Artificial Intelligence (AI) for Ndis Providers

What's Changing

From 10 December 2026, Australian organisations (APP entities) must disclose in their privacy, risk and/or information management policies and procedures when they use automated decision-making, including AI, to make or substantially support decisions that could significantly affect a person's rights, care or interests. The obligation comes from a change as of the 10/12/26 made to the Privacy and Other Legislation Amendment Act 2024, which amends the Privacy Act 1988 (Cth). It sets transparency rules for how computer programs, from AI models to rule-based engines, shape decisions about people. This is the first time Australian privacy law formally treats automated decision-making as a disclosure obligation for compliance, legal, IT, and risk management

Who Will Be Impacted?

Only applicable, if you collect, store, use and archive any type of automated and/or AI in your NDIS service.  

• All registered and unregistered NDIS providers.
• Sole traders and organisations delivering NDIS-funded supports.
• Support workers and administrative staff responsible for completing service records.
• Finance, payroll and invoicing teams.
• Plan managers and support coordinators who assist with care and claims.
• Participants and nominees, where delays or missing information affects a process and/or their information is used or store in AI software. 

Types of Software and Systems

Some example of automated and AI systems and software. 

• Voice-to-Text Transcription Apps
• AI Note Rephrasing and Summarization
• Intelligent Shift Matching
• Real-Time Schedule Adjustment
• Automated Compliance and Budget Checks
• Invoice and Claim Automation
• Risk Prediction and Incident Prevention
• Outcome Forecasting
• Cloud‑based or Google Solution
• ChatGPT
• Claude
• Zapier
• Grammarly

What It Means?

• It means mapping all for automated and AI use collection, storage, use and archiving where there has been decisions made in relation to your NDIS service or with a participant/guardian that may affect a person's rights, care or interests.
• Updating policies, procedures, forms, registers and plans before the deadline.
• Clearly define acceptable and prohibited for automated and AI useuse. 
• Clearly define roles & responsibilities for for automated and AI use including approval, software vetting, use and training. 
• Transparently disclose all for automated and AI use software and systems to participants and other stakeholders. 
• Implement, monitor and review a management system for human oversight or clinical judgment in automated and artificial intelligence (AI) including the software used, automated and AI use activity, outcome and who maintained oversight.  
• Fully inform and gain the participants/guardian consent for automated and AI use software or systems
• Never enter personal, participant or organisational information in automated and AI use system or software. 
• Never store personal, participant or organisational information in automated and AI use system or software outside of Australia. 
• Implement, monitor and regularly review a privacy and confidential, risk and/or information management policies and procedures. 
• Conduct ongoing and regular testing of automated and AI use systems and software. 

Non-Compliance Outcome

The OAIC can issue compliance notices, issue infringement notices, or pursue civil penalties reaching up to $50 million for serious interferences. Enforcement is active rather than theoretical through OAIC compliance sweeps. 

WHAT DO YOUR NEED TO DO NOW!

• Map software and systems for all automated and AI collection, storage, use and archiving.
• Implement or review a privacy and confidential, risk and/or information management policies and procedures. 
• Implement or review participant consent form and automated or AI use register.
• Update risk management policies, procedures, whs assessment plan and risk management plan/s for automated and AI use.
• Urgency conduct, vet and test all automated and AI systems and software including verification of information storage in Australia only. 

Your NDIS Provider Journey, Made Clear

Navigate registration, implement compliance and build the knowledge and systems to operate with confidence as a unregistered or registered NDIS provider.

• Learn Online — Self-paced eLearning
• Book a Mentor — Ad-hoc support
• Join for $80 — Sign up today
• Check Your Compliance — Complete an internal audit
• Get Registration-Ready — Prepare for your NDIS registration
• Stay on Track — Compliance reminders and prompts
• Not Sure Where to Start? — Chat with us here!