NDIS and aged care compliance timeframes at a glance
The clocks providers most often need are these. NDIS reportable incidents: 24 hours from becoming aware, or 5 business days for an unauthorised restrictive practice. Aged care SIRS: 24 hours for Priority 1 and 30 days for Priority 2. Incident and restrictive practice records: 7 years. NDIS audit reports: 14 or 28 days to the Commission, and a major non-conformity is fixed within 3 months. Each figure below links to its source.
Key takeaways
- Incident notification clocks run from when the provider becomes aware, not from when the incident happened.
- NDIS incident records, reportable incident records and restrictive practice records each have a stated 7 year minimum, starting from different days.
- From 27 August 2026, section 45B of the NDIS Act adds a 7 year duty for prescribed claim records. The kinds of record are left to the NDIS Rules, and we had not found Rules prescribing them on 26 September 2026.
- A major non-conformity at an NDIS audit must be fixed within 3 months, and a certification audit’s Stage 2 follows Stage 1 within 3 months.
How quickly must an incident be notified?
| Scheme | Incident | Notify within | Clock starts |
|---|---|---|---|
| NDIS | Death, serious injury, abuse or neglect, unlawful sexual or physical contact or assault, sexual misconduct | 24 hours | Provider becomes aware |
| NDIS | Use of a restrictive practice that is unauthorised, or does not follow a behaviour support plan | 5 business days (5 Day Form; the 24 hour rule applies if the incident has resulted in harm) | Provider becomes aware |
| Aged care (SIRS) | Priority 1: for example injury or illness needing medical or psychological treatment, or reasonable grounds to report to police | 24 hours | Provider becomes aware |
| Aged care (SIRS) | Priority 2: all other reportable incidents | 30 days | Provider becomes aware |
For the NDIS, the Immediate Notification Form is due within the timeframe above and the 5 Day Form supplies additional information and actions taken within five business days, both through the NDIS Commission Portal. For aged care, notification is through My Aged Care’s provider portal, and a crime or ongoing danger must also be reported to police within 24 hours. See the NDIS triage workflow and aged care incident reporting.
How long must records be kept?
| Record | Minimum | Runs from | Where it is stated |
|---|---|---|---|
| NDIS incident record (incident management system) | 7 years | The day the record is made | Incident Management and Reportable Incidents Rules 2018, s 12(4) |
| NDIS reportable incident record | 7 years | The day the Commission is notified | Same Rules, s 25(2) |
| Written information about regulated restrictive practices | 7 years | The day the record is made | Restrictive Practices and Behaviour Support Rules 2018, s 15(3) |
| Prescribed records relating to a claim, or to the support it relates to | 7 years | The day the claim is made | NDIS Act s 45B, in force 27 August 2026, for claims made on or after that date |
Section 45B applies only to records of a kind prescribed by the NDIS Rules. We had not found Rules prescribing them on 26 September 2026, so it does not itself say every shift note must be kept for 7 years. Other Commonwealth, State or Territory laws may add retention requirements. See how long NDIS providers must keep records.
What are the NDIS audit timeframes?
| Step | Timeframe |
|---|---|
| Certification audit: Stage 2 onsite audit after Stage 1 desktop audit | Within 3 months of Stage 1 being completed |
| Mid-term audit | Completed 18 months into the registration period |
| Audit report submitted to the NDIS Commission | Up to 14 days after a verification audit; up to 28 days after a certification or mid-term audit |
| Major non-conformity (rating 0) | 3 months to fix; registration does not progress until it is addressed |
| Minor non-conformity (rating 1) | A longer time to fix; the process continues |
See the NDIS audit readiness guide and how failures become audit findings.
Which dates matter?
NDIS SIL providers must be registered with the NDIS Commission from 1 July 2026, and the SIL Practice Standards module is audited at the provider’s next audit. See SIL mandatory registration. For the wider 2026 to 2028 calendar and what each date means for shift notes, see NDIS reform dates 2026 to 2028.
How should this page be cited, and how is it kept correct?
You are welcome to link to this page. Suggested citation: NoteGate, “NDIS and aged care compliance timeframes at a glance”, last reviewed 28 September 2026, notegate.com.au/blog/ndis-aged-care-compliance-timeframes.html. The figures come from the sources listed below. If one is out of date or wrong, please tell us at info@notegate.com.au and we will check it against the source and correct the page. This is general information, not legal advice: check the current Rules and the regulator’s pages before you rely on a period.
Frequently asked questions
How long do NDIS providers have to report a serious incident?
Within 24 hours of becoming aware for death, serious injury, abuse or neglect, unlawful sexual or physical contact or assault, and sexual misconduct. An unauthorised restrictive practice, or one that does not follow a behaviour support plan, is due within 5 business days.
How long do aged care providers have to report a serious incident?
Within 24 hours of becoming aware for a Priority 1 incident and within 30 days of becoming aware for a Priority 2 incident. The provider decides the priority.
How long must NDIS incident and restrictive practice records be kept?
Seven years. An incident record runs from the day it is made, a reportable incident record from the day the Commission is notified, and restrictive practice records from the day the record is made.
How long is the gap between the two stages of an NDIS certification audit?
The Stage 2 onsite audit should take place in the 3 months after the Stage 1 desktop audit is complete.
Is SIL registration mandatory?
Yes. From 1 July 2026, NDIS SIL providers must be registered with the NDIS Commission. The SIL Practice Standards module is audited at the provider’s next audit.
Sources
- Reportable incidents (NDIS Quality and Safeguards Commission, retrieved 25 September 2026)
- NDIS (Incident Management and Reportable Incidents) Rules 2018, sections 12 and 25 (Federal Register of Legislation, retrieved 25 September 2026)
- NDIS (Restrictive Practices and Behaviour Support) Rules 2018, section 15 Record keeping (Federal Register of Legislation, retrieved 25 September 2026)
- Types of audits (NDIS) (NDIS Quality and Safeguards Commission, retrieved 28 September 2026)
- About reportable incidents (SIRS) (Aged Care Quality and Safety Commission, retrieved 28 September 2026)
- National Disability Insurance Scheme Amendment (Securing the NDIS for Future Generations) Act 2026, Schedule 2 Part 4 (section 45B) (Federal Register of Legislation, retrieved 26 September 2026)
- Mandatory registration and transition pathways for supported independent living (NDIS Quality and Safeguards Commission, retrieved 21 September 2026)
- NDIS (Provider Registration and Practice Standards) Rules 2018, transitional provisions for supported independent living (compilation from 1 July 2026) (Federal Register of Legislation, retrieved 28 September 2026)
Related
Keep the record behind each clock
See how NoteGate keeps incidents, notes and their history together as audit evidence.
Book a 20-minute walkthroughChoose a plan