Four Federal Court penalties made headlines in the disability sector over the past eighteen months: $1.1 million against Oak Tasmania, $1.8 million against Livebetter Services, $2.2 million against Aurora Community Care, and $2.5 million against Lifestyle Solutions over its Hakone House service, according to case summaries reported by Mondaq. Those penalties were handed down under the old rules.

Under the new ones, the ceiling is higher, the regulator has more reach, and more people inside a provider organisation can be held personally accountable. The NDIS Integrity and Safeguarding Act 2026 rewrote large sections of the National Disability Insurance Scheme Act 2013, and it is already in force. If you run an NDIS provider business, whether you employ three support workers or three hundred, this is the piece of legislation your compliance plan needs to be built around for the rest of the year.

This article breaks down what actually changed, when each part takes effect, what it costs to get wrong, and what a provider team should be doing differently starting now.

What the Act actually is, and why it exists

The National Disability Insurance Scheme Amendment (Integrity and Safeguarding) Act 2026 received Royal Assent on 8 April 2026, following its passage through Parliament, as confirmed on the official NDIS legislation page. It is the second major tranche of NDIS reform, built directly on the findings of the Disability Royal Commission and the Independent Review of the NDIS, according to analysis published by MinterEllison. In plain terms, both reviews found the same thing: the scheme’s regulator did not have enough power to stop bad actors before harm occurred, and people who tried to report problems were not adequately protected. This Act is the legislative response.

The full text of the Act is available on the Federal Register of Legislation, and the Department of Health, Disability and Ageing has published a plain-language overview for providers who want the source material rather than a summary.

A quick sense of scale. The market this Act now regulates is not small. NDIS providers generated an estimated $44.7 billion in market revenue in 2025, and as of the first quarter of the 2025 to 2026 financial year there were roughly 17,374 registered providers competing alongside 257,318 unregistered ones, per NDIA data cited by Provider+. Registered providers make up only about 6% of that total headcount, yet they carry the bulk of the new compliance obligations described below.

The three schedules, and when each one starts

The Act is not one single switch that flips on 8 April. It is structured into three schedules, and each commences on a different date. Getting this timeline wrong is an easy way to miss an obligation.

Schedule	What it covers	Commencement date
Schedule 1	Expanded powers for the NDIS Quality and Safeguards Commission: new penalties, broader banning orders, anti-promotion orders	9 April 2026
Schedule 3	Whistleblower protection reforms	9 April 2026
Schedule 2	NDIA operational changes: electronic claiming, participant withdrawal process	6 May 2026

Source: MinterEllison legislative summary. A related but separate reform, the mandatory Supported Independent Living Practice Standards, also lands on 1 July 2026 and is worth tracking alongside this Act even though it comes from a different instrument.

Key commencement dates for the NDIS Integrity and Safeguarding Act 2026

The new penalty regime: what “serious contravention” actually means

The single biggest structural change in the Act is the introduction of a new legal concept: the serious contravention. A contravention is classified as serious if it involves either a significant failure by the provider or a systematic pattern of conduct, and the framework is closely modelled on the Aged Care Act 2024, according to MinterEllison’s analysis. A serious contravention now attracts a civil penalty of up to 10,000 penalty units, which at the current penalty unit value works out to $3,300,000.

That is not the only new number providers need to know. The Act introduced or increased several other penalties at the same time:

Contravention	Maximum penalty
Serious contravention	Up to $3,300,000 (civil)
Breaching a banning order	Up to 5 years imprisonment or $99,000, or both
Anti-promotion order breach	$82,500 (civil)
Providing unregistered supports (criminal offence)	Up to 2 years imprisonment or $39,600, or both
Knowingly giving false or misleading information	$39,600 (civil)
Providing unregistered supports (strict liability)	$19,800
Failing to comply with an information-gathering notice	$19,800 (civil)
Unauthorised disclosure of a whistleblower’s identity	$9,900 (civil)

Source: MinterEllison, current as at penalty unit values in force from 8 April 2026.

Maximum civil penalties under the NDIS Integrity and Safeguarding Act 2026

Two things stand out in that table. First, the gap between the lowest and highest penalty is enormous, which tells you the regulator is now designed to scale its response to the actual severity of the conduct rather than applying one blunt penalty across the board. Second, several of these obligations, like responding properly to an information-gathering notice, are administrative rather than clinical. A provider can be exposed to a $19,800 penalty purely because a records request was not actioned in time, which has nothing to do with the quality of care being delivered and everything to do with how organised the back office is.

Banning orders now reach further, and anti-promotion orders are brand new

Before this Act, banning orders were mostly aimed at individual workers directly involved in providing supports. That scope has been broadened to also cover quality auditors and other people who facilitate the provision of supports, not just the person delivering the service, as outlined in the MinterEllison summary. If your organisation relies on independent auditors or facilitators as part of how it operates, that relationship now sits inside the Commission’s enforcement perimeter.

The Act also creates an entirely new tool: the anti-promotion order. The NDIS Quality and Safeguards Commissioner can now prohibit or restrict a person from engaging in specified promotional conduct connected to the NDIS, aimed squarely at providers making misleading claims or marketing supports in ways that undermine trust in the scheme, per Mondaq’s legal analysis. Breaching one carries a civil penalty of $82,500. Worth noting for marketing and intake teams specifically: this order can be issued while an investigation is still underway, meaning a provider’s advertising or lead generation activity could be restricted before any finding of wrongdoing is finalised.

Whistleblower protections got sharper teeth

Schedule 3 rewrites how the NDIS Act treats people who report wrongdoing, and the changes go two directions at once: it is now easier for someone to safely raise a concern, and harder for anyone to punish them for doing so.

On the “easier to report” side:

• The list of people who can make a protected disclosure has been widened to include additional categories of current and former workers, as detailed in the Department of Health’s Auslan overview document.
• Disclosures can now be made anonymously, so a worker or participant does not have to attach their name to a report.
• The previous requirement that a disclosure be made “in good faith” has been removed, which simplifies the test for whether a disclosure qualifies for protection.

On the “harder to punish” side, unauthorised disclosure of a whistleblower’s identity now carries its own civil penalty of $9,900, with limited exceptions such as disclosures to the Commissioner, law enforcement, legal practitioners, or with the whistleblower’s own consent.

For a provider, this means your whistleblower policy from last year is very likely out of date. If it still requires a name attached to a complaint, or still asks the discloser to demonstrate good faith, it does not reflect the current law.

What actually changes in day-to-day operations

Schedule 2 is the least dramatic of the three schedules in terms of penalties, but it is the one most likely to touch your rostering, billing, and intake workflows directly.

Electronic claiming becomes the default. The NDIA is moving toward an entirely electronic claiming system, requiring providers to lodge payment claims through the Agency’s online systems and digital channels, according to Gilbert + Tobin’s regulatory update. Providers still reconciling claims manually or through spreadsheets are working against where the system is heading, not with it. We have covered exactly what this shift means for billing teams, including timing and practical preparation steps, in a separate post on the NDIS electronic claims mandate.

Participant withdrawal now has a formal, protected process. A participant who wants to leave the scheme must submit a written request to the NDIA’s CEO, who must then provide written acknowledgement setting out the consequences of leaving. A cooling-off period of at least 90 days applies, during which the participant can cancel the withdrawal at any time, per MinterEllison. Providers supporting a participant through this decision should know the process exists and how long it runs, particularly for continuity of care planning.

What providers should actually be doing right now

Reading the Act is one thing. Translating it into a working compliance posture is another. Based on what actually changed, here is the practical checklist worth running through this month:

• Update your whistleblower policyto remove any “good faith” requirement and to explicitly allow anonymous disclosures.
• Audit who can access and respond to information-gathering notices, and confirm someone in your organisation can turn one around quickly. A late response is now its own penalty, separate from whatever the notice was actually investigating.
• Review promotional and marketing materialagainst the new anti-promotion order power, especially anything that makes claims about outcomes or compares your service to a competitor’s.
• Map every third-party auditor and facilitatoryour organisation works with, since banning orders now reach that group too.
• Confirm your billing workflow is ready for electronic claiming, rather than waiting until it becomes unavoidable.
• Brief your team, not just your compliance lead, since several of the new obligations (like responding to information requests) sit with operations and admin staff, not just clinical leadership.

None of this is a one-off project. It is an ongoing operational discipline, and it is exactly the kind of thing that becomes unmanageable across spreadsheets and disconnected tools once your organisation grows past a handful of staff. This is the gap our compliance workspace inside the Inclusify platform is built to close: a single, auditable record of policies, disclosures, and information requests, rather than a folder structure only one person understands. If you are earlier in the process of getting audit-ready more broadly, our guide on NDIS audit readiness is a useful next read.

Frequently asked questions

When did the NDIS Integrity and Safeguarding Act 2026 start?

It received Royal Assent on 8 April 2026. Schedules 1 and 3 (Commission powers and whistleblower protections) started the next day, 9 April 2026. Schedule 2 (NDIA operational changes, including electronic claiming) started on 6 May 2026, as confirmed by MinterEllison.

What is the maximum penalty under the Act?

A serious contravention, meaning a significant failure or a systematic pattern of misconduct, carries a civil penalty of up to 10,000 penalty units, currently $3,300,000, per the MinterEllison summary.

Does the Act apply to unregistered providers?

Yes. The Act introduces new tiered offences specifically for providing, or holding out as able to provide, NDIS supports without registration, including a criminal offence carrying up to two years’ imprisonment.

What is an anti-promotion order?

A new power letting the NDIS Quality and Safeguards Commissioner prohibit or restrict a provider’s promotional conduct connected to the NDIS, intended to stop misleading marketing claims. It can be issued while an investigation is still ongoing.

Can NDIS whistleblowers report anonymously now?

Yes. Under Schedule 3, disclosures can now be made anonymously, and the previous requirement that a disclosure be made in good faith has been removed.

The bottom line

The NDIS Integrity and Safeguarding Act 2026 is not a minor compliance update to file away. It rebuilds the regulator’s enforcement toolkit from the ground up, and it does so at a moment when the NDIS Quality and Safeguards Commission has already shown, through penalties in the millions of dollars, that it is willing to use the powers it has. Providers who treat this as a legal team problem rather than an operational one are going to find the gap between the two closing fast.

If you want to see how Inclusify helps provider teams turn obligations like these into a repeatable operational routine rather than a once-a-year scramble, our platform overview walks through the compliance, workforce, and claims tools in one place, and our pricing page shows what that looks like at each stage of growth.