Most providers get NDIS reportable incident classification wrong. Here’s what the Rules actually require.
An NDIS reportable incident is not just any adverse event that happens in your service. It’s a specific category of event defined in the NDIS (Incident Management and Reportable Incidents) Rules 2018, and the Commission expects providers to know the difference. Most providers don’t classify these correctly, not because they’re careless, but because the rules have genuine grey areas that internal processes tend to paper over rather than resolve.
This guide covers the six categories of NDIS reportable incidents, the classification mistakes that show up in audits, and what a reliable classification process actually looks like.
Under the NDIS Rules, there are six categories of NDIS reportable incidents that registered providers must notify the NDIS Quality and Safeguards Commission about:
Each category has its own notification timeline. Death requires notification to the Commission within 24 hours. Most other NDIS reportable incidents require initial notification within 24 hours, followed by a detailed written report within 5 business days. Getting the category wrong from the start creates cascading problem, inaccurate initial reports, amendment requests from the Commission, and audit findings that could have been avoided.
Mistake 1: Treating ‘serious injury’ as a subjective call
The most common classification error. ‘Serious injury’ has a specific meaning under the NDIS Rules, it includes fractures, lacerations requiring medical treatment, head injuries, and injuries requiring hospitalisation. Some providers apply a gut-feel threshold rather than a documented standard. If the definition is not written into your internal incident form, support workers are making judgement calls without a framework.
Mistake 2: Missing restrictive practice incidents entirely
A restrictive practice that is not authorised in a participant’s behaviour support plan is an NDIS reportable incident. This catches providers out most often in two situations: when a support worker uses a practice they consider minor or routine, and when a participant’s plan has changed but the updated plan has not reached frontline staff. Both are reportable. Neither tends to surface unless your incident management system explicitly prompts for it.
Mistake 3: The 24-hour window starting too late
The 24-hour notification clock starts from when the incident occurs, not when it reaches a manager, not when it is formally documented. Providers with multi-step internal escalation processes routinely miss this. By the time a team leader notifies a coordinator, who notifies a compliance officer, who reviews and approves the notification, the 24 hours has passed. The fix is not to speed up the review process. It is to file the initial notification immediately and complete the detailed report separately within the 5-day window.
Mistake 4: Applying the ‘wait and see’ approach
Some teams hold off on classifying an incident as reportable while they gather more information. If a participant is injured but the severity is unclear, the instinct is to wait for a medical assessment before deciding whether to report. The Commission does not allow this. If there are reasonable grounds to believe an incident is reportable, initial notification must go in. You can update and correct the report. You cannot retroactively file one after the deadline.
Mistake 5: Limiting reportable incidents to in-home or in-facility settings
NDIS reportable incidents follow the participant, not the location. An incident that occurs in the community during a supported activity is just as reportable as one that occurs in a SIL home. Providers who structure their incident forms around location rather than participant support context create blind spots for community-based incidents.
Mistake 6: Confusing an internal incident with a reportable one
Most providers have two categories: internal incidents and reportable incidents. The line between them is often drawn by instinct rather than documented criteria. A near-miss is typically internal. A medication error resulting in medical treatment is reportable. The problem is when providers consistently classify borderline cases as internal to reduce reporting burden, without written criteria to defend that decision at audit.
A classification process that holds up at audit has three components.
The 24-hour initial notification requirement is the part of NDIS incident management that providers find hardest to meet consistently. In a well-run organisation, the initial notification takes around 10 to 15 minutes to complete. The challenge is process, not time. The notification needs to happen before full investigation, before a root cause analysis, and often before all the facts are confirmed.
Providers who build their process around getting everything right before reporting will miss the window. Providers who file first and investigate second will not.
What is the difference between an NDIS reportable incident and an internal incident?
An NDIS reportable incident is one that falls into the six categories defined in the NDIS Incident Management Rules and must be notified to the NDIS Quality and Safeguards Commission. An internal incident is any other adverse event that your organisation records and manages internally. Internal incidents do not require Commission notification, but they should still be documented and reviewed. The categories are defined by the Rules, not by the severity of the incident as your team perceives it.
Does a near-miss need to be reported to the NDIS Commission?
No. A near-miss, an event that could have caused harm but did not, is not an NDIS reportable incident under the current Rules. It should be recorded as an internal incident. That said, a pattern of near-misses in a particular area is exactly the kind of risk the Commission expects you to identify through your internal incident management system and act on proactively.
What happens if a provider misses the 24-hour notification deadline?
Late notification is a compliance breach. The Commission can investigate and take regulatory action. In practice, a single late notification with a clear explanation is less likely to result in serious action than a pattern of late reporting. If you miss a deadline, notify as soon as possible, document why it was missed, and put a process fix in place.
Can an initial notification be amended after submission?
Yes. The Commission expects initial notifications to be filed quickly, which means they may be incomplete. You can submit additional information and corrections as the investigation progresses. The key is to get the initial notification in on time and update it as you learn more, not to delay it until the full picture is clear.
What does the Commission do with a reportable incident notification?
The Commission assesses each notification and decides whether to investigate. Most notifications are reviewed and closed without a formal investigation when the provider’s response is thorough and the corrective actions are appropriate. The Commission looks at whether the provider identified what went wrong, what the risk to the participant was, and what has been done to prevent recurrence.
————————————————————————————————————————
Wholii’s incident management module automatically surfaces the six reportable categories at the point of reporting, tracks the 24-hour deadline in real time, and connects initial notifications to the full investigation workflow — so nothing falls through between the report and the resolution.
For the full framework on what the NDIS Commission expects from provider incident management, the NDIS Reportable Incidents guidance at ndiscommission.gov.au is the authoritative source.
————————————————————————————————————————
Written by the Wholii team. Wholii is an NDIS compliance and governance platform built for registered Australian NDIS providers.
Registered NDIS providers must now keep records for seven years. Destroying them is a criminal offence, and payments can be clawed back if you can’t produce one.
From 1 December 2026, NDIS providers have just 90 days to submit a claim — here is what that means for your organisation and what you need to do before the deadline hits.
The NDIS just had its biggest shake-up since launch. Here’s what registered providers need to know, and why compliance matters more now than ever.
