Right now, only 6% of NDIS providers are registered and visible to regulators.¹ The remaining 94% operate in a space the Commission can see almost nothing of — no audits, no reporting obligations, no meaningful power to intervene.

That changes in July.

From 1 July 2026, mandatory registration comes into force for Supported Independent Living (SIL) providers and online platform providers matching participants with support workers. It is the most significant expansion of the NDIS Commission's oversight powers since the scheme began. But registration alone is not enough. The real question is what we build on top of it.

‍

Under the existing framework, registration has been voluntary for many provider types. Unregistered providers are not illegal. They are simply invisible. The NDIS Commission has no visibility over who they are, how many there are, what services they are delivering, or what is being claimed against participant plans. They are not subject to audits. They do not need to notify authorities when something goes wrong — including, extraordinarily, participant deaths.²

Multiple reviews — the NDIS Review, the Disability Royal Commission, and the Provider and Worker Registration Taskforce — all reached the same conclusion: the lack of mandatory registration in high-intensity support settings created a regulatory blind spot that left participants exposed and fraud unchecked.³

‍

The compliance failures that flourish in unregistered provider environments follow consistent, well-documented patterns.

Duplicate billing across multiple entities. Claims for services with no evidence of delivery. Inflated invoices submitted against participant plans with no corresponding service record.

These patterns exist not because unregistered providers are inherently more fraudulent than registered ones — many are doing the right thing — but because the absence of registration creates an environment where fraud is structurally easier to commit and structurally harder to detect. No audit trail. No reporting obligations. No visibility for the Commission until a complaint is made or a participant is harmed.

Mandatory registration doesn't eliminate fraud. It eliminates the blind spot that fraud depends on.

‍

Mandatory registration produces something the NDIS has never had before: a complete, structured dataset of who is operating in the market.

The NDIS already processes around 500,000 claims every single day.⁴ The ANAO found that 53.7% of claims subject to manual pre-payment review were cancelled for non-compliance.⁵ Manual review at this scale has already been shown to be only partly effective — and mandatory registration is about to add thousands of newly registered providers to that volume. The dataset is getting bigger. The case for automation is getting stronger.

This is precisely where an automated compliance engine changes the equation. Rather than checking registration status after a claim has been submitted and payment queued, an automated system validates it at the point of transaction. Is this provider registered? Is their registration current or lapsed? Are their workers screened? Does the claim match the participant's approved plan?

These are not complex questions. They are deterministic checks that a rules-based system can answer in milliseconds — and that a manual review process, working through 265,000 flagged claims a day, simply cannot.

Beyond the point-of-claim checks, automation unlocks something more powerful: behavioural pattern detection across the entire registered provider population. Connected entity networks billing the same participants. Velocity anomalies — sudden spikes in claim volume from newly registered providers. Bulk submissions outside business hours. Providers whose registration is current, but whose billing patterns are inconsistent with their stated services.

These signals are invisible to a system processing claims one at a time. They are only visible when you can analyse the full dataset continuously — which is exactly what automation makes possible.

Mandatory registration is the government's recognition that you cannot govern what you cannot see. From July, the Commission will have visibility over a portion of the market it previously had no window into at all.

But visibility is the starting point, not the destination.

Registration creates the conditions for a more transparent, more accountable NDIS. What it does not create on its own is the real-time compliance infrastructure needed to act on what that transparency reveals. Catching a fraudulent claim six months after payment is better than never. Blocking it before payment is released is better still.

The blind spot is closing. The dataset is growing. The question now is whether the compliance infrastructure keeps pace — or whether the scheme finds itself with more data than it can act on, and fraud that is better documented but no harder to commit.

Automation is not a future consideration for the NDIS. It is the logical and necessary next step in a reform agenda that has already done the hard work of establishing who is in the market.

The government is signalling that mandatory registration will expand further — to personal care providers, daily living supports, and providers operating in closed settings. The July reforms are the beginning of a broader trajectory. Each expansion adds more providers to the registered dataset. Each addition strengthens the case for the automated layer that makes that data actionable. The foundation is being laid. Now it needs to be built on.

‍