NDIS Integrity And Safeguarding Act 2026: The New Cost Of Getting It Wrong

The NDIS Integrity and Safeguarding Act 2026 introduces tougher penalties, stronger enforcement powers and new compliance obligations for providers.

The National Disability Insurance Scheme Amendment (Integrity and Safeguarding) Act 2026 (Cth) (Act) is now in force. It represents the most significant expansion of the powers of the NDIS Quality and Safeguards Commission since its establishment.

For disability service providers ¹ (DSP) (and their insurers) the message is clear: the regulatory risk profile of operating in the NDIS space has fundamentally changed.

Key Changes

Dramatically Increased Civil Penalties

The centrepiece of the reform is a major escalation in the financial consequences of non-compliance.

Civil penalties for serious contraventions of the NDIS Code of Conduct have increased from the previous maximum of approximately $412,500 (1,250 penalty units) to 10,000 penalty units per contravention (currently $3.64 million²). The provider’s overall exposure will depend on the number of contraventions established and could, in theory, reach figures over $16 million. Though, as we have seen with some cases under the previous legislation, the Court will consider the principle of totality to ensure that the total penalty does not exceed what is proper for the contravening conduct as a whole³.

Despite the commentary on the previous penalty outcomes, there was continuing concern about the adequacy of the deterrent effect during the Royal Commission and the NDIS Review. The new penalty regime is designed to ensure that, for providers operating at scale, the financial risk of non-compliance may no longer be seen as simply a cost of doing business. The underlying sentiment is to recognise the value of life and rights of people living with disability.

The Act also introduces new civil penalty provisions for conduct that was previously only subject to criminal prosecution such as providing false or misleading information to the NDIS Commission. This gives the Commission greater flexibility to pursue enforcement through civil courts where conduct is harmful but may not meet the higher evidentiary threshold for criminal proceedings. New civil penalties now also apply to refusing or failing to comply with requirements to provide information or documents to the Commission (up to 60 penalty units⁴).

Introduction of Criminal Offences

The Act introduces criminal penalties for providers operating without the required registration in high-risk support categories. Prior to this change, providing supports without registration was a civil matter. Now, an unregistered individual who provides Supported Independent Living or other designated high-risk supports faces a maximum penalty of two years' imprisonment or 120 penalty units⁵ (or both). Critically, this criminal exposure applies to individuals, not merely corporate entities. A sole trader operating an unregistered SIL service after 1 July 2026 is personally exposed to criminal prosecution with a strict liability.

Breaching a banning order is also now a criminal offence, carrying a maximum of five years' imprisonment or penalties of up to 300 penalty units⁶ (or both) with a separate civil penalty of up to 10,000 penalty units for a serious contravention.

Mandatory Registration

From 1 July 2026, all providers of Supported Independent Living and platform-based providers (now called NDIS digital platforms) delivering NDIS supports were required to be registered with the NDIS Commission.

Expanded Banning Orders

The NDIS Commission's banning order powers have been significantly broadened. The powers were previously limited to providers but can now be imposed on approved quality auditors and persons involved in providing services that enable or facilitate the provision of supports or services and including those assisting with or advising on registration applications.

This addresses the highly publicised problem of unscrupulous operators who, whilst not themselves registered providers, exert influence over service delivery and scheme integrity from adjacent roles.

Anti-Promotion Orders

For some time, the Commission has been working with the Australian Competition and Consumer Commission (ACCC) to identify advertising that may be in breach of the Australian Consumer Law. This is a current priority of the ACCC.A breach of he Australian Consumer Law could result in additional or alternative penalty exposure.

The Act gives new enforcement powers to allow the Commissioner to make orders prohibiting or restricting a person from engaging in certain promotional conduct in connection with the NDIS. These orders are designed to impact businesses that advertise NDIS supports in ways that undermine the scheme's integrity or that mislead participants into misusing their funding.

Breach of an anti-promotion order carries a civil penalty of 250 penalty units⁷.

In addition, the Commission can issue these orders while investigations are underway in order to protect participant safety and scheme integrity, which could effectively silence a provider's marketing operations during a compliance action.

The changes expand the range of enforceable actions for promotional material in the disability sector.

Enhanced Whistleblower Protections

The Act strengthens safeguards for anyone reporting unsafe or unlawful practices, including workers, participants, and families. It removes the previous requirement for a whistleblower to provide their name and to act in good faith when making a disclosure.

Disclosing the identity of, or information that could lead to the identification of, a protected whistleblower now attracts a civil penalty of 30 penalty units⁸.

These protections are not unfamiliar and largely align with the whistleblower framework under the Aged Care Act and will require disability support providers to review and update their internal whistleblower policies and procedures.

Strengthened Monitoring and Compliance Powers

The Commission's information-gathering powers have been modernised and enhanced by the introduction of mandatory electronic claim forms to help prevent fraud and misuse. This ought to enable faster intervention where participant safety is at risk.

Implications

For Providers

The combined effect of higher civil penalties, criminal exposure, expanded banning orders, and the new anti-promotion power means the Commission holds a more robust enforcement toolkit.

For providers operating at scale, the financial risk of non-compliance has dramatically increased.

Providers should immediately review their compliance frameworks, marketing materials, registration status, and internal complaint-handling and whistleblower procedures.

The introduction of civil penalty alternatives to criminal prosecution also means that enforcement actions are likely to become more frequent. Where the Commission previously may have declined to pursue matters that did not justify the cost and complexity of criminal proceedings, civil penalty proceedings and infringement notices may provide a proportionate mechanism to hold providers accountable.

This reduced procedural complexity combined with the lower burden of proof in civil cases (being on the balance of probabilities) materially expands the range of cases capable of establishing a contravention of the Act.This may result in a cost saving for the Commission and improve their prospect of a successful action.

Whilst it may also be intended to be administratively efficient, that may also depend on resourcing at the Commission.

Governance considerations

Directors, managers, and sole traders should understand that the criminal penalty provisions expose individuals personally. Any perception that administrative type errors carry modest civil consequences ought to be re-set with these changes.

Legal advice should be obtained promptly where there is any doubt about a DSP’s obligations.

For Insurers

From an indemnity and claims management perspective, the reforms create a materially different risk landscape.

The potential for a multi-million dollar civil penalty and criminal prosecution fundamentally alters the exposure calculus for underwriters of DSPs.

Insurers should also anticipate a greater frequency of enforcement actions and the potential for larger settlement demands from the Commission in negotiated outcomes.

The expansion of banning orders to non-provider actors (auditors, consultants, facilitators) also broadens the population of insured persons who may face regulatory action, with consequences for policy coverage and notification obligations.

Conclusion

The Act represents a shift in the regulatory architecture of the NDIS, transforming the Commission from what many in the sector regarded as an under-resourced and under-powered regulator into one better equipped to regulate the sector. The reforms follow recent changes to the aged care regime and align the approach more closely with the work health and safety regulatory model.

For providers and their insurers, the imperative is preparation. Those who proactively invest in robust governance, compliance systems, documented policies, and registered service delivery will be well-positioned. Now is a good time to establish those models and mitigate risks, while the Commission positions itself to draw upon its new powers and pathways to ensure regulatory compliance.

Footnotes

1. See for example: a penalty of $1.1M plus costs in Commissioner of the NDIS Quality and Safeguards Commission v Oak Tasmania [2026] FCA 7; a penalty of $2.2M plus costs in Commissioner of the NDIS Quality and Safeguards Commission v Aurora Community Care Pty Ltd (in liquidation) (No 2) [2025] FCA 1237; a penalty of $2.5M plus costs in Commissioner of the NDIS Quality and Safeguards Commission v Lifestyle Solutions (Aust) (Hakone House proceeding) [2025] FCA 1393; a penalty of $1.8M plus costs in Commissioner of the NDIS Quality and Safeguards Commission v Livebetter Services Ltd [2024] FCA 374

2. At the time of publication, a Commonwealth penalty unit is $364. This is indexed annually and will be next revised at 1 July 2027.

3. Commissioner of the NDIS Quality and Safeguards Commission v Livebetter Services Ltd [2024] FCA 374 paragraph 40.

4. Currently $21,840.

5. Currently $43,680.

6. Currently $109,200.

7. Currently $91,000.

8. Currently $10,000.