Your website lists your supports and your phone number. A participant who is unhappy, or the sister of one, reads that page before anyone picks up the phone. One clause in the NDIS complaints rules is written for exactly that moment, and it is the only part of compliance addressed to the public rather than to a regulator. This post reads the clause, shows what 145 registered provider sites in Brisbane actually do about it, and sorts what belongs on a page from what has to stay private.
In brief
- Most of NDIS compliance is private. One clause is addressed to the public: how a person complains to you, and how they complain to the Commissioner.
- We read 467 provider websites listed in Brisbane and surrounds. Of the 145 that state the provider is registered, 25 showed both routes and 78 showed neither.
- Registration became mandatory for supported independent living and NDIS digital platform services on 1 July 2026. More providers now carry the registered provider duties.
- Meeting the clause costs a page, a footer link, a form that does not force a name, and 5 lines of contact details.
What compliance actually covers for a small provider
For a small NDIS provider, the compliance requirements fall into 4 groups, and they have different owners.
Registration comes first, because the supports delivered decide it. Some can only be delivered by a registered provider. If you are registered, the NDIS Practice Standards apply and an auditor assesses you against them. Our NDIS audit checklist goes through what that assessment asks for. The NDIS Code of Conduct applies either way. The Code of Conduct rules say it ‘applies to all NDIS providers and persons employed or otherwise engaged by them, regardless of whether they are registered’. The same rules add that ‘anyone can raise a complaint about potential breaches of the NDIS Code of Conduct’.
Then there are the 2 systems that run every day of the year. One handles complaints. One handles incidents. A complaints management and resolution system is the documented process a provider uses to take, resolve and record complaints. An incident management system is its twin for things that go wrong in a support. The NDIS Quality and Safeguards Commission puts the first one plainly. ‘All NDIS providers are expected to have effective complaints management and resolution practices.’ For registered NDIS providers it is firmer than an expectation, because the system is a condition of registration.
Behind all of this sit 2 bodies, and they are easy to mix up. The National Disability Insurance Agency, the NDIA, funds plans and pays claims. The NDIS Commission regulates providers and workers, takes complaints and runs enforcement actions. A participant who wants to complain about NDIS services needs the Commission, not the agency.
Read the compliance guides that rank for this topic and you get policies, registers, training and audit preparation. Useful, all of it. The longest one we read runs to about 2,700 words and uses the word website once. The next runs to about 2,381 words and never uses it. One of these duties is not private at all, and almost nobody writes about that one.
This article is general information about published rules. It is not legal advice, and it is not a substitute for reading the instruments yourself.
Who has to be registered, and what changed on 1 July 2026
Registration is mandatory by support type, not by the size of your organisation. A sole trader can be required to register while a larger provider down the road is not.
The Commission lists the supports that can only be delivered by a registered provider:
- specialist disability accommodation
- specialist behaviour support services, including providers who implement restrictive practices
- supports or services for participants with agency managed funding
- plan management services
- supported independent living
- NDIS digital platform services
- residential aged care with NDIS participants living in the facility.
The last 2 entries on that list are new, and the change reached providers delivering those supports in the middle of the year. The Commission says that ‘from 1 July 2026 some supported independent living (SIL) providers must register with the NDIS Commission’. A new class of support, 0138, carries it, and the Commission adds the matching registration group to the certificates of approved providers. Platform providers came in at the same time.
The Commission is blunt about the consequence. ‘Providing supported independent living without registration is a serious offence.’ Delivering it from that date without registration may breach the NDIS Act. The maximum penalty is 2 years imprisonment, a fine of 120 penalty units, or both.
There was a cut off for the transition as well. A provider already delivering supported independent living that had not applied by 1 October 2026 ‘will need to stop providing supported independent living supports’. That wording was on the Commission’s transition page when we read it on 10 November 2026. Transition positions move, so check that page rather than this one.
This matters for the rest of the article in one specific way. Providers who sat outside the registered provider rules until the middle of 2026 are inside them now. That includes the rule about what the public can see.
The part of compliance the rules make public
Here is the clause. It is subsection 8(7) of the National Disability Insurance Scheme (Complaints Management and Resolution) Rules 2018, in the compilation that started on 28 January 2026.
‘The system must provide for the following details to be readily available and accessible to the public: (a) how a complaint about the registered NDIS provider can be made to the provider; (b) how a complaint about the registered NDIS provider can be made to the Commissioner.’
Read that twice, because it is unusual. Almost everything else in NDIS compliance is owed to the regulator, the auditor or the participant in front of you. This one is owed to the public. That includes a support coordinator you have never met, a sister in another state, and a participant who has not signed anything yet.
The rule does not say website. That is our reading, not the law. Service agreements, welcome packs and a poster on the office wall can all carry the same details, and some providers use them. The difference is reach. A stranger can get to a website without asking you first, and a stranger is who the clause is written for.
The Commission says the same thing in service language. Providers should deliver ‘communication to NDIS participants so they know how to make a complaint to you or the NDIS Commission’. Note what is being asked for: a process people can use, not a policy document to publish.
What the complaints rules ask for, line by line
Beyond publishing both routes, 4 paragraphs shape what the route itself has to be. None of them is long.
Anyone, including anonymously. The system must do this, in the words of the rules: ‘enable any person to make a complaint (including an anonymous complaint) to the registered NDIS provider about the supports or services provided by the provider’. The Commission’s guidance lists ‘the ability to submit complaints anonymously’ as part of a documented process. A form that demands a name and an email is a decision against this paragraph, and most providers make it by accident.
Easy and accessible. The system must ‘provide for an easy and accessible process for making and resolving complaints’. The Commission talks about ‘platforms, technology or languages that are accessible to NDIS participants and staff’. Three clicks and a login is not that.
Told about the Commissioner. A person who complains, and each person with disability affected, ‘is advised how that complaint or issue may be raised with the Commissioner’. Reasonable steps have to be taken to make sure of it. This duty is separate from publishing the route. Publishing is about what the public can find. This is about what you say once someone has spoken up.
In an accessible form. Under paragraph 10(1)(b), copies of the documented system go out ‘in a form that is accessible to’ participants. Families, carers and advocates are named too, along with everyone you employ or engage. The subsection 8(7) information travels with those copies. The incident rules carry a matching duty for the documented incident management system.
The Code of Conduct sits underneath all 4. It requires a provider to ‘promptly take steps to raise and act on concerns about matters that may impact the quality and safety of supports and services provided to people with disability’. If you are not registered, that is still you.
There is a selfish reason to make the route easy, too. A complaint that reaches you is the cheapest signal you will get about your own service. It also arrives while you can still improve the quality of what you deliver. A complaint that goes straight past you to the Commission teaches you nothing.
What 145 registered provider websites actually show
We wanted to know how often the public part is actually public. So we counted.
On 10 November 2026 we read 467 provider websites listed in Brisbane and surrounds. Of those, 366 answered with a home page worth reading and 313 mentioned the NDIS on it. In that group, 145 state on the site that the provider is registered. That last group is the one that matters, because those providers say themselves that the clause applies to them.
| Out of 145 sites stating the provider is registered | Sites |
|---|---|
| A complaints page or a complaints address | 67 |
| The Commission named as the other route | 25 |
| Both routes visible | 25 |
| Neither route visible | 78 |
| Says a complaint can be anonymous | 19 |
| Offers help with the format: Easy Read, an interpreter or an advocate | 7 |
Our method was deliberately shallow. A worried visitor is shallow too. A script read the home page and up to 3 pages linked from it with complaint or feedback wording. It also tried 5 common addresses, such as /complaints/ and /contact/. Every positive mark was then read back by eye, which removed 3 false positives and found 4 pages the script had missed.
Now the limits, because numbers without them are just noise. This is what is visible on a website, not a finding of non-compliance. The rules allow the same information to reach participants another way. Registration status here comes from the site rather than the register, so it is a claim rather than a verified fact. We rechecked the 185 sites that showed nothing by hand. Complaint wording turned up on 5 of them, so the figure moves by a point or two.
One more thing worth saying plainly. An audit samples evidence against the Practice Standards, and quality indicators are how an auditor judges it. This survey is not an audit and not an NDIS compliance checklist. It only looks at what a stranger can see in the first minute, which is the test subsection 8(7) sets.
We could not find a published survey of provider complaint pages to compare against, which is part of why we ran one.
Where each piece belongs on the site
Walk your own site the way a worried family member would. Put the pieces where that person will find them, not where a policy folder would put them.
A complaints page with its own address. Not a paragraph inside the contact page, and not a PDF. A page you can send someone to, named the way people speak: complaints and feedback.
Links from the footer and the contact page. The footer is where people look after the menu fails them. One link, in plain words, on every page of the site.
A form that does not force a name. In our survey we found 132 complaint pages. Of those, 106 carried a form, 94 showed an email address and 65 showed a phone number. A form is usually the only route offered. If its name and email fields are required, the anonymous route disappears. Make those fields optional, or add a channel that does not ask.
The Commission’s details, next to yours. Not instead of yours. Its own page gives the channels:
- phone 1800 035 544, free call from landlines
- the National Relay Service, for people who are d/Deaf or have a hearing or speech difficulty
- interpreting, which can be arranged
- an online form, for people who cannot phone in business hours or would rather write.
One line about help. Say that you can arrange an interpreter, an advocate, or an Easy Read version. The page also has to be usable by the person reading it, a separate job we worked through in our published accessibility report for an NDIS provider. Only 7 sites out of 145 said anything like it. Best practice goes further and names a person to ask, which costs nothing and reduces the risk of a complaint going nowhere.
A sentence pointing at the service agreement. If your agreement already carries this, say so on the page. It is good practice, and it tells a reader you have thought about it.
Two things do not belong here. Worker screening clearance numbers are not public information, and neither are the names of individual staff who handle complaints. The same caution covers anything you publish about a participant, which we went through in what the NDIS Code of Conduct means for your website. A role is enough.
What the rules do not ask of your website
Publishing is not the same as providing on request, and the rules are careful about the difference.
You do not have to publish your policies and procedures in full, your register of complaints, or anything about a complaint that has been made. The rules go the other way. Reasonable steps must be taken so that ‘information provided in a complaint is kept confidential and only disclosed if required by law or if the disclosure is otherwise appropriate in the circumstances’. Records of complaints ‘must be kept for 7 years from the day the record is made’. Kept, not published.
The same holds for the heavier material. Reportable incidents go to the Commissioner, within 24 hours for the first set of details and 5 business days for the rest. Behaviour support plans and records of restrictive practices sit in that private lane too. None of it is website material. A safeguard that leaks participant information does not protect participants, and participant safety is the whole point of service delivery in this sector.
Enforcement is published, but not by you. The Commission keeps a register of banning orders, compliance notices, enforceable undertakings and suspensions or revocations of registration, and it decides what goes on it.
So the honest version is small. A page, a link, a form that does not demand a name, 5 lines of contact details, and one sentence about help. That is a morning of work, and it is the only part of compliance that a person outside your organisation will ever check.
NDIS compliance FAQ
Does the NDIS require a provider to have a website?
No. No rule we read asks for a website. Subsection 8(7) of the complaints rules asks for two details to be readily available and accessible to the public, and a website is the cheapest way a small provider can do that.
Do unregistered providers have to publish a complaint route?
Subsection 8(7) binds registered providers. The NDIS Code of Conduct binds every provider, registered or not, and the Commission expects all providers to manage complaints effectively. Publishing the route is good practice for an unregistered provider rather than a duty.
Does a complaint have to be anonymous?
A complaint can be anonymous. The rules say the system must enable any person to complain, including anonymously. A form that requires a name and an email closes that door, unless you offer a second channel.
Do we have to publish our complaints policy?
No. The rules ask for copies of the documented system to be provided in an accessible form to participants, families, carers, advocates and your workers. Providing on request is not the same as publishing, and records of individual complaints stay confidential.
What changed for NDIS providers on 1 July 2026?
Registration became mandatory for supported independent living and NDIS digital platform services. Providers who were outside the registered provider rules before that date now carry them, including the public information duty.
Before you rely on this
This post is general information based on instruments and regulator pages we read on 10 November 2026. It is not legal advice. Rules change, transition positions for mandatory registration move, and your own situation needs advice that fits it. Check the current Federal Register of Legislation and NDIS Commission pages before you act.
If your public pages need to carry this without turning into a policy folder, our NDIS provider website design service includes a read of what a participant can find. We would be glad to look at yours.
By Vasilii Aldukhov, Web Ways Tech, a Sydney web design studio that builds WordPress websites for NDIS, childcare, dental and trade businesses.
