed by the Minister (section 181L(1)) for a term that must not exceed 3 years (section 181L(2)), and must establish and maintain the NDIS worker screening database under section 181Y.

What does the NDIS Commission do that the NDIA does not?

The Commission states the relationship plainly: "The NDIS Commission is independent of the NDIA, but we both play a part in delivering the NDIS." The Commission regulates providers and workers. It looks at the safety and quality of NDIS-funded supports and services, guides providers and workers on the Code of Conduct and NDIS practice standards, looks at fair pricing, guides providers on behaviour management plans to reduce restrictive practices, and receives and actions complaints from people with disability about the safety and quality of their supports. The NDIA provides individualised plans, coordinates service bookings, payments and access to plans for providers, receives complaints about NDIS funding and plans, and detects and investigates allegations of fraud.

The boundary the Commission draws is: "The NDIS Commission does not regulate the NDIA. Complaints about the NDIA or participant plans should be made directly to the NDIA."

Alongside those functions, the Commission also monitors provider compliance with the NDIS Code of Conduct and the NDIS Practice Standards, conducts investigations and enforcement actions, and coordinates nationally consistent NDIS worker screening with the states and territories.

Which providers does the NDIS Commission regulate?

Both registered and unregistered ones, but differently. Registration is mandatory to provide specialist disability accommodation (SDA), specialist behaviour support services, supports or services to NDIS participants with NDIA-managed funding, plan management services, supported independent living (SIL), and NDIS digital platform services. The Commission adds: "You must also get registered if you plan to use regulated restrictive practices." Unregistered providers can deliver everything else, but only participants who self-manage or plan-manage their NDIS funding can choose them.

A registered provider has applied, been audited against the relevant NDIS Practice Standards and assessed as meeting them (through a certification or verification audit, depending on the registration groups it holds), undergone a suitability assessment of both the provider and its key personnel, and been issued a certificate of registration. The Commission cites section 73E for registration and section 73F for the conditions attached to it. These providers are generally registered for three years.

The Code of Conduct is where unregistered providers get caught. Section 73V makes contravention a civil penalty provision: 10,000 penalty units for a serious contravention by an NDIS provider, or 250 penalty units in any other case. The Commission's Annual Report 2024-25 notes: "Currently, 15 out of 16 providers are unregistered with the NDIS Commission, leaving most of the market not directly visible to us." The registration boundary is also moving under the Commission's mandatory registration reform, which covers supported independent living and NDIS digital platforms, so treat the Commission's current registration page as the source of truth rather than anything older.

What can the NDIS Commission do if you get it wrong?

The Commission's Compliance and Enforcement Policy, Version 3.0 June 2026, sets out a ladder from informal letters to court-imposed penalties.

Breaching a compliance notice is itself a civil penalty provision: 10,000 penalty units for a serious contravention by an NDIS provider, or 60 penalty units otherwise, and for a registered provider the notice must state that failure to comply may lead to suspension or revocation of registration. Breaching an anti-promotion order carries 250 penalty units (section 73ZOB). Breaching a banning order carries the heaviest penalties of all: 5 years imprisonment or 300 penalty units or both for the fault-based offence, 150 penalty units for a strict liability offence, and a civil penalty of 10,000 penalty units for a serious contravention by an NDIS provider or 1,000 penalty units otherwise (section 73ZNA).

Table 4 of the Annual Report 2024-25 shows how the ladder is being used: 716 compliance notices (up from 42 in 2023-24), 194 banning orders (up from 124), 87 infringement notices, 8 civil penalty proceedings, and no enforceable undertakings. The largest single penalty named in that report is Valmar Support Services, where the Federal Court ordered $1.916 million in penalties for breaches of the NDIS Act that led to a participant's death from choking.

What the regulator or assessor expects

The Commission's stated enforcement principles are: "we take a human-rights approach"; "our actions will be intelligence led and risk-based, and proportionate to the risk"; "we are fair, transparent, and accountable"; and "we use all our regulatory levers". Registered providers are audited against the Practice Standards and hold conditions of registration under section 73F, including having effective systems and practices for managing complaints and managing incidents. That is where day to day NDIS provider compliance sits.

Enforcement actions land on the NDIS Provider Register, established under section 73ZDA. The public search lists banning orders, compliance notices, enforceable undertakings and suspension or revocation of registration actions, with a separate infringement notice list. Low-level actions such as warning letters and requests to adjust practices are not published, nor are civil proceedings taken in addition to an initial enforcement action, nor instances where publishing is not in the interest of the public or a participant. Each year the Commission also publishes regulatory priorities that identify the greatest areas of risk for the next 12 months.

Common mistakes

Sending plan and funding complaints to the wrong agency. A complaint about an NDIA plan, a funding decision or a payment belongs with the NDIA. The Commission takes concerns about the safety and quality of NDIS-funded supports and services, not about the money or the plan, and it does not regulate the NDIA at all.

Assuming an unregistered provider is outside the system. Section 73V binds every provider to the Code of Conduct, and the Commission wrote to more than 285,000 of them on 4 September 2026 to say so. The only real boundary is which participants can use an unregistered provider: those who self-manage or plan-manage their funding.

Treating a compliance notice as advisory. A compliance notice under section 73ZM is a direction, not a suggestion. Failing to comply is a civil penalty provision carrying 10,000 penalty units for a serious contravention by an NDIS provider or 60 penalty units otherwise, and for a registered provider it can end in suspension or revocation of registration.

Forgetting that enforcement is public. Banning orders, compliance notices, enforceable undertakings and registration suspensions and revocations appear on a searchable public register under section 73ZDA. Referrers, participants and competitors can all see them.

Assuming registration status is fixed. The registration boundary is moving under the Commission's mandatory registration reform, which covers supported independent living and NDIS digital platforms. The Commission's current registration page, not last year's guide, is the source of truth.

Frequently asked questions

What is the NDIS Quality and Safeguards Commission?

It is "an independent Australian Government regulator" established by section 181A of the National Disability Insurance Scheme Act 2013, in Chapter 6A of that Act. It consists of the Commissioner and the Commission's staff, and its function under section 181B is to assist the Commissioner, who holds the statutory powers to register, monitor and take action against providers and workers.

What is the difference between the NDIS Commission and the NDIA?

They are separate bodies. The Commission regulates the safety and quality of NDIS-funded supports and services, and the providers and workers who deliver them. The NDIA provides individualised plans, coordinates service bookings and payments, takes complaints about funding and plans, and investigates fraud. The Commission does not regulate the NDIA.

Does the NDIS Commission regulate unregistered providers?

Yes. Section 73V makes the NDIS Code of Conduct binding on all providers, with a civil penalty of 10,000 penalty units for a serious contravention by an NDIS provider or 250 penalty units otherwise. On 4 September 2026 the Commission wrote to more than 285,000 unregistered providers to remind them of that.

What powers does the NDIS Commission have?

It can issue compliance notices and infringement notices, accept enforceable undertakings, make anti-promotion orders and banning orders, and seek injunctions and civil penalties in court. Breaching a banning order can carry 5 years imprisonment or 300 penalty units, or both. It can also suspend registration for up to 30 days at a time and revoke it after giving at least 28 days to respond.

Can the NDIS Commission cancel my registration?

Yes. Under section 73P the Commissioner may revoke a registration, but must first notify the provider that revocation is being considered, give reasons, and invite written submissions within a period of not less than 28 days. The Commissioner may also suspend a registration for periods of not more than 30 days, more than once.

Are NDIS Commission enforcement actions made public?

Yes, the significant ones. The compliance actions search lists banning orders, compliance notices, enforceable undertakings and suspension or revocation of registration, plus a separate infringement notice list. Warning letters and low-level requests to adjust practices are not published.

Who is the NDIS Commissioner?

Commissioner Louise Glanville, alongside Associate Commissioner Natalie Wade. The Commissioner is appointed by the Minister under section 181L(1) for a term that must not exceed 3 years, and the statutory powers of the Commission sit with the Commissioner rather than with the Commission as a body.

Last reviewed 13 September 2026