Compliance & risk

New NDIS laws: what registered and unregistered providers need to know

Major changes to the NDIS have now become law, with new requirements being introduced progressively from August 2026. For providers, the overall direction is towards better record keeping, tighter claiming rules, greater visibility of unregistered providers and expanded mandatory registration for some supports. But this does not mean every unregistered provider suddenly needs to become registered or undergo an audit. Here are the main things providers should know.

Updated 24 August 2026

1. More unregistered providers will eventually need to register

Currently, many providers can remain unregistered if they work with self-managed or plan-managed participants. That is not disappearing completely.

However, the Government has confirmed that mandatory registration will progressively expand to providers delivering supports considered higher risk. Examples given so far include:

• personal care
• daily living supports
• supports delivered in closed settings.

The expanded registration system is expected to begin rolling out from 1 July 2027 and continue progressively through to 2030. The complete list of supports requiring registration has not yet been finalised.

So, if you're currently an unregistered support worker or provider, there is no need to assume you must register immediately. But if you provide personal care, daily living or other higher-risk supports, this is something you should be watching closely.

Australian Government - NDIS changes

2. Most providers will eventually need to enrol with the NDIA

One of the biggest changes for unregistered providers is provider enrolment. Enrolment is different from registration.

From 1 July 2027, the Government intends to progressively require most NDIS providers to provide identifying information to the NDIA and nominate a validated bank account for receiving NDIS payments.

This means a provider could potentially remain unregistered, but still need to be enrolled with the NDIA. The purpose is to give the NDIA greater visibility over who is actually receiving NDIS funding. The exact enrolment process is still being developed.

3. Providers will need to keep records for seven years

This is one of the clearest new compliance requirements.

From 27 August 2026, providers will be required to retain prescribed records relating to NDIS claims and payments for generally seven years. The detailed rules will determine exactly which records must be kept.

For most providers, though, the practical message is simple: if you claim for a support, you should be able to show that the support was actually delivered.

Good records may include things such as invoices and other evidence supporting the service provided, depending on the type of support and the final rules. Poor record keeping can become particularly important if the NDIA questions whether a provider was entitled to a payment.

Importantly, a missing record does not automatically mean a provider must repay the claim. The legislation also considers whether the provider can otherwise demonstrate that they were entitled to the payment.

Federal Register of Legislation - NDIS Amendment Act 2026

4. The claiming deadline is dropping to 90 days

From 1 December 2026, the timeframe for making an NDIS claim will reduce from two years to 90 days after the support is delivered.

For providers, this means letting invoices and claims sit for months could become a much bigger problem. It's worth making sure your invoicing, reconciliation and claiming processes are organised before the new timeframe starts.

5. Unregistered providers are still regulated

A common misconception is that an unregistered provider isn't really regulated by the NDIS Commission. That's not correct.

Both registered and unregistered providers must comply with the NDIS Code of Conduct. This includes requirements around:

• participant rights
• privacy
• safe and competent support
• honesty and transparency
• preventing abuse, neglect and exploitation
• responding to safety concerns.

The NDIS Commission can take compliance action against unregistered providers, including banning providers or workers from delivering NDIS supports.

Registered providers simply have additional obligations, including the NDIS Practice Standards and, depending on their registration, requirements relating to incidents, complaints, worker screening, governance and audits.

NDIS Commission - Code of Conduct

6. Does this mean more providers will be audited?

Potentially - but it is important not to overstate this.

There is no new rule saying every unregistered provider must now undergo an NDIS audit. However, if a provider is eventually required to become registered, they will need to satisfy the registration requirements that apply to their supports.

Under the current system, registration can involve either a verification audit or a more detailed certification audit, depending on the types of supports being provided. Exactly what audit requirements will apply to providers brought into mandatory registration from 2027 has not yet been completely finalised.

Separately, the NDIA and NDIS Commission are also receiving stronger information-gathering and compliance powers. That doesn't mean providers should expect random audits every week. It does mean providers should be prepared to produce evidence supporting their claims and services if they are ever questioned.

7. Be careful with gifts and incentives

From 20 November 2026, new rules will restrict providers from offering benefits designed to encourage participants to:

• sign up with them
• remain with them
• purchase additional supports
• increase the amount of supports they use.

Cash and cash-like incentives such as gift cards and vouchers are specifically addressed by the legislation.

There are exceptions for legitimate pricing practices and some other situations, so this does not mean every discount or promotional item is automatically prohibited. But providers using sign-up bonuses, referral rewards or participant incentives should review those arrangements.

8. Registered providers should stay audit-ready

For providers who are already registered, the new legislation doesn't replace your existing compliance requirements. You still need to meet the NDIS Practice Standards relevant to your registration.

For certification providers in particular, auditors may look beyond whether you have a policy document. They can review whether your systems are actually being used - including records, registers, complaints, incidents, worker files and evidence of how supports are delivered.

The safest approach is to treat compliance as an ongoing part of running the business rather than something to fix immediately before an audit.

NDIS Commission - Quality audits

What should providers do now?

There is no need to panic or register for things that do not yet apply to you. But providers should start making sure the basics are right.

For both registered and unregistered providers:

• keep accurate evidence of supports delivered
• keep invoices and records organised
• make sure claims accurately reflect the service provided
• prepare for the 90-day claiming deadline
• understand your obligations under the NDIS Code of Conduct
• review participant incentives or referral rewards
• monitor announcements about provider enrolment and mandatory registration.

If you're already registered, continue maintaining the policies, systems and evidence required for your registration and audits. If you're unregistered, keep an eye on which supports are eventually classified as requiring mandatory registration.

The key takeaway

The biggest change may be that being unregistered will increasingly no longer mean being largely invisible to the NDIA.

Provider enrolment, stronger record-keeping requirements, shorter claim timeframes and expanded mandatory registration will give the NDIA and NDIS Commission greater oversight of the provider market.

That does not mean every small provider needs to become registered. It does mean that whether you're a registered organisation or an independent unregistered support worker, having proper records and being able to demonstrate that your NDIS services and claims are legitimate is becoming increasingly important.

Key dates

• 27 August 2026 - new record-keeping and compliance provisions commence
• 20 November 2026 - provider inducement restrictions commence
• 1 December 2026 - 90-day claiming deadline commences
• From 1 July 2027 - provider enrolment and expanded mandatory registration begin rolling out
• By December 2030 - Government intends to complete the expanded registration rollout

Where Bluetail fits

If the changes eventually bring your supports into mandatory registration - or you just want your records in better shape before the new rules bite - you don't have to work it out alone, and you don't have to pay a consultant thousands either.

• The free DIY registration guidewalks the whole registration process step by step, for both the verification and certification pathways - so if registration is coming your way, you can see exactly what's involved before spending anything.
• The registration document pack covers the document side - 73 editable policies, agreements, registers and forms, pre-filled with your business details, for a one-off $65. Preview every document free first.
• The Bluetail CRMhelps with exactly what the new laws emphasise: records of the supports you actually delivered - shift notes, incident and complaint registers, worker files and invoicing - so evidence exists as you work rather than being reconstructed later. It's free to use in full until at least January 2027 while in early access.
• And the DIY NDIS Registration Facebook group is a free community of providers working through registration themselves - ask questions, compare notes and keep up with changes like these as more detail lands.

To be clear about what these do and do not do: the guide, documents and CRM help you prepare and keep records. They do not register you, make you compliant on their own, or guarantee you will pass an audit - and Bluetail is not affiliated with, endorsed by or approved by the NDIA or the NDIS Quality and Safeguards Commission.

This article provides general information based on legislation and Australian Government guidance available as at 24 August 2026. Some implementation details, including the supports that will require mandatory registration, are still being developed. It is not legal, financial or compliance advice, and Bluetail is not affiliated with the NDIS Commission or the NDIA.