The two numbers every registered NDIS provider needs to hold: 24 hours for the immediate notification, 5 business days for the full report. Both clocks start when your key personnel become aware of the incident — not when the incident occurred.
That distinction decides audit outcomes. We managed incident intake across SIL homes for years before building systems for it, and the gap between those two readings of the clock is where most of the trouble we see actually lives.
What counts as a reportable incident
Under the NDIS Commission's reportable incident rules, registered providers must notify the Commission of incidents that occur in connection with delivering NDIS supports, including:
- the death of a person with disability
- serious injury
- abuse or neglect
- unlawful sexual or physical contact with, or assault of, a person with disability
- sexual misconduct committed against, or in the presence of, a person with disability
- unauthorised use of a restrictive practice
Allegations count. The threshold is not "confirmed": an alleged reportable incident carries the same notification obligation as a substantiated one.
The timeline, precisely
Within 24 hours of key personnel becoming aware: submit the immediate notification through the NDIS Commission Portal. It does not need every detail. It needs the nature of the incident, who was involved, when it occurred or was discovered, and the immediate actions taken.
Within 5 business days: the full written report. What happened, what the investigation found, what corrective actions followed.
The exception: unauthorised restrictive practices run on a 5-business-day notification timeline instead of 24 hours, unless the use resulted in harm to a person with disability, in which case the 24-hour clock applies.
One more reading of the fine print that matters. Because the clock starts at awareness, a worker knowing on Friday is not the trigger. Key personnel knowing is. Which sounds like relief and is actually the trap.
Where providers get caught
In the diagnostics we run, we ask one question about incidents: what was your real median time from incident to notification last quarter? Not the policy number. The actual number. Very few operators can answer it. The ones who check are routinely surprised.
The failure pattern is almost never a provider deciding not to report. It is structural:
The awareness chain is slow. A support worker logs something in a shift note at 11pm Saturday. The team leader reads it Monday. Key personnel hear about it Tuesday. The organisation believes its clock started Tuesday. But if an auditor forms the view that the Saturday shift note put the organisation on notice, the notification is two days late. The longer your internal chain, the more this judgment call costs.
Intake records are incomplete. The phone call happens, the support worker describes the event, and the details get written up "properly" later. Retrospective completion is exactly what audits are built to find. The record needs to be Commission-ready when it is created, not reconstructed on day four.
After-hours is uncovered. Most reportable incidents in SIL settings do not happen between 9 and 5. Whoever is on call is handling the participant first, as they should. The documentation happens on the drive home, from memory, or not at all.
From 1 July 2026 this stops being a registered-providers-only concern. Mandatory registration for SIL and platform providers brings previously unregistered operators into the full reportable incident regime. Providers who have never run a Commission notification workflow will be required to run one correctly from day one.
What a compliant intake actually captures
A first-contact record that stands up later contains: the severity classification against the reportable categories above, the people involved, the time of occurrence and the time of awareness (both: the gap between them is evidence in your favour when documented), immediate actions taken, and who was notified internally and when.
Capture that at intake and the 24-hour notification is an extraction job. Capture less and the notification becomes an investigation under deadline.
The system answer
This is the job our Triage Agent does. It takes the after-hours intake, classifies severity against the Commission's reportable categories, routes to the on-call contact, and generates the Commission-ready documentation at the moment the incident is logged, including the awareness timestamp that anchors the 24-hour clock. Every incident is documented within 24 hours of occurrence, which means the notification decision is made with a complete record in front of you, inside the window.
It installs in 3 weeks. Providers facing the July 1 registration deadline are installing it now for exactly this reason.
If you want the honest read on your current exposure, the Operational Diagnostic maps your incident workflow end to end in 30 minutes, including the median-time question above, answered from your own records.