Free tool

NDIS incident report template and reportable incident checker

Build a structured internal incident record, then check whether the incident may be an NDIS reportable incident and which notification timeframes apply. Nothing is sent to the NDIS Commission.

Runs in your browser. Nothing you enter is sent to AusGPT.

This tool does not notify the NDIS Commission. It builds an internal record and a screening checklist. Registered providers must notify reportable incidents through the NDIS Commission Portal and follow their own incident management procedures. If anyone is in immediate danger or needs medical help, call 000 first.

1. About this record

Is your organisation a registered NDIS provider?

2. When and where

If you don't know, leave this blank and give the time it was first identified in the description.

When a worker told key personnel, a supervisor or manager, or the person responsible for reporting. Notification timeframes run from this point.

3. People involved (by role)

Use roles, initials or IDs here. Add names and contact details in your organisation's incident management system, which the Rules require.

4. What happened

Facts in order: what was seen or heard, by whom, and when. Don't include opinions or anything nobody directly saw or heard.

Their exact words if possible.

5. Reportable incident screening

Tick every category that applies or may apply. Allegations count, and so do incidents you have already handled internally.

Did it happen, or is it alleged to have happened, in connection with NDIS supports or services your organisation provides?

"In connection with" is broad. It can include incidents outside a shift that arose from your supports, such as following a plan you wrote.

6. Immediate actions, safety and support

How they were involved in decisions so far, what they want to happen, and any support person or advocate.

7. Notifications made

Who was told, when, by whom, and any reference numbers.

8. Assessment and next steps (optional)

Could it have been prevented? How well was it managed? What remedial action is needed? Does anyone else need to be told?

One per line, with who is responsible.

General information only, not legal advice. Review the output with your own advisers before you rely on it.

This free NDIS incident report template helps you write a clear internal incident record and check, step by step, whether the incident may be a reportable incident. Answer the questions above and you get two things: a structured internal record you can copy or download, and a screening checklist with the notification timeframes worked out from when your organisation became aware.

It doesn't submit anything. Registered NDIS providers notify reportable incidents through the NDIS Commission Portal, and your own incident management procedures always come first. If someone is hurt or in danger, call 000 before you do anything else.

NDIS reportable incidents: the six categories

Reportable incidents are set out in the NDIS Act and the NDIS (Incident Management and Reportable Incidents) Rules 2018. They include alleged incidents as well as confirmed ones.

Reportable incident Notify the Commission within
Death of a person with disability 24 hours
Serious injury of a person with disability 24 hours
Abuse or neglect of a person with disability 24 hours
Unlawful sexual or physical contact with, or assault of, a person with disability 24 hours
Sexual misconduct against, or in the presence of, a person with disability, including grooming 24 hours
Use of a restrictive practice that is unauthorised by the state or territory, or not in line with the person's behaviour support plan 5 business days (24 hours if it caused harm)

Timeframes as published by the NDIS Commission, checked 9 October 2026.

A few details from the Rules and the Commission's guidance:

  • Serious injury includes fractures, burns, deep cuts, extensive bruising, head or brain injuries and any other injury requiring hospitalisation.
  • Unlawful physical contact is not reportable if both the contact and its impact on the person were negligible. The impact can be emotional or psychological, not just physical.
  • In connection with is broad. It covers incidents during supports, incidents arising from supports being provided, changed or withdrawn, and incidents later linked to the supports. You don't need to decide that your service caused the incident before notifying.

NDIS incident report timeframes

Step When What it covers
Immediate notification Within 24 hours of becoming aware Provider details, what happened, impact or harm, immediate actions (including whether police were told), who was involved
5-day form Within 5 business days of becoming aware Witnesses, further actions proposed, any information you couldn't give within 24 hours
Unauthorised restrictive practice (no harm) Within 5 business days The 5-day form is the only form needed
Significant new information As soon as reasonably practicable A change in the kind of incident, or a further reportable incident
Final report Within 60 business days of the 5-day notification, if the Commission requires one Investigation details, findings, corrective action, whether the person was kept informed

The clock starts when your organisation becomes aware. The Commission treats this as the point a worker tells key personnel, their supervisor or manager, or the person your incident management system names as responsible for notifications. The Commission says missing a timeframe might result in an infringement notice or other compliance action.

You don't have to obtain or give certain details if doing so could prejudice a criminal investigation or expose a person with disability to a risk of harm. You still notify the incident.

Who must report

  • Registered NDIS providers must notify the Commission of all reportable incidents connected with their supports, including ones they have already handled internally.
  • Key personnel, and the person named as responsible for notifications, must take all reasonable steps to make sure reportable incidents are notified.
  • Workers must tell key personnel, a supervisor or manager, or the responsible person as soon as possible.
  • Unregistered providers aren't covered by the notification duty, but must follow the NDIS Code of Conduct. The Commission says all providers should have an incident management system.

Notifying the Commission doesn't replace other duties, such as reporting crimes to police, mandatory reporting to child protection, or notifying a coroner where state or territory law requires it. If you see an incident involving another provider's supports, the Commission's guidance is to raise it with the reportable incidents team as a concern rather than lodging a notification yourself.

What your internal incident record must include

For every incident, not only reportable ones, a registered provider's incident management system must record at least:

  • a description of the incident, including the impact on or harm to the person
  • whether it is a reportable incident
  • the time, date and place it happened, or when it was first identified
  • names and contact details of the people involved and any witnesses
  • the assessment of the incident, considering the person's views
  • actions taken, including support for the person
  • consultations with the person, and whether they were given reports or findings
  • details and outcomes of any investigation
  • the name and contact details of the person making the record.

Records must be kept for 7 years. This template uses roles rather than names, so you're not typing personal details into a web page. Add names and contact details in your organisation's own system.

When you write the description, follow the Commission's advice for workers: record what the person told you in their exact words if possible, record what you saw and heard, and leave out opinions and interpretations. Our NDIS progress note builder has a language check that helps with this.

AusGPT also helps NDIS teams draft and review documents with Claude, processed in Australia. See AusGPT for NDIS providers.

Sources

  1. NDIS Commission: Reportable incidents (timeframes and how to notify)
  2. NDIS Commission: Incident management
  3. NDIS Commission: Reportable Incidents, Detailed Guidance for Registered NDIS Providers
  4. National Disability Insurance Scheme (Incident Management and Reportable Incidents) Rules 2018
  5. NDIS Commission: NDIS Code of Conduct

Frequently asked questions

What is a reportable incident in the NDIS?
A reportable incident is a serious incident, or an allegation of one, that happens in connection with the supports or services a registered NDIS provider delivers. The categories are: death of a person with disability; serious injury; abuse or neglect; unlawful sexual or physical contact with, or assault of, a person with disability; sexual misconduct, including grooming; and use of a restrictive practice that isn't authorised by the state or territory or isn't in line with the person's behaviour support plan.
What are the NDIS incident report timeframes?
For deaths, serious injuries, abuse or neglect, unlawful sexual or physical contact or assault, and sexual misconduct, the immediate notification is due within 24 hours of the provider becoming aware, followed by the 5-day form within 5 business days. An unauthorised use of a restrictive practice is notified within 5 business days, or within 24 hours if it harmed the person. If the Commission asks for a final report, it is due within 60 business days after the 5-day notification unless the Commission allows longer.
When does the 24-hour clock start?
From when the registered provider became aware of the incident. The NDIS Commission's guidance treats a provider as aware once a worker has told a member of its key personnel, their supervisor or manager, or the person named in its incident management system as responsible for notifying the Commission.
Do we have to notify an incident we've already dealt with?
Yes. The NDIS Commission says registered providers must notify all reportable incidents, including incidents they have already recorded and responded to in their own incident management system, and including allegations.
Do unregistered providers report incidents to the NDIS Commission?
The reportable incident notification duties apply to registered NDIS providers. Unregistered providers and their workers must still follow the NDIS Code of Conduct, which includes taking all reasonable steps to prevent and respond to violence, exploitation, neglect and abuse, and the Commission says all NDIS providers should have an incident management system.
Does this tool notify the NDIS Commission?
No. It builds an internal record and a screening checklist in your browser. Nothing is sent to AusGPT, the NDIS Commission or anyone else. Registered providers must notify reportable incidents through the NDIS Commission Portal and follow their own procedures.
How long do we keep incident records?
The NDIS (Incident Management and Reportable Incidents) Rules 2018 require registered providers to keep incident records for 7 years. Other Commonwealth, state or territory laws may also apply.

Keep reading

NDIS NDIS progress note builder Fill in a structured form to build a clear, objective NDIS progress note, check it for subjective or judgemental wording, then copy it or download it as Word or Markdown. Industry AI for NDIS Secure AI for NDIS providers and support coordinators. Draft progress notes, reports and incident summaries, and answer Practice Standards questions, with data kept in Australia. Security How AusGPT keeps data in Australia Where your data is stored and processed, and the controls that protect it.

Secure AI for your team, processed in Australia

Claude AI, document chat and voice dictation, with your data stored and processed in Australia. $29 per user per month.

Start free trial Talk to us