NDIS Practice Standard: Implementing Behaviour Support Plans Explained (2026)

Who This Applies To and Why It Matters in 2026

Any NDIS registered provider that delivers supports to a participant who has a behaviour support plan (BSP) — or who uses regulated restrictive practices — must comply with the Behaviour Support module of the NDIS Practice Standards. This includes SIL providers, short-term accommodation services, day programs, and any registered provider delivering high-intensity daily personal activities.

The NDIS Quality and Safeguards Commission enforces these requirements. Providers that fail to meet them face compliance notices, conditions on registration, suspension, revocation, or civil penalties. Under the strengthened registration reforms taking effect progressively through 2026, the Commission has signalled stronger audit attention on behaviour support obligations, particularly for providers delivering SIL and complex-support environments.

Understanding exactly what the standard requires — and what auditors examine — is essential for any provider seeking re-registration or preparing for a verification or certification audit.

What the NDIS Practice Standard Requires: The Core Obligations

The Behaviour Support module of the NDIS Practice Standards sits within the Supplementary Module 2 framework. It applies on top of the four core modules (Rights and Responsibility, Individual Outcomes, Feedback and Complaints, and Governance and Operational Management). Key obligations include:

• BSP must be developed by a registered behaviour support practitioner. Providers cannot create or authorise their own BSPs. The plan must come from a practitioner registered with the NDIS Commission under the behaviour support registration group.
• Staff must be trained in the specific plan. It is not sufficient to provide generic training on behaviour support. Workers who support the participant must understand that individual's BSP, the strategies it contains, and any restrictive practices that have been authorised.
• Restrictive practices must be authorised. No regulated restrictive practice (physical restraint, mechanical restraint, chemical restraint, environmental restraint, or seclusion) may be used unless it is contained in the participant's BSP and authorised under the relevant state or territory process. Using an unauthorised restrictive practice is a serious breach.
• Data collection and monitoring. Providers must collect data on the use of restrictive practices as required by the BSP, and that data must be provided to the behaviour support practitioner for plan review purposes.
• Incident reporting. The use of a regulated restrictive practice is a reportable incident under the NDIS (Incident Management and Reportable Incidents) Rules. Providers must report these to the NDIS Commission within the prescribed timeframes — noting that serious incidents have a shorter mandatory notification window.
• Plan review support. Providers must actively support the regular review of BSPs, including making monitoring data available and facilitating the practitioner's access to the participant and support team.

The Five Types of Regulated Restrictive Practices

The NDIS Commission defines five categories of regulated restrictive practices. Every provider using any of these must have an authorised BSP in place:

Providers must note that state and territory authorisation requirements vary. In some jurisdictions, a formal guardianship or tribunal order is required; in others, consent frameworks differ. Providers operating across state lines must understand the requirements in each jurisdiction.

What a Compliant Implementation Looks Like: Step-by-Step

1. Obtain the current BSP. Confirm the plan is current, was developed by a registered practitioner, and has not lapsed. Check the review date and flag plans that are overdue for review.
2. Verify authorisation for all restrictive practices listed. Do not implement any restrictive practice, even if it appears in the BSP, until you have confirmed the relevant state or territory authorisation is in place.
3. Deliver plan-specific training to all relevant workers. Document who was trained, when, and what the training covered. This record must be available for audit. Relief and casual staff who may support the participant must also be trained before they commence shifts.
4. Establish a data collection system. Record each instance of restrictive practice use — what was used, when, duration, the behaviour that preceded it, and any de-escalation strategies that were attempted first. The BSP will specify the format; follow it.
5. Report incidents. Use the NDIS Commission's PRODA portal to report reportable incidents within the required timeframe. Maintain an internal incident log that cross-references these reports.
6. Share data with the behaviour support practitioner. Ahead of each scheduled BSP review, compile monitoring data and make it available to the practitioner. Document that you have done so.
7. Participate in BSP reviews. Assign a named staff member (often a Team Leader or Service Manager) to attend or contribute to BSP reviews. Implement any changes to the plan promptly and retrain staff when strategies change.

What Auditors Check: Common Non-Conformances

During certification audits, approved quality auditors will examine the provider's behaviour support systems in detail. Based on the NDIS Commission's published guidance and audit methodology, the following are frequent areas where providers are found non-conformant:

• Outdated BSPs in use. Providers continue implementing plans that have passed their scheduled review date without an updated plan being in place.
• Missing or undocumented training records. Workers are verbally briefed on a plan but no signed training record exists. Auditors will ask for evidence, not assurances.
• Unauthorised restrictive practices. A restrictive practice is being used but the required state or territory authorisation cannot be produced.
• Inconsistent incident recording. Some instances of restrictive practice use are reported to the Commission but others are not, or internal records do not align with what was reported externally.
• No evidence of data being provided to the practitioner. Providers collect monitoring data but cannot demonstrate it was shared with the behaviour support practitioner for review purposes.
• BSP strategies not followed. The plan specifies a particular de-escalation sequence, but observed or documented practice does not reflect it.

Non-conformances in the Behaviour Support module are treated seriously by the NDIS Commission, particularly where they involve unauthorised restrictive practices or failures to report. These matters can be escalated beyond audit findings to formal compliance action.

The 2026 Strengthened Registration Framework and What Changes

The NDIS Commission's registration reforms — progressing through 2026 — introduce a more risk-proportionate audit model. For providers delivering supports to participants with complex behaviour support needs, this means:

• Increased likelihood of on-site audit activity, particularly for SIL and high-intensity support providers.
• Greater scrutiny of provider governance around behaviour support, including whether senior leadership can demonstrate oversight of restrictive practice use across the organisation.
• Renewed expectations that providers have a designated person responsible for behaviour support compliance and practitioner liaison.

Providers should treat any registration renewal or mid-term audit as an opportunity to conduct an internal review of their behaviour support systems before auditors arrive.

Building Audit-Ready Systems

Robust internal systems are the foundation of compliance. Providers should maintain a centralised register of all participants with a BSP, including plan review dates and the authorisation status of each restrictive practice. This register should be reviewed at least monthly by a named responsible person.

For SIL providers managing multiple participants across several homes, the ndiscompliant.com.au 136-document SIL compliance kit includes ready-to-use templates for BSP registers, restrictive practice authorisation tracking, staff training logs, and incident recording forms — built to the current NDIS Practice Standards.

Regardless of the tools used, the principle is the same: documentation must exist, must be current, and must be retrievable at the point of audit.