R1 — Regulatory Pathway Research: NDIS Provider Registration (Victoria, as at August 2026)

Prepared under AI Project Governance Standard v3.7, project class STANDARD. Serves REQ-SYS-02, REQ-SYS-03, REQ-CON-01. Research date: 2026-08-20.

1. Current registration pathways and audit types; registration groups

The NDIS Quality and Safeguards Commission operates two audit pathways for provider registration:

• Verification audit — a lower-intensity, desktop-style review, applied to registration groups assessed as lower risk.

• Certification audit — a two-stage audit (Stage 1 desktop/documentation review, Stage 2 on-site review) against the NDIS Practice Standards, applied to higher-risk registration groups.

The NDIS Commission's own registration-groups page (fetched successfully) lists 36 registration groups ("classes of support"), split as:

• Certification-audit groups (13): 0102, 0104, 0106, 0107, 0110, 0115, 0117, 0118, 0125, 0131, 0132, 0133, 0136

• Verification-audit groups (23): 0101, 0103, 0105, 0108, 0109, 0111, 0112, 0113, 0114, 0116, 0119, 0120, 0121, 0122, 0123, 0124, 0126, 0127, 0128, 0129, 0130, 0134, 0135

Rule noted on that page: if an application spans both certification- and verification-linked groups, the whole application must go through certification audit.

I was not able to directly fetch the NDIS Commission's "types of audit" page (.../apply-registration/types-audits) or the "NDIS Practice Standards" page (.../rules-and-standards/ndis-practice-standards) — both returned a ROBOTS_DISALLOWED error on repeated attempts, including a retry. The registration-groups page on the same domain fetched successfully, so this appears to be a page-specific access issue, not a whole-domain block. Stage 1/Stage 2 audit content below (Q5) is therefore sourced from secondary industry pages that themselves describe the same Commission process, not from the primary Commission audit-type page — flagged Medium confidence accordingly.

2. STATUS OF REGISTRATION REFORM — what is actually law as at August 2026

This is a fast-moving and layered picture. Distinguishing law / in force vs announced vs still-proposal:

A. Mandatory registration for SIL and NDIS digital platform providers

• Status: Announced policy, in a transition/commencement window, not confirmed by primary sources as having passed as amended Rules text. The Minister for the NDIS announced (reported as "late 2025" / "December 2025" across sources) that providers delivering Supported Independent Living (SIL, support item 0138) and NDIS digital platforms (0137) must become registered.

• Commencement date cited on the NDIS Commission's reform-hub page: 1 July 2026.

• A separate NDIS.gov.au news article (published 9 June 2026) states providers must be registered, or have an application submitted, by 1 October 2026.

— These two dates are not obviously reconcilable from the sources I fetched (possibly "reform starts" 1 July vs "compliance deadline" 1 October) — flagged as a discrepancy requiring the primary Rules instrument to resolve.

• New SIL-specific Practice Standards are described as "being developed."

• Support coordination mandatory registration has been paused / deferred, not implemented, per industry secondary source (Team DSC) — I could not independently confirm this against a primary government source within the effort ceiling; treat as Medium confidence.

B. NDIS Amendment (Securing the NDIS for Future Generations) Bill 2026

• Status: PASSED Parliament — confirmed via ndis.gov.au ("Securing the NDIS for future generations" page, fetched successfully).

• Passage reported as 19 August 2026 (i.e., the day before this research was conducted), commencing 7 days after Governor-General's assent (Royal Assent), with staged implementation running through to July 2028.

• Relevant to registration: this Act creates authority to expand mandatory registration requirements from July 2027 to further categories of providers — specifically those delivering personal care, daily living supports, and "supports provided in closed settings." This is a further, later tranche beyond the SIL/platform-provider reform in 2A above.

• It also references future "community consultation" on differentiated pricing for unregistered providers — i.e. not yet implemented, still proposal-stage.

• It introduces new record-keeping retention obligations (providers 7 years, participants 3 years, nominees 5 years) from commencement.

• It is not, on the sources sighted, a wholesale enactment of the 2023 NDIS Review's full graduated risk-proportionate registration model — that broader model (as recommended by the NDIS Review and detailed by the 2024 NDIS Provider and Worker Registration Taskforce) remains only partially implemented, via these two separate, staged reforms (SIL/platform now, personal-care/closed-settings from mid-2027).

Bottom line for Victoria new-provider planning: as at August 2026, mandatory registration is a live, commencing obligation only for SIL and NDIS digital platform providers (2026 window); a second wave covering personal care / daily living / closed-settings providers is legislated to start July 2027; the general graduated/tiered registration framework recommended by the Review is not shown, in the sources gathered, to be fully in force yet.

3. Unregistered providers — what they can legally do in 2026

Per ndis.gov.au "Guide to working with providers" (fetched successfully, page states last updated 17 June 2026):

• Unregistered providers can deliver supports to:
• Self-managed participants (full discretion).
• Plan-managed participants, where a registered plan manager administers the funding.

• Unregistered providers cannot be used for:
• NDIA-managed (agency-managed) portions of a plan — a registered provider is mandatory here.
• Specialist Disability Accommodation (SDA) supports.
• Regulated behaviour supports (must be delivered by a registered provider).

• This is layered on top of the emerging mandatory-registration-by-service-type reforms in Q2: once SIL/platform mandatory registration takes effect, an unregistered SIL/platform provider will not be able to operate in that service type regardless of the participant's management type.

4. Application process, fee, and observed timeframes

From the NDIS Commission's own "Apply for registration" page (fetched successfully):

1. Confirm eligibility; ensure workers in risk-assessed roles hold worker-screening clearances; obtain a PRODA account; gather key-personnel and service documentation.

1. Complete the online application in the NDIS Commission Applications Portal, including self-assessment against the Practice Standards and suitability questions. The application must be completed within 60 days or it is deleted.

1. Engage an independent Approved Quality Auditor (AQA) at the applicant's own cost to conduct the quality audit; the applicant receives an Initial Scope of Audit document.

1. NDIS Commission reviews the auditor's recommendation and assesses suitability; may request more information.

1. Decision notified (approval/refusal), with a chance to respond before a refusal is finalised.

1. Certificate issued, stating registered service groups, registration period, and any conditions.

Fee: The Commission's own application page, as fetched, does not mention any application fee. All costs described are the applicant's audit fees paid to the AQA. I could not find an explicit Commission statement of "no application fee," so I record this as an inference from the absence of any fee line on the primary process page, corroborated by every industry cost-guide reviewed discussing only audit/consultant/insurance costs, never a Commission lodgement fee — Medium confidence.

Observed timeframes (secondary source, but citing NDIS Commission's own published quarterly performance data for Jan–Mar 2026):

• Certification pathway, starting from scratch, no major delays: 9–12 months from start to Certificate of Registration.

• Verification pathway: 4–6 months.

• NDIS Commission processing time (after audit report submitted): median 34 days for new Certification applications, 49 days for Verification applications (Commission's own Jan–Mar 2026 quarterly data, as cited by the secondary source) — "half of applications take longer than this."

5. Approved Quality Auditor engagement and Stage 1 / Stage 2 audits

(Sourced from industry secondary pages, as the Commission's primary "types of audit" page could not be fetched — see caveat in Q1.)

• Providers select and directly contract an Approved Quality Auditor (AQA), accredited by JASANZ (Joint Accreditation System of Australia and New Zealand). Described three-layer model: NDIS Commission regulates providers → JASANZ accredits auditors → AQAs audit providers.

• Stage 1 (desktop review): examines policies, procedures, governance and training documentation against the Practice Standards; typically occurs about a month after engaging the auditor; a day or less of auditor work for a small provider.

• Stage 2 (on-site audit): evaluates implementation via staff/participant interviews, record sampling, service observation; "must normally occur within three months after Stage 1"; minimum one full day for a small provider. Auditor has up to 28 calendar days after the on-site visit to submit the report to the Commission.

• Certification audit pricing is unregulated; one secondary source quotes AU$3,000–5,000 typical for a certification audit (Medium/Low confidence — single secondary source, not confirmed against a Commission fee schedule or a second independent source).

6. Key personnel, suitability assessment, worker screening

From the NDIS Commission's own pages (fetched successfully — "About registration" and beta "Registered provider obligations"):

• Key personnel are defined as individuals with significant roles — executive decision-makers, or those with authority/significant influence over planning, directing or controlling the provider's activities. All key personnel must be disclosed in the application.

• Suitability assessment of the organisation and of each key person considers: prior NDIS registration history, banning orders, criminal convictions, insolvency history, adverse regulatory findings/enforcement action, fraud/dishonesty findings, and corporate disqualifications.

• Worker screening: providers must ensure all workers in risk-assessed roles hold a valid NDIS Worker Screening Check clearance before starting in that role, and must fulfil ongoing worker-screening obligations for the workforce.

• All workers are expected to complete the "Quality, Safety and You" e-learning module (human rights, respect, risk, worker responsibilities).

7. Renewal / re-registration cycle

• The NDIS Commission's official renewal guidance PDF (P19, dated 2026-06, fetched successfully) states providers can submit a renewal application within 6 months of their registration end date, via the Commission Portal (myID login), working through a sequential set of application tabs before final submission.

• The specific length of a registration period was not stated in that renewal document. A separate NDIS Commission page (beta.ndiscommission.gov.au, fetched successfully) states providers are "generally registered for three years" — Medium confidence, as it is described as a general/typical position rather than a fixed statutory term, and I could not cross-confirm the exact figure against the primary (non-beta) Commission registration page.

8. 2025/2026 changes materially affecting a new provider's viability

• National Agreement on Foundational Supports (federalfinancialrelations.gov.au, fetched successfully): a five-year (2026–2031) Commonwealth–state agreement, commenced 2 February 2026, creating a support tier "positioned between mainstream services and specialist NDIS supports." All states/territories have signed the first bilateral phase, "Thriving Kids", targeting children aged 8 and under with developmental delay/autism at low-to-moderate support need. This sits outside the NDIS proper and does not, on the page fetched, itself alter NDIS provider registration requirements — but it is a new, adjacent funding/service channel a Victorian entrant should be aware of when deciding whether to target NDIS-registered supports vs this foundational-supports channel.

• NDIS Amendment (Securing the NDIS for Future Generations) Bill 2026 — see Q2B above: passed Parliament 19 August 2026, staged commencement to July 2028, including the July 2027 mandatory-registration expansion, new record-keeping duration rules, a new plan-variation pathway for 24-hour high-support participants, and progressive resets of some support budget categories from October 2026.

• Given the Bill passed literally the day before this research (19 August 2026), the Rules and legislative instruments needed to operationalise it (including the exact registration-group scope for the July 2027 expansion) were not yet located in the sources gathered — see UNVERIFIED.

SOURCES TABLE

UNVERIFIED / COULD NOT CONFIRM

1. Exact reconciliation of the 1 July 2026 vs 1 October 2026 dates for SIL/platform mandatory registration. (R1-05 vs R1-06) — To verify: fetch the actual amended Provider Registration Rules 2026 legislative instrument (via legislation.gov.au / Federal Register of Legislation) which should state the operative commencement and any transition/compliance-by date separately, rather than relying on two different NDIS-family web pages that were not reconciled here.

1. Whether support coordination mandatory registration is formally, officially paused, and by what instrument. — To verify: locate an ndis.gov.au or ndiscommission.gov.au or health.gov.au statement (not just trade press) confirming the pause and its status.

1. Full text and precise scope of the NDIS Amendment (Securing the NDIS for Future Generations) Act 2026, including exact registration-group scope of the July 2027 expansion, and confirmation of Royal Assent date. — To verify: fetch the Bill/Act text directly from legislation.gov.au or the Australian Parliament House (aph.gov.au) Bills page (https://www.aph.gov.au/Parliamentary_Business/Bills_Legislation/Bills_Search_Results/Result?bId=r7487), which returned in search results but could not be fetched within the effort ceiling; health.gov.au pages describing the Bill were also blocked (ROBOTS_DISALLOWED with repeated timeouts) during this session.

1. NDIS Commission's primary "types of audit" page and "NDIS Practice Standards" page content — could not be fetched directly (persistent ROBOTS_DISALLOWED / robots.txt timeout errors across multiple attempts and retries), so Stage 1/Stage 2 audit detail (Q5) rests on trade-press secondary sources only. To verify: retry fetch later, or obtain the content via an alternate access method (e.g., cached version, PDF factsheet, or direct API) not available in this session.

1. Whether there is truly no NDIS Commission application/lodgement fee (R1-14) — inferred from absence of any fee statement on the Commission's own process page; not an explicit confirmation. To verify: find an explicit NDIS Commission FAQ or fee-schedule statement, or contact the Commission directly.

1. Exact statutory length of a registration period (e.g., "3 years") as a confirmed rule rather than a general description — sourced only from the Commission's beta site. To verify: locate the equivalent statement on the primary (non-beta) ndiscommission.gov.au site or in the NDIS Practice Standards/Rules.

1. Certification audit typical price range (AU$3,000–5,000) — single trade-press source, unregulated market, not cross-verified against a second independent source or an NDIS Commission price-transparency page.

1. Relationship between the National Agreement on Foundational Supports and NDIS provider registration status — the Commonwealth Treasury page fetched contained no information on this link; unclear whether providers delivering Foundational Supports (e.g., Thriving Kids) require any form of NDIS Commission registration at all, or operate under a wholly separate state-based accreditation regime. To verify: consult the Thriving Kids bilateral agreement documents or Victorian Department of Families, Fairness and Housing guidance specifically.

Note on effort ceiling: this research used most of its allotted ~30 tool calls; the items above are flagged rather than pursued further, consistent with the charter's exit gate.