Published NDIS enforcement actions quadrupled in 2025. That is not the same as enforcement rising

The NDIS Commission publishes a register of compliance and enforcement actions, and counted straight it tells a dramatic story: 362 actions listed for 2024, 1,533 for 2025. We counted it by action type instead, and the dramatic story falls apart. Ninety per cent of the increase is a single instrument, published compliance notices, up from 46 to 1,105. Meanwhile the most serious sanction in the list went the other way: revocations of registration halved. And the policy governing what goes on the register was rewritten in the same year.

10 August 2026 register counted 9 Aug 2026 2 primary sources

If you are a participant choosing a provider, or a provider wondering how hard the regulator is pressing, the Commission's public register looks like the place to find out. It is worth knowing what it can and cannot answer before you rely on it.

What the register actually records

We queried the register year by year and then type by type. The type counts sum exactly to the year totals in both years, which is the check that makes the rest of this worth reading.

Published NDIS compliance and enforcement actions, by type
Action type	2024	2025	Change
Compliance notice	46	1,105	up 2,302 per cent
Banning order	134	280	up 109 per cent
Revocation of registration	177	91	down 49 per cent
Refusal to re-register	0	48	new
Suspension of registration	4	8	up 100 per cent
Enforceable undertaking	1	1	unchanged
Total	362	1,533	up 323 per cent

Three things stand out, and only the first one matches the headline.

The rise is one instrument. Compliance notices account for 1,059 of the 1,171 additional actions. Every other category combined accounts for the rest.

The most serious sanction went backwards. Revocation of registration is the heavy end of this list: it removes a provider from the scheme. It fell from 177 to 91. Whatever happened in 2025, fewer providers were removed than the year before.

A category that recorded nothing began recording. Refusal to re-register went from zero to 48.

Why none of that proves enforcement increased

Here is the part that decides how much weight the numbers can carry. The register is not a complete list of what the Commission does. It is a list of what the Commission decides to publish, and the Commission says so plainly on its own page about publishing regulatory activity: We assess each action to decide what should be published.

That alone would make a trend reading shaky. What makes it untenable is the timing. The policy that governs those decisions, the Publishing Regulatory Activity policy, is version 2.0, dated July 2025. The rules about what appears on this register were rewritten in the same year that the count of one published category rose twenty-fourfold.

We cannot tell you what version 2.0 changed, because the published policy carries no revision history and we could not find version 1.0. So we are not asserting that the policy change caused the jump. We are saying something narrower and firmer: a rise in published actions is consistent with more enforcement, with more publishing, or with both, and nothing on the public record separates them.

What this means if you are using the register

The register remains genuinely useful for the thing it was built for. If you want to know whether a particular provider or worker has had action taken against them, look them up. That is a factual question about a published record and the register answers it.

What it will not support is a comparison over time. "Enforcement has quadrupled" is the natural sentence to write from these totals and it is not a safe one. Neither is the opposite reading, that halving revocations shows a regulator going soft, since the same publishing caveat cuts both ways.

Our view, labelled as such

Publishing this register at all is the right instinct, and the Commission deserves credit for putting individual decisions in public where a participant can check them.

The gap is that a register presented as a public record invites exactly the trend reading it cannot bear, and nothing on the page warns you. Two small additions would fix it: a note stating that publication is discretionary and that counts across years are therefore not comparable, and a revision history on the publishing policy so a reader can see what changed and when. The second costs nothing. Regulators publish counts of their own activity in annual reports, and those are the numbers to compare over time. This register is a lookup tool, and it should say so.

How we counted this

The Commission's compliance register is a search interface rather than a downloadable dataset, so we queried it directly through a browser and read the result count the interface itself reports. Each query fixed the year and the action type and left state and status unrestricted. We recorded the filter values back off the page for every query to confirm what had actually been applied.

The check that makes these numbers usable: the six action-type counts sum to exactly 362 for 2024 and exactly 1,533 for 2025, matching the year totals read independently. Had they not reconciled we would not have published them.

One trap worth naming, because it produced a false result first. Leaving the year filter out does not return all years: the interface silently defaults to the current year. An unfiltered query returns a figure that looks like a grand total and is not one, which is how we briefly had a 2025 count larger than the apparent total for all time.

What we have not done. We have not asked the Commission to comment, and we would publish its response. We have not established what version 2.0 of the publishing policy changed, because the document carries no revision history and we could not locate version 1.0, so the relationship between the policy and the count remains a coincidence in timing rather than a demonstrated cause. We have not compared these figures against the Commission's annual report, which states activity counts independently and is the right way to settle whether enforcement itself rose. One further caveat on the date: the policy document says July 2025 while the file it is served under is named for July 2026, and we have relied on the date inside the document.

Primary sources

NDIS Quality and Safeguards Commission, Search for banning orders and other compliance decisions (the public compliance register, queried 9 August 2026): every count in the table above, by year and by action type, together with the filter vocabulary of six action types, nine states and territories, and years from 2018.

NDIS Quality and Safeguards Commission, Publishing Regulatory Activity policy (page and linked PDF, read 9 August 2026): that publication of each action is assessed case by case, that the register is organised into banning orders and other statutory compliance and enforcement actions, and that the policy in force is version 2.0 dated July 2025.