The NDIS Practice Standards: which ones apply to you, and what an auditor actually checks

The Practice Standards sit behind a large share of the scheme’s enforcement. They are what a provider is found to have contravened when the Commission acts, as in the $1.1 million Federal Court penalty against Oak Tasmania, and they are what a compliance notice tells a provider to fix. Almost every description of them stops at the name.

So we read the instrument rather than a summary of it: the National Disability Insurance Scheme (Provider Registration and Practice Standards) Rules 2018, in the compilation that took effect on 1 July 2026. The Standards are made under section 73T of the Act, and the rules say plainly what they are for: they specify the standards concerning the quality of supports and services to be provided by registered NDIS providers.

There is no single set of Practice Standards

Section 20 carries a table. Column 1 is a class of supports, column 2 is the Schedule containing the standards that apply, and column 3 is the method an approved quality auditor must use. The table runs to 39 rows, covering 38 numbered classes of support with one of them split in two. Which standards you are held to is decided entirely by what you deliver.

There are nine Schedules of standards. The Core module (Schedule 1) is the substantial one, at 25 numbered clauses across rights, governance, the provision of supports and the support environment. Then there are add-on modules for higher risk work: high intensity daily personal activities, specialist behaviour support, implementing behaviour support plans, early childhood, specialised support coordination, specialist disability accommodation, supported independent living, and a verification module.

The two pathways, and how far apart they are

The split is not close. Of the 39 rows, 16 require certification and 23 require verification.

Schedule 8, the verification module, contains four substantive standards. In full, they are risk management, complaints management and resolution, incident management, and human resource management. Each is a sentence or two. The incident standard, for instance, requires that each participant is safeguarded by a system ensuring that incidents are acknowledged, responded to, well-managed and learned from.

A provider on the certification pathway meets those four as part of a longer list, and also Part 2 of the Core module, which is the part about the rights of participants. Part 2 is five clauses: person-centred supports, individual values and beliefs, privacy and dignity, independence and informed choice, and freedom from violence, abuse, neglect, exploitation or discrimination. That last one reads in full: Each participant can access supports free from violence, abuse, neglect, exploitation or discrimination.

None of Part 2 appears in the verification module.

What that does and does not mean

It would be easy, and wrong, to read this as participants of verification providers having no protection. Two things sit alongside the Standards.

The first is the NDIS Code of Conduct, a separate instrument made under section 73V. It covers NDIS providers and the people they employ or engage, and it requires them to act with respect for individual rights to freedom of expression, self-determination and decision-making, to respect privacy, and to provide supports safely and competently. Compliance is a civil penalty provision. It binds regardless of which audit pathway a provider is on, and regardless of whether the provider is registered at all.

The second is that some modules carry their own rights provisions. The specialist disability accommodation module has a Rights and responsibilities clause of its own, and the supported independent living module added in 2026 leads with supported decision-making and safeguarding.

So the accurate statement is narrower than the alarming one, and still worth making: the difference between the pathways is not whether a provider has rights obligations, but whether an auditor is required to look at them before the provider is registered, and at each renewal. For 23 of 39 rows, nobody checks that part.

The verification list is not only equipment

The intuitive justification for a lighter pathway is that it covers low-contact supply: hand a participant a piece of equipment and walk away. Much of the list does look like that, including vision equipment, hearing equipment, vehicle modifications, customised prosthetics and assistive products.

But the same list also carries community nursing care, therapeutic supports, exercise physiology and personal training, household tasks, assistance with travel and transport arrangements, interpreting and translation, and management of funding for supports in participant plans, which is plan management. Those involve clinical contact, entry to a person’s home, or control of their money. This is our observation about the composition of the list, not a claim the Commission makes, and it is the part of the table we think a reader is most likely to find surprising.

Three rules that catch people out

Government providers do not get the light pathway. Section 22 says that to be registered for any class of supports at all, the Commonwealth, a State or Territory, an authority of either, or a local government authority must be assessed against the Core module using certification. It applies in addition to section 20. A council delivering a support that would otherwise be verification-only is certified anyway.

Certification counts as verification. Section 23 provides that where a standard must be assessed by verification, assessing it by certification satisfies the requirement. The pathways are a floor, not a fixed category.

Restrictive practices override the table. If supports are delivered in circumstances involving the use, or possible use, of a regulated restrictive practice, the provider must also be assessed against Schedule 4, using certification, whatever column 3 says.

What changed in 2026

The compilation we read includes amendments up to the Provider Registration and Practice Standards Amendment (Mandatory Registration and Other Matters) Rules 2026, registered 24 June 2026 and commenced 1 July 2026. That instrument added Schedule 7A, Module 5A, for assistance with supported independent living, and a new row 38 to the section 20 table requiring Schedules 1 and 7A by certification. Its four standards are supported decision-making, safeguarding, practice governance, and agreements about tenancy, housing and support arrangements.

Why this connects to enforcement

The rules attach the Standards to registration by way of a note in section 19: non-compliance with the NDIS Practice Standards by a registered provider constitutes a breach of a condition of registration, citing paragraph 73F(2)(c) and section 73J of the Act. Section 73J is the compliance-notice power, and it is the provision most often named in the Commission’s published infringement notices. The Standards are the content; section 73J is the lever.

What we are not saying

Nothing here says that providers on the verification pathway are unsafe, that any particular provider has done anything wrong, or that the Commission has made an error. Support classes differ in risk and it is reasonable for the depth of an audit to differ with them. We have not tried to establish whether harm is more common on one pathway than the other, and we have seen no data that would settle it. The point is narrower: the design decision is real, it is made in a table most people have never read, and the composition of that table is not quite what the word “verification” implies.