Insights · AI Consulting
AI for NDIS providers.
NDIS providers carry more paperwork per hour of support than almost any business in Australia. AI can take a real share of it, on some of the most sensitive data in the country. What to automate, what to leave with people, and what to demand from whoever builds it.
Every hour of support an NDIS provider delivers creates work that is not support. A progress note. A shift on the roster. A claim against the participant's plan, checked against the service agreement and the price limits. Sometimes an incident report on a regulatory clock. Then, at audit, the evidence that all of it happened the way the Practice Standards say it should.
That administrative load is exactly the kind of work AI agents now do well. It is also work done on disability, health and behavioural information about people who often cannot easily speak up if it goes wrong. Both facts decide how an NDIS provider should approach AI, and who it should trust to build it.
What changed for providers in 2026.
Three changes make this year the one to get the foundations right.
- Mandatory registration has started. From 1 July 2026, supported independent living (SIL) and NDIS digital platform providers became the first supports subject to mandatory registration with the NDIS Quality and Safeguards Commission, with SIL Practice Standards, audits, reporting and worker screening attached. Registration brings audit, and audit asks for evidence.
- Automated decisions must be disclosed. From 10 December 2026, any organisation that uses a computer program to make decisions that could significantly affect a person's rights or interests, using their personal information, must say so in its privacy policy. A rostering or eligibility tool that decides who gets which support is in scope.
- Size is no shelter. The Privacy Act's small business exemption does not apply to organisations that provide a health service and hold health information. That captures most NDIS providers at any turnover, so every AI system that reads a participant record carries full Australian Privacy Principles obligations.
Where AI agents earn their keep in an NDIS business.
The strongest uses share a shape: high volume, a clear rule to check against, and a person who signs off. Five stand out.
- Progress notes. A support worker speaks a two-minute summary at the end of a shift, and an agent drafts the note in your format, tagged to the participant's goals. The worker reviews and signs it. Notes get written on the day rather than on Friday night, and they get better, because the draft prompts for what the goal-tracking needs.
- Claims reconciliation. An agent checks every delivered shift against the service agreement, the plan budget and the current price limits before the claim goes in, and flags the mismatches. This is where cash leaks, through rejected claims, under-claiming and write-offs nobody has time to chase.
- Rostering support. Matching worker skills, screening status, participant preferences and travel is a constraint problem, and agents are good at proposing a roster. A coordinator approves it. Keeping the approval human is also what keeps it outside the new automated-decision disclosure.
- Incident reporting. Most reportable incidents must be notified to the NDIS Commission within 24 hours of key personnel becoming aware, with a fuller report within five business days. An agent that drafts the notification from the worker's account, pulls the participant's behaviour support plan and tracks both deadlines turns a scramble into a checklist. A person still decides whether the incident is reportable.
- Audit evidence. An agent that can answer "show me every restrictive practice recorded against this plan in the last 12 months, and the authorisation for each" from your own records turns audit preparation from weeks into days. It only works if the records are joined up, which is a data problem before it is an AI problem.
Where AI must not decide.
Some decisions stay with people, whatever the tool can do. Whether to use a restrictive practice. What goes into a behaviour support plan. Whether a participant's funding request is reasonable and necessary. Whether an incident is reportable. Whether a worker is safe to be rostered with a particular person.
AI can prepare the information for every one of those decisions. It should make none of them. This is partly regulation and partly practice: an agent that is right 97 percent of the time is a gift on claims and a serious failure on safeguarding. We have written more generally about where AI agents do not work yet, and the NDIS sits at the careful end of that line.
What to demand from the firm that builds it.
The model is rarely the hard part. The hard part is the data underneath it and the controls around it. Ask any AI partner these five questions before you sign.
- Where does participant data go? Every prompt, embedding, log and backup should stay in Australian regions, and the partner should be able to show you, not just tell you. Our piece on where your AI data can live covers the four places it usually leaks.
- Who reviews what the agent writes? Every output that becomes a record should have a named human approver, and the system should log who approved what.
- What happens to your records? Your case notes should not train anyone else's model, and you should own everything the system produces.
- Can it survive an audit? Ask how the partner would evidence the system to an NDIS Commission auditor. If the answer is a slide, keep looking.
- Will they start with an assessment? A partner who quotes a build before looking at your data is guessing. An AI readiness assessment tells you which of the five uses above your records can support today.
Why RUBIX.
RUBIX has been an Australian data and AI consultancy since 2011. That is 15 years, 450+ projects and 115+ customers building governed data platforms for organisations where the data is sensitive and the regulator is watching. Everything we build for an NDIS provider stands on that record.
- We have done this for an NDIS provider. For a leading NDIS provider we joined six disconnected systems into one governed data foundation, a live role-based dashboard and an AI automation roadmap worth ~$645K a year, in under eight weeks. Read the NDIS provider case study.
- Sensitive health data is not new to us. Our work with Medibank covered AI readiness, responsible-AI guardrails and personalisation on a privacy-respecting data foundation. That is the same discipline an NDIS provider needs, at a scale that fits a provider.
- Data first, then agents. Most provider AI projects stall because notes live in one system, rosters in another and claims in a spreadsheet. We build the data foundation that joins them, then put AI agents to work on it.
- Australian, onshore and accountable. Our people are in Australia, the data stays in Australian regions by default, and governance is designed in from the first week. See our AI governance consulting for how.
- Senior people do the work. Our forward deployed engineers sit with your team, so the people who scoped the work are the people who deliver it.
If you run an NDIS business and want to know what AI can safely take off your team, start with a conversation about your records, not a demo of a tool.
General information only, not legal or regulatory advice. Current as at September 2026.
