If you’re an NDIS provider, your risk profile has changed.
Federal Parliament has passed the NDIS Amendment (Integrity and Safeguarding) Bill 2025 into law, giving the NDIS Quality and Safeguards Commission stronger enforcement powers, much higher penalties and new criminal offences for serious misconduct.
At the risk of stating the obvious, this is a clear and inevitable shift from “education first” to enforcement with real consequences.
What’s changed (plain language)
- Much higher civil penalties. The Commission has pointed to increases from a maximum of $412,500 to more than $15 million when a participant is hurt or injured under a provider’s care. Government messaging during the Bill’s introduction also flagged potential fines of over $16 million for serious contraventions.
- New criminal offences, including up to 5 years’ imprisonment for delivering supports that require registration without being registered, and for breaching a banning order.
- Broader banning powers, including the ability to ban auditors and consultants, not just providers and workers.
- Marketing is now higher risk. The Commission can use anti-promotion orders to restrict promotional conduct that undermines the integrity of the scheme.
- Faster information demands. The legislation supports shorter timeframes for providing information and documents and strengthens information-gathering powers.
The point that many providers may miss
This is aimed at bad actors, yes. But every provider will feel the impact of these new laws.
The real risk is no longer in “doing the wrong thing”; it is in having gaps you cannot see, or cannot prove you have closed, when the regulator comes knocking.
What you can be doing now
1) Make compliance an operating system (not a folder)
- Map the participant journey end-to-end
- Identify harm points and assign owners
- Put simple checks into daily practice
2) Stress test one serious incident scenario
Pick one realistic scenario and rehearse it properly:
- who notices
- who escalates
- who stabilises safety
- who documents
- who notifies
If it is messy in rehearsal, it will be worse in real life.
3) Tighten your boundaries
- Confirm your registration matches what you deliver and market
- Remove low-value services that add compliance risk
- Do not let subcontracting blur accountability (or, to put it another way, you have at least shared responsibility for what your subbies do and don’t do).
4) Upgrade evidence, not paperwork
Move from “we have a policy” to “we can prove it was used”:
- supervision notes
- competency sign off
- incident follow-up
- consent and choice records
5) Clean up marketing and referral practices
Assume marketing will be tested:
- lead generation deals
- referral incentives
- coercive “free” offers
- claims that imply guaranteed outcomes
6) Build a regulator response pack
One place you can pull quickly:
- incident registers
- training records
- audits
- governance minutes showing oversight
MGA’s take
The focus of many in discussing this legislation is going to be on the new penalties, which are significant; there’s no doubt. But it should also be about confidence.
The providers who thrive will be the ones who can say, “Here is how we keep people safe while supporting their right to exercise choice and control, and here is the evidence.”
If you want to talk it through
At Management Governance Australia, we’ve worked with providers to get practical about:
- board-ready risk mapping
- incident and complaints uplift
- marketing and referral risk reviews
- regulator readiness packs
If you’d like a sounding board, please have a chat with us at MGA. Happy to compare notes and share what we’re seeing.
David Moody
Consultant & Head of Strategic Relationship, MGA Group
#NDIS #Safeguarding #Governance #DisabilityServices #RiskManagement #QualityAndSafety