Status note, 28 July 2026. The 3,671 figure in this story was the register’s full row count when we downloaded it on 19 July, and it still read 3,671 on 27 July. On 28 July the same export returned 3,668, with compliance notices down by exactly three and every other category unchanged. The register is therefore not append-only: rows leave it, so a total taken from it is a snapshot rather than a cumulative tally. The analysis below is unchanged and remains accurate as at its download date. See our banning-order analysis for the detail.
What the export shows that the search page cannot
The register’s public search tool serves one case at a time. Its CSV export, a link inside the search page, serves all of them: every banning order, compliance notice, enforceable undertaking, suspension, revocation and registration refusal the Commission has published, each with the Commission’s own stated reasons. Counted whole, the register breaks down to 2,361 compliance notices, 789 banning orders, 337 revocations of registration, 139 refusals to re-register, 40 suspensions and 5 enforceable undertakings.
The volume is recent. The register recorded 15 actions in 2019 and 79 in 2022. In 2025 it recorded 1,533, and 2026 already carries 1,442, including actions decided now with effective dates as late as 31 August. Enforcement at this scale is a new fact of the sector, and it did not arrive evenly. It arrived in waves.
The three waves are audit deadlines, run in bulk
August 2025 (776 actions), January 2026 (798) and March 2026 (491) tower over every other month in the register’s history. Reading the Commission’s own stated reasons row by row shows each wave is one mechanism applied across hundreds of providers at once.
Wave one: the conditional-audit sweep
Of August 2025’s 776 actions, 746 are compliance notices, and the sampled entries repeat one fact pattern. A typical entry, for Platinum Support Coordination Pty Ltd, records that a notice was issued because a delegate of the Commissioner reasonably believes the provider contravened section 73J of the NDIS Act, “more specifically, the failure… to commence a conditional audit three months after service delivery has commenced”. New providers are frequently registered on the condition that a certification audit is completed within three months of starting service delivery; the register shows the Commission checking that condition across the book and issuing notices to those who missed it, in bulk.
Wave two: the mid-term audit sweep
January 2026’s 775 compliance notices carry near-identical text across unrelated providers in different states. Three sampled entries, for Holy Trinity Disability Services (QLD), Mr King George Oreste trading as Joyfulness Care (WA) and Sumair Enterprises trading as Bridgeway Support Services (VIC), each require the provider “by 20/02/2026 to take action to engage an approved quality audit to complete a mid-term audit in accordance with section 13B” of the Provider Registration and Practice Standards Rules 2018, and by 30 April 2026 to give the Commission the completed audit report. Registered providers sit on a three-year certification cycle with a mid-term audit in the middle; this wave is that deadline, enforced through the whole cohort at once.
Wave three: the single-day refusal batch
March 2026 adds a different instrument: 85 refusals to re-register, every one effective the same day, 12 March 2026. The sampled reasons are again uniform. The entry for one NSW applicant records refusal because the applicant has not “been assessed by an approved quality auditor as meeting the applicable standards” and has not “demonstrated suitability to provide supports or services to people with disability”. Applicants who did not clear the audit-and-suitability bar were refused as a batch, on one day.
What this means if you hold registration
The picture that emerges is a regulator that polices the perimeter continuously and the paperwork periodically, at scale. Individual investigations still happen, and still escalate: the register’s own record for Oak Tasmania begins with compliance notices in 2020 and 2021 and ends with a $1.1 million Federal Court penalty in January 2026, a ladder we walk through in a separate piece. The Diversity Models case shows the same escalation inside one quarter: a banning order against the company, a revocation of its registration, and a banning order against its director, each published on the register and explained in the Commission’s own media release.
But the bulk of the register is now deadline enforcement. For a provider, the practical reading is plain: the conditional-audit clock (three months from first service delivery) and the mid-term audit date on your certification cycle are not soft dates a case officer may eventually notice. They are queried against the whole book, and the notices go out together. A missed audit date now lands your organisation’s name on a public register beside the genuinely serious cases, with the Commission’s stated reasons attached, visible to anyone who searches.
One caution in reading the register: a compliance notice records that a delegate “reasonably believes” a provider has contravened a requirement and requires action; it is not a finding of misconduct, and many entries, including Oak Tasmania’s early ones, note the provider went on to fulfil all requirements of the notice. We report what the register itself records, in its own words.
Methodology
Counts are computed from the NDIS Commission’s own “Download all enforcement action data” CSV export, downloaded 19 July 2026 (3,671 rows, effective dates 25 January 2019 to 31 August 2026; some 2026 actions carry future effective dates, so 2026 totals will grow). Monthly counts group rows by the register’s “date effective from” field. Verbatim quotes are from the register’s “relevant information” field for the named rows. One row carries no effective date and is excluded from the chart. Providers and individuals are named here only as the Commission has itself published them on the register or in its media releases, and nothing beyond the regulator’s own published words is asserted about any of them.
Primary sources
- NDIS Commission, compliance and enforcement actions register, full CSV export (downloaded 19 July 2026)
- NDIS Commission, compliance and enforcement actions search
- NDIS Commission, compliance and enforcement actions (register landing page)
- NDIS Commission media release, $1.1 million penalty imposed on Tasmanian NDIS provider, 19 January 2026
- NDIS Commission media release, NDIS Commission bans Monique Jeremiah of Diversity Models from NDIS, 29 May 2026
- NDIS Commission, provider registration feed (RSS), which records the audit conditions new registrations carry