Regulated restrictive practices are one of the most closely watched areas of NDIS compliance. Here is what counts as one, why a behaviour support plan and authorisation sit behind it, and the two reporting streams providers keep mixing up.
The Accorda Team · 10 August 2026
Few areas of NDIS compliance carry as much weight — or as much worry — as restrictive practices. They sit at the point where a person's safety and a person's rights can pull in opposite directions, and the rules are deliberately strict because of it. The good news is that the obligations, once you lay them out plainly, are clear and finite. Most of the stress providers feel here is not about the care itself. It is about knowing exactly what counts, who has to authorise it, and which report goes where by when.
This is a guide to getting that straight.
A restrictive practice is any practice or intervention that has the effect of restricting the rights or freedom of movement of a person with disability. Under the NDIS, a specific set of these are regulated — meaning their use is subject to formal oversight by the NDIS Quality and Safeguards Commission.
There are five categories of regulated restrictive practice:
Seclusion — the sole confinement of a person in a room or space where their exit is prevented or not facilitated.
Chemical restraint — the use of medication or a chemical substance for the primary purpose of influencing a person's behaviour, other than medication prescribed to treat a diagnosed condition.
Mechanical restraint — the use of a device to prevent, restrict or subdue a person's movement for the primary purpose of influencing their behaviour (not devices used for a proper therapeutic or non-behavioural purpose).
Physical restraint — the use of physical force to prevent, restrict or subdue a person's movement, for the primary purpose of influencing their behaviour.
Environmental restraint — restricting a person's free access to parts of their environment, including items or activities.
The word doing the heavy lifting in most of these definitions is purpose. A locked medicine cabinet is not an environmental restraint. A seatbelt worn for safety is not a mechanical restraint. What tips a practice into regulated territory is using it to influence a person's behaviour. If you are ever unsure which side of the line something falls on, that is exactly the moment to get behaviour support advice rather than to guess.
It is worth saying plainly: the entire framework exists to reduce and eliminate the use of restrictive practices, not to make them administratively tidy. A restrictive practice is a last resort, used only when there is a risk of harm and only in the least restrictive way for the shortest time.
That is why positive behaviour support sits at the centre of the system. Where a regulated restrictive practice is going to be used, the person needs a behaviour support plan developed by an NDIS behaviour support practitioner the Commission has assessed as suitable. The plan looks at why a behaviour is happening and builds strategies to reduce the need for the restrictive practice over time.
The measure of good practice here is not a perfectly filed report. It is a restrictive practice you are actively working to need less of.
If a regulated restrictive practice is going to be used on an ongoing basis, the behaviour support plan is not optional and it is not open-ended. There are defined timeframes:
An interim behaviour support plan within one month of when the regulated restrictive practice was first used.
A comprehensive behaviour support plan within six months of when it was first used.
These deadlines run from first use, not from when you got around to arranging the specialist. That is a common place for well-meaning providers to fall behind — the support is happening, the plan is "being organised," and the clock has quietly run out.
Here is the part that trips people up most. Authorising the use of a regulated restrictive practice is handled by the authorising body in the state or territory where the person lives — not by the NDIS Commission. Every state and territory runs its own authorisation arrangements, and they differ in the detail.
As the implementing provider, getting that authorisation is your responsibility. You cannot assume it has been handled elsewhere in the person's support team. If a regulated restrictive practice is in use, someone needs to be able to point to the authorisation that covers it — and to the behaviour support plan it belongs to.
Now to the reporting, where most of the confusion — and most of the risk — lives. There are two distinct streams, and providers regularly collapse them into one in their heads.
1. The monthly report on authorised use. When you use regulated restrictive practices in line with a behaviour support plan and the relevant authorisation, you submit a monthly report to the NDIS Commission on that use. It is completed within five business days of the end of the month. This is the routine, expected reporting for practices that are properly in place — it is how the Commission keeps sight of what is being used and, over time, whether it is reducing.
2. The reportable incident for unauthorised use. When a regulated restrictive practice is used without the required authorisation, or not in accordance with a behaviour support plan, that is a different matter entirely. It is a reportable incident, and it must be reported to the NDIS Commission within five business days of the provider becoming aware of it.
The distinction matters because the two live in different parts of your obligations. The monthly report is business-as-usual. The unauthorised-use report is an exception report that signals something went outside the rules. Treating an unauthorised use as "we'll pick it up in the monthly report" is precisely the mistake that turns a one-off into a compliance finding.
A simple way to hold it in your head:
Authorised, in-plan use → monthly report, within 5 business days of month end.
Unauthorised or out-of-plan use → reportable incident, within 5 business days of becoming aware.
Both windows are five business days. What differs is the trigger and the seriousness.
In practice, providers rarely fail here because they do not understand restrictive practices. They come unstuck on the connective tissue:
The support worker on the ground does not recognise that what happened counts as a regulated restrictive practice, so nothing gets flagged.
An unauthorised use is noticed, but it drifts for a week while people work out who lodges what — and the five-day window closes.
The behaviour support plan exists, but the authorisation, the staff sign-offs and the incident records live in three different places, so proving the whole picture at audit is a scramble.
The records themselves are editable documents with no reliable trail of who wrote what, when — which is a problem when a regulator is asking whether a note was made on the day or tidied up afterwards.
None of these are failures of care. They are failures of evidence and timing. And that is a narrower, more solvable problem than it feels like at 4:55pm on the fifth business day.
Let us be honest about the boundary. Accorda does not write behaviour support plans, does not decide whether a practice is authorised, and does not submit your monthly regulated-restrictive-practices report to the Commission portal on your behalf. That is clinical and regulatory work that belongs with your behaviour support practitioner and your team.
What Accorda does is hold the compliance scaffolding around it steady, so the timing and the evidence stop being the weak point:
Incident reporting with reportable-incident detection — when a restrictive practice is used outside authorisation or a plan, the report is triaged as the reportable incident it is, not buried in a general note, so it lands inside the five-business-day window.
Smart bundled notifications — deadline reminders that keep the month-end reporting and any incident timeframes from sneaking up on a busy team.
Policy management with staff sign-offs — a current restrictive-practices policy that your workers have actually read and signed, so "our people know the rules" is something you can show, not just say.
Tamper-evident records integrity — a clear, dated trail behind every record, so you can demonstrate a note was made when it says it was.
One-click audit evidence packs — the policy, the sign-offs and the incident history pulled together in one place when an auditor asks.
Regulatory Radar — a watch on the rules themselves, so if the requirements shift, you find out before an auditor tells you.
In other words: you and your practitioners do the work of reducing restrictive practices and getting the plans and authorisations right. Accorda makes sure the reporting deadlines are met and the evidence holds together.
Restrictive practices are strictly regulated for good reason, and the framework is built to make you need them less over time. The obligations are demanding but finite: know the five categories, get a behaviour support plan and authorisation in place, and keep the two reporting streams — the monthly report and the unauthorised-use reportable incident — clearly separate, each inside its five-business-day window. Get the plan, the authorisation and the reporting lined up, keep the records honest, and this stops being the thing you dread and becomes just another part of good, provable care.
NDIS Quality and Safeguards Commission — Rules for behaviour support and restrictive practices
NDIS Quality and Safeguards Commission — Behaviour support and restrictive practices (overview)
NDIS Quality and Safeguards Commission — Regulated Restrictive Practices Guide
NDIS Quality and Safeguards Commission — The Positive Behaviour Support Capability Framework
This article is general information only, current as at August 2026, and is not legal or compliance advice. Regulatory requirements can change.
Start today
Try Accorda free for 14 days. Every feature, no credit card, no auto-charge.
