The NDIS Quality and Safeguards Commission has always had the authority to investigate and act on provider noncompliance. But the NDIS Amendment (Integrity and Safeguarding) Act 2026 substantially expands what it can do, and how quickly it can do it.

For NDIS providers, understanding these new powers isn’t just useful, it’s essential. The regulatory environment has fundamentally changed.

Why Were the Powers Expanded?

The Commission was created in 2018 with a clear mandate: protect NDIS participants and maintain the quality and integrity of the scheme. Over the years, multiple reviews and inquiries found that while the Commission was working within its powers, those powers were often insufficient to act decisively against providers engaged in serious misconduct.

The problems identified included:
– Slow enforcement timelines that allowed noncompliant providers to continue operating during appeals
– Limited ability to share information with other agencies investigating the same conduct
– Narrow suspension powers that required lengthy processes before action could be taken
– No individual accountability mechanism beyond what applied to registered organisations

The 2026 Act addresses all of these directly.

The New Powers, A Plain English Breakdown

1. Immediate Suspension in Urgent Circumstances

Under the previous framework, suspending a provider’s registration required following a formal process with notice, response periods, and review rights, all of which took time.

The 2026 Act gives the Commission the ability to immediately suspend a provider’s registration where it determines that urgent action is necessary to protect participants. This can happen without the usual lead time when there is credible evidence of:

• Immediate risk of harm to participants
• Serious and deliberate fraud
• Criminal conduct associated with the provision of supports

The provider retains review rights, but the suspension takes effect immediately, operations stop while any appeal is resolved, not after.

What this means in practice: If a serious complaint or audit finding triggers an urgent assessment, a provider can find themselves suspended with immediate effect. Cooperating with the Commission and maintaining robust safeguarding systems is both a compliance obligation and a practical protection.

2. Banning Orders, Including for Individuals

Previously, enforcement action targeted registered organisations. The 2026 Act introduces banning orders that can be applied to individuals, including sole traders, directors, key management personnel, and anyone else found to have engaged in conduct that warrants exclusion from the NDIS sector.

A banning order can prohibit a person from:
– Operating as an NDIS provider
– Being involved in the management of an NDIS provider
– Providing supports to NDIS participants in any capacity

Banning orders can be permanent or fixed term, depending on the seriousness of the conduct.

Why this matters: Under the old framework, a director of a company that lost its registration could, in theory, establish a new entity and continue operating. Banning orders close that pathway. If you’re personally found to have engaged in serious misconduct, you, not just your organisation, face exclusion from the sector.

3. Information Sharing with Other Agencies

The Commission’s previous powers to share information with other government bodies were limited. The 2026 Act creates explicit information sharing arrangements with:

• The Australian Taxation Office (ATO), enabling cross referencing of billing, income, and tax compliance data
• The Australian Competition and Consumer Commission (ACCC), for conduct that may also involve consumer law breaches
• State and Territory regulators, including workplace safety authorities, health departments, and state police
• Other Commonwealth bodies, as appropriate to the conduct under investigation

This creates a genuinely integrated regulatory environment. The Commission no longer operates in isolation.

What this means in practice: A provider who may have avoided detection by keeping noncompliance across different regulatory domains is now exposed to cross agency visibility. The Commission can see, and share, a fuller picture.

4. Unannounced Audits

Previously, NDIS audits followed a scheduled process. While the Commission could conduct compliance monitoring visits, full audits with minimal notice were rare.

The 2026 Act explicitly enables the Commission to trigger unannounced audits where it has reasonable grounds to suspect:
– A provider is engaged in misconduct
– Participants may be at risk
– Evidence relevant to an investigation may be at risk of destruction or alteration

Unannounced audits mean that the preparation window providers previously had no longer exists in circumstances where the Commission decides to act quickly.

What this means in practice: You should be ready for an audit at any time. Your records, your staff, your service delivery, these should reflect your obligations as a matter of course, not only when an audit is scheduled.

5. Compliance Notices with Binding Timelines

The Commission’s ability to issue compliance notices has been strengthened. Under the 2026 Act, compliance notices can now include:

• Specific, binding remediation requirements, not just general directives
• Fixed timeframes for compliance, with clear consequences if the deadline is missed
• Progress reporting requirements, where a provider must demonstrate to the Commission that steps are being taken

Failure to comply with a compliance notice within the specified timeframe is itself an additional ground for enforcement action, including referral for civil penalty proceedings.

6. Strengthened Civil Penalty Proceedings

The Commission can now pursue civil penalties more efficiently through the Federal Court. The Act streamlines the evidentiary requirements and clarifies the Commission’s ability to seek:

• Civil pecuniary penalties for serious contraventions (up to 10,000 penalty units)
• Injunctions to prevent ongoing or anticipated noncompliance
• Compensation orders in favour of affected participants

This gives the Commission a comprehensive toolkit, not just the ability to stop a provider’s registration, but to pursue financial accountability and participant redress.

What Hasn’t Changed

It’s worth being clear about what these expanded powers don’t mean:

• The Commission is not out to catch good faith providers on administrative technicalities
• The expanded powers are targeted at serious misconduct, deliberate fraud, and situations where participant safety is at risk
• Providers who engage openly with the Commission, cooperate with audits, and remediate issues identified are far less likely to face the more significant enforcement tools

The philosophy behind the 2026 Act is proportionality, stronger powers for stronger misconduct, used to protect participants and the integrity of the scheme.

Preparing Your Organisation

Given these changes, there are practical steps every provider should take:

Audit readiness: Treat every day as if an audit could start. That means current records, trained staff, and documented processes, not scrambling when notice arrives.

Know your obligations: Make sure your management team understands the current practice standards, the mandatory reporting obligations, and the scope of your registration.

Engage openly with the Commission: If you receive correspondence from the Commission, respond promptly and constructively. Failing to engage is noted, and delays can escalate situations that might otherwise have been manageable.

Review your governance: Who in your organisation is responsible for compliance? Do they have the authority, the resources, and the expertise to do that job? In a tighter regulatory environment, compliance cannot be an afterthought.

Get professional advice when needed: For complex compliance situations, seek advice from someone who understands NDIS regulation. Early advice is almost always cheaper than managing the consequences of getting it wrong.

The NDIS Commission’s expanded enforcement toolkit is a direct response to years of identified integrity issues within the scheme. For providers operating with genuine commitment to participant outcomes, the strengthened framework creates a better, fairer environment. For those who have been exploiting gaps in oversight, those gaps are now significantly narrowed.