AI call intake for Australian NDIS providers: what an agent must do when a caller discloses a reportable incident
Section 20 of the NDIS (Incident Management and Reportable Incidents) Rules 2018, instrument F2018L00633, gives a registered provider 24 hours to notify the NDIS Quality and Safeguards Commission of a death, serious injury, abuse, neglect, unlawful sexual or physical contact, or sexual misconduct. The clock runs from provider awareness. An after-hours AI intake agent can start that clock; it cannot discharge the duty.
That is the design problem for an AI receptionist on an NDIS line in Australia. Most enquiries are ordinary: a support coordinator checking capacity, a family member asking whether you take plan-managed participants, a referral from a local area coordinator. A small number are not. A caller says something at 9pm on a Saturday that, once a human hears it, is a reportable incident with a deadline attached. AI receptionists are now marketed to NDIS services in Australia, and the 24-hour and 5-business-day deadlines travel with that marketing. This page names the provision those deadlines come from, and draws the line at what an intake agent can and cannot do about them.
What the instrument actually says, and which clock applies
The instrument is F2018L00633, made 17 May 2018 and registered on the Federal Register of Legislation on 18 May 2018. Check its currency: the register shows it in force as compilation 0, with no amendments incorporated and none unincorporated as at 6 September 2026. The text you read today is the text as made. Note also that although the instrument is called Rules, its provisions are numbered as sections — practitioners say rule 20, the document says section 20.
Two Parts matter. Part 2 (sections 5–13) requires every registered provider to implement and maintain a documented incident management system; the operative requirements sit in Division 2 (sections 8–13). Section 10 sets the procedures it must contain, including who is “responsible for reporting incidents that are reportable incidents to the Commissioner”. Section 12 sets the minimum details recorded per incident and a 7-year retention period. Section 13(3) requires training requirements for “any persons employed or otherwise engaged by” the provider — worth pausing on if you are engaging an automated intake layer.
Part 3 (sections 14–26) sets the notification duties — two clocks, both running from provider awareness:
| Provision | Trigger | Deadline | Form of notification |
|---|---|---|---|
| s 20(1)–(2) | Death, serious injury, abuse or neglect, unlawful sexual or physical contact or assault, sexual misconduct | Within 24 hours of the provider becoming aware | May be given by telephone or in writing (s 20(5)) |
| s 20(3) | Insufficient information available inside 24 hours | Details in paragraphs 20(2)(a) to (e) within 24 hours; the rest within 5 business days | The remainder must be in writing (s 20(6)) |
| s 20(4) | Witness details and further proposed actions | Within 5 business days of awareness | In writing |
| s 21 | Reportable incidents not covered by s 20(1)(b) — in practice unauthorised restrictive practice | Within 5 business days of awareness | In writing (s 21(2)(a)) |
| s 23 | Significant new information, or a further reportable incident | As soon as reasonably practicable | In writing |
| s 24 | Final report, if required by the Commissioner | Within 60 business days of the s 20(4) or s 21 notification, or a longer period specified by the Commissioner | In writing |
Two carve-outs are easy to miss. Section 16(2) excludes unlawful physical contact where “the contact with, and impact on, the person with disability is negligible”. Section 22 excuses obtaining or notifying certain details where that would, or could reasonably be expected to, “prejudice the conduct of a criminal investigation” or “expose a person with disability to a risk of harm”. Both are judgement calls. Neither belongs in a voice agent’s prompt as a decision rule.
Answering, recording, notifying: three different jobs
These three jobs are easily run together. Separated, the boundary is obvious. Answering is picking up at 9pm, identifying the caller and their relationship to the participant, and not making them ring the next provider. That is an agent’s job.
Recording is capturing what was said, in the caller’s words, with a timestamp, in the shape section 12 requires. That is also an agent’s job, and where automation earns its place: a transcribed, timestamped capture is a better section 12(2) record than a note reconstructed on Monday morning.
Notifying is submitting the Immediate Notification Form or the 5 Day Form through the NDIS Commission Portal. That is not an agent’s job. Section 18 places the duty on the provider’s key personnel and on the person specified under paragraph 10(1)(c). A vendor implying its product handles reportable incident notification is describing a duty it cannot hold.
The honest framing: an AI intake agent is a capture-and-escalate layer. It shortens the distance between a disclosure and a human who can classify it. It does not classify.
What the agent may do, and what must reach a human
| Agent may do | Must escalate to a named human |
|---|---|
| Answer, identify the caller, capture callback number and participant identifier | Any decision on whether the disclosure is a reportable incident |
| Record the disclosure verbatim, with timestamp and audio retained | Any assessment of seriousness under s 16, including the s 16(2) negligible-contact carve-out |
| Ask neutral, non-leading follow-ups: when, where, who else was present, is anyone unsafe now | Anything touching a criminal allegation — s 22 exists because asking can do harm |
| State that the call is recorded and that a person will call back | Reassurance to the caller that a report will be made |
| Direct an immediate-danger caller to 000 and end the call | Contact with police, the Commission, or the participant’s family on the provider’s behalf |
| Page the on-call contact and keep paging until acknowledged | Deciding no escalation is needed because the caller sounded calm |
The last row matters most. The failure mode is not an agent that over-escalates — it is one that treats a low-emotion disclosure as an ordinary message and drops it in a Monday inbox. A disclosure at 9pm Saturday, read at 9am Monday, is roughly 36 hours gone. Whether the provider became aware, in the statutory sense, at the moment of the call is a question for the provider and its lawyers — but you do not want to be arguing it.
So escalation must be a page-and-acknowledge loop, not an email. Unacknowledged after a set interval, it moves to the next name on the roster, and the system logs who was paged and when they acknowledged. That log is the record you will be relying on if the awareness question is ever put to you.
The rest of the intake call, which is most of it
Compliance is the spine, but volume is elsewhere. A first NDIS enquiry is longer than a booking call and carries a fixed set of qualifying questions. An agent tuned for short appointment-setting calls will truncate it.
- Plan management type. Agency-managed, plan-managed or self-managed changes whether you can invoice the participant at all. Ask it in the first minute, not the last.
- Who is calling. Participant, family member, nominee, support coordinator, local area coordinator or discharge planner — each needs a different follow-up and consent position.
- Support type and capacity. Core, capacity building or capital; suburb; days needed; whether the roster can take the shift.
- Waitlist honesty. If the answer is a wait, say the wait, and make sure the enquiry lands on a list a human reviews. Callers ring the next provider not because a wait is unacceptable, but because nobody told them what it was.
What to require of any vendor before you point it at an NDIS line
- Verbatim capture and retention. Transcript plus audio, timestamped, exportable. The 7-year retention in ss 12(4) and 25(2) is yours to satisfy, so the data has to be yours.
- A hard escalation SLA. Named on-call contact, page-and-acknowledge, automatic fallback. Ask what happens when nobody answers.
- No classification claims. If a vendor claims its agent identifies reportable incidents, ask which section it applies, and what happens when it is wrong.
- Data residency and deletion. Disclosures about participants are sensitive information. Ask where recordings sit and who can read them.
- Change control. Section 13(3) requires training requirements for people engaged by you. You should be able to show what the agent was instructed to do, and when that changed.
Where Zian fits: our phone, SMS, email and WhatsApp agents answer, qualify and write structured records into a CRM, with knowledge-base lookups so the answer on plan management types matches your team’s. The Customer Support Agent runs 24/7, and Zian supports 30+ languages with voice cloning. For providers who will not put disclosure recordings on shared infrastructure, Zian supports private model deployment on customer infrastructure. Zian is in partnership-application beta. We do not hold, and do not claim, any NDIS registration or certification — and no vendor’s product discharges a provider’s obligations under F2018L00633.
FAQ
Can an AI receptionist notify the NDIS Commission of a reportable incident?
No. Notification is made by the registered provider through the NDIS Commission Portal using the Immediate Notification Form or the 5 Day Form, and section 18 of F2018L00633 places the duty on the provider’s key personnel and the person specified under paragraph 10(1)(c). The Commission sets this out on its reportable incidents page, which states that timeframes are calculated from when a registered NDIS provider became aware of the incident. An intake agent can capture and escalate; it cannot notify.
Which reportable incidents have a 24-hour deadline and which have 5 business days?
Section 20 sets 24 hours for death, serious injury, abuse or neglect, unlawful sexual or physical contact with or assault of a person with disability, and sexual misconduct including grooming. Section 21 covers everything else that is a reportable incident, in practice unauthorised use of a restrictive practice, at 5 business days. Section 20(3) allows a split: core details inside 24 hours, the remainder within 5 business days.
Does the 24-hour clock start when the AI agent takes the call?
Section 20 runs the deadline from when the provider became aware that the incident occurred. Whether an automated intake layer creates that awareness is a question for the provider and its advisers, not one settled by a vendor’s marketing. The safe design assumes it does: escalate immediately, log the acknowledgement, and never let a disclosure wait for business hours.
What should the agent do if the caller says someone is in danger right now?
Direct them to emergency services and stop taking details. The NDIS Commission’s incident management guidance says to call 000 if the impacted person needs immediate medical care or you suspect a criminal offence has occurred, and not to delay that action. The agent should say it plainly, then page the on-call contact.
Has F2018L00633 been amended?
Not as at 6 September 2026. The Federal Register of Legislation shows the instrument in force as the version registered on 18 May 2018, with no amendments incorporated and none unincorporated. Read the current text at legislation.gov.au before you rely on any summary, including this one.
Do unregistered providers have the same duties?
No. Parts 2 and 3 of F2018L00633 apply to registered NDIS providers, and non-compliance is a breach of a condition of registration under paragraphs 73F(2)(g) and 73F(2)(h) of the National Disability Insurance Scheme Act 2013. The Commission’s guidance is that all NDIS providers should have an incident management system, while registered providers must have one.
Build the intake layer, keep the duty
The defensible position is narrow: answer every call, capture every word, escalate anything that might be reportable to a named human inside minutes, and leave classification and notification where the instrument puts them.