Artificial intelligence promises to change how organisations operate: faster decisions, earlier warnings, less time on paperwork. For NDIS providers, the promise is real and so is the risk. A provider’s records are health and disability information about people who depend on them. The same records are what an auditor, the NDIS Quality and Safeguards Commission, or a family will ask to see when something goes wrong.
Beneath every useful AI tool sits something that is easy to overlook: governed data. Without trustworthy, well-structured data, even a sophisticated model produces output nobody can rely on. Garbage in, garbage out applies to AI as much as to any other system. In a regulated care setting, it also applies to your registration.
AI assists. People decide.
In a compliance setting, AI must never operate on its own. Every AI output that affects a participant, a worker, a report to the Commission or an audit record is a draft until a named person reviews and approves it. That person is accountable for the outcome. The AI is not.
This is a design rule, not a courtesy. It means:
- AI proposes, a person approves. Nothing is lodged, sent, signed off or recorded as final without a human decision.
- Named accountability. Each decision has an owner. “The system flagged it” is not an answer an auditor will accept.
- Escalation to a person. When the AI is unsure, or the matter is serious, such as harm to a participant or a restrictive practice, it hands over to a person immediately.
- Overrides are recorded. When a reviewer changes or rejects an AI suggestion, that is captured along with the reason.
- The evidence trail is complete. For every item you can show what the AI saw, what it suggested, who reviewed it and what they decided.
- People can switch it off. Any AI step can be paused or bypassed without stopping the underlying process.
Where AI can help an NDIS provider
Most of an NDIS provider’s compliance workload is reading, checking, chasing and filing. That is where AI assistance fits best, with a person making the final call on every item below.
- Spotting reportable incidents earlier. Incidents often first appear as a line in a shift note or an email, not as a lodged report. Most reportable incidents have a 24-hour notification clock that starts when the provider becomes aware of them, with a follow-up report due within five days. AI can read incoming notes and messages, flag likely reportable incidents, and pre-fill a draft. A manager decides whether it is reportable and lodges it.
- Chasing approvals and escalations. Restrictive practice authorisations, plan changes and complaints each have owners and deadlines. AI can track what is waiting, who it is waiting on, and nudge or escalate to a person before a deadline is missed. It never grants the approval.
- Checking policy sign-off. Workers need to read and understand current policies and procedures. AI can issue the sign-off, ask short comprehension questions, and record who has completed them. A supervisor follows up anyone who struggles.
- Checking documents. Worker screening checks, qualifications, first aid and driver licence records expire. AI can read uploaded documents, extract the dates and flag what is missing or about to lapse. A person confirms before anyone is cleared or stood down. Workforce records are widely reported by practitioners as a common source of audit findings.
- Cross-checking systems. Rosters, timesheets, invoices and service agreements should tell the same story. AI can compare them and raise anomalies, such as a shift billed with no matching roster entry. A person investigates and decides what to do.
- Preparing audit evidence. Registration and renewal depend on an audit against the NDIS Practice Standards, and auditors work to a limited time window. Evidence that is already indexed, dated and attributable makes that window count, and each item shows who reviewed it.
What the regulators have said so far
The rules are still catching up, so providers should be cautious about vendor claims.
- In February 2026 the NDIS Commission published a position statement on the use of AI in developing behaviour support plans. It does not endorse or approve AI tools for that purpose. It does not stop providers using AI, provided they meet their legal obligations, and it expects participant information to be de-identified and not disclosed to AI systems.
- The Office of the Australian Information Commissioner (OAIC) has published guidance on AI and personal information. It tells organisations to assume the Privacy Act applies where personal information is involved, and recommends a privacy impact assessment before starting.
- Health information, which includes information about a person’s disability, is sensitive information under the Privacy Act and is held to a higher standard. AI-generated inferences about a person can also count as personal information.
- We have not found Commission guidance endorsing AI for detecting reportable incidents, or independent evaluation of vendor claims on the subject. Treat those claims with caution until evidence appears.
The practical reading: use AI to prepare and prompt, keep a person accountable for each decision, and be able to show an auditor how each one was made. That is why human review is built into every step above, not added afterwards.
What “governed data” actually means
Governed data is documented, owned, consistent and auditable. Your core measures share a single definition across every team. Access is controlled by role and every query is traceable. Your data has observable quality checks, not just occasional manual reviews.
When governance is strong, AI can draft and check work that a person then reviews quickly and with confidence. When it is weak, the reviewer has to rebuild every AI output by hand, and most of the benefit is lost. In an NDIS setting, weak governance also means you cannot answer the auditor’s question: who saw this, what did the system recommend, and who approved it?
The three layers of a governed data foundation
At Applysmarts, we structure data governance across three interdependent layers:
- Semantic layer: Shared definitions and business logic, independent of the underlying platform. One definition of “reportable incident”, “active participant” or “worker cleared to work” across every report and every AI tool.
- Access governance: Role-based permissions enforced at the platform level, with full audit trails. For participant information, this is who saw what, when, and under which role. It is also where you decide what is de-identified before it reaches an AI model, and where you record each human approval, so review is evidenced rather than assumed.
- Quality monitoring: Automated checks that detect drift, missing values, broken links between records and statistical anomalies before they reach a report, a dashboard or an AI model.
Our AI models run as AWS, Azure or Google Cloud hosted models resident in Australia, inside your own cloud account.
Starting the journey
Providers at the start of their AI journey often ask where to begin. The answer is always the same: start with your data.
- Pick one painful process. Incident reporting, worker document expiry and policy sign-off are common starting points.
- Map the records involved. Where does the information start, who owns it, and where does it end up?
- Document the definitions. What counts as a reportable incident for you? What counts as a current clearance?
- Assign owners. One named person per dataset.
- Decide what AI may see. Run a privacy impact assessment and decide what is de-identified first.
- Decide who reviews what. For each AI output, name the reviewer, what they check, and how quickly they must act.
- Build the first governed dataset around that core, keep a person approving every output, and let your AI ambitions grow from there.
The providers who benefit most from AI will not be those with the largest models or the biggest budgets. They will be the ones whose records are ready to support AI-assisted decisions that their people can review, their auditors can trace and the people they support can trust.
Not sure where your records stand? Take our 2-minute readiness check or book a free 30-minute call.