Eight years into this sector, and I can genuinely say I’ve never seen the regulatory ground shift this fast. I’ve been through registration renewals, practice standard updates, and the usual slow grind of paperwork that comes with running a provider business — but what’s happening right now with registration and compliance isn’t a tweak. It’s a structural rebuild of who gets to operate in this space, and if you’re a provider, registered or not, you need to be paying close attention.
Where this started
Here’s a number that surprised even me when I first saw it: prior to this year’s changes, only around 8% of NDIS providers were actually registered with — and therefore visible to — the Quality and Safeguards Commission. Think about that for a second. Over ninety percent of the market has been operating with essentially no direct oversight from the regulator. The government’s stated goal now is to bring that up to around 90% registered over time, which tells you how far this is going to go, and how fast.
The first wave landed on 1 July 2026: Supported Independent Living (SIL) providers and NDIS digital platform providers must now be registered, full stop, with no exemption left for operating unregistered. This isn’t a suggestion or a “best practice” recommendation — it’s now backed by real teeth. The NDIS Amendment (Integrity and Safeguarding) Act 2025 introduced criminal penalties for operating without registration where it’s required, civil penalties of up to $15 million for serious misconduct, and banning powers that now extend to auditors and consultants, not just providers themselves.
Why the regulator is moving this hard
I understand the instinct some providers have to feel targeted by all this, but honestly, having worked both sides of this sector — support work on the ground and running a business — I think the reasoning holds up. SIL and platform-based services touch some of the most vulnerable participants in the Scheme, often in closed, high-intensity settings where there’s little external visibility into what’s actually happening day to day. When I think back to some of the operators I’ve seen come and go over the years — the ones with no real systems, no real oversight, just enough charm to win a few clients — this is exactly the kind of gap that’s been left open for too long.
There’s also a specific abuse the Commission moved to close alongside the July wave: the sale of pre-registered “turnkey” NDIS businesses, some advertised for up to $120,000, explicitly marketed as a way to skip the six-to-twelve month registration process entirely and start operating immediately. If you’ve ever wondered how some genuinely questionable operators seemed to appear out of nowhere with full registration already in place, that’s likely how. That loophole is now closed.
What’s already locked in, and what’s coming
If you’re delivering SIL or running a platform-based service, you needed to be registered from 1 July 2026 — that ship has sailed, and if you’re still unregistered, you need to move on this immediately, not “when I get to it.”
Beyond that first wave, the direction of travel is clear even where the detail isn’t finalised yet:
- Personal care and daily living supports are next in line. The government has flagged mandatory registration expanding to these “high-risk supports” progressively between 2027 and 2030. This hasn’t been legislated yet, but Minister Butler flagged the intent directly in an April 2026 address, so I wouldn’t treat this as speculative — I’d treat it as a matter of when, not if.
- Support coordination was originally on the list for mandatory registration too, but that particular reform has been paused for now. Worth watching, not worth ignoring.
- Already-registered providers aren’t off the hook either — the Commission is shifting toward continuous compliance monitoring rather than periodic audits, meaning registration renewal now demands active, ongoing evidence of compliance rather than scrambling to pull records together once every few years.
- Notification timeframes are shortening. Draft amendments will tighten how quickly providers must notify the Commission of certain events and changes, with stronger requirements specifically around changes of business ownership.
What continuous compliance actually means for your business
This is the part I think catches providers off guard the most. The old model — get through your audit, file it away, mostly forget about it until renewal — doesn’t work anymore. The Commission’s direction is toward real-time, embedded compliance: documentation that reflects what’s actually happening in service delivery day to day, not policies that look good on paper but don’t match how your business actually runs.
In practice, that means:
– Your policies need to reflect real operations, not a generic template you downloaded and never customised
– Documentation needs to be current and accessible, not reconstructed from memory when an auditor asks
– Worker qualification tracking, incident records, and service delivery evidence need to exist as ongoing systems, not end-of-year cleanup jobs
I’ve seen enough providers get caught out at audit time to know the common failure points aren’t usually dramatic — they’re mundane. Registers not maintained. Internal audits started but never finished. Participant files half-complete. None of that is scandalous, but all of it fails an audit under the new scrutiny.
What I’d actually do if I were you right now
If you’re a SIL or platform provider and you’re not yet registered, this is not a “get to it next quarter” item. Registration typically takes three to twelve months from application to approval once you factor in engaging an approved quality auditor and getting your internal policies genuinely audit-ready. Every month of delay is a month closer to operating in breach.
If you deliver personal care or daily living supports, start preparing now even though the legislation isn’t finalised. Waiting for the exact date to be confirmed before you start building audit-ready systems means you’ll be racing the clock when it finally lands — and given the SIL rollout gave the sector a template for how fast these deadlines can move, I wouldn’t bank on a long runway.
If you’re already registered, shift your mindset from “audit season” to “always audit-ready.” Build compliance into how your team actually operates day to day — rostering systems that track qualifications automatically, incident reporting that happens at the point of care rather than at the end of the week, documentation that’s genuinely current rather than backfilled.
Budget for it properly. Registration costs — audits, compliance documentation, governance systems — run anywhere from a few thousand dollars to $15,000 or more depending on your size and service types. That’s not a number to discover partway through the process.
My honest take
I’ve got no sympathy left for operators who’ve spent years cutting corners because the oversight simply wasn’t there — I’ve watched too many participants get let down by exactly that gap to feel anything but relief that it’s closing. But I do think the sector needs to be realistic about the cost this places on smaller, genuinely good providers who’ve been doing the right thing without the resources of a big organisation behind them. Registration and continuous compliance aren’t free, and if the Commission wants 90% of the market genuinely regulated, there needs to be real support — not just enforcement — for the small operators trying to do this properly on tight margins.
What I keep telling my own team, and what I’d tell any provider reading this: the providers who treat this as an opportunity to actually tighten up their operations, rather than a box-ticking burden, are going to come out the other side stronger and more trusted by participants and coordinators alike. The ones who wait and hope it blows over are the ones I’d worry about.
I’ll keep tracking how the personal care and daily living registration timeline firms up, because that’s the wave that’s going to touch the largest number of providers in this sector — including, quite possibly, you.