Commissioner of the NDIS Quality and Safeguards Commission v Oak Tasmania [2026] FCA 7
On 19 January 2026, the Federal Court of Australia ordered Oak Tasmania (Oak) to pay the Commonwealth a pecuniary penalty of $1.1 million for contraventions of the National Disability Insurance Scheme Act 2013 (Cth) (NDIS Act).
In this proceeding, the Commissioner of the National Disability Insurance Scheme Quality and Safeguards Commission (Commission) sought:
Declarations that Oak breached a condition of its registration and contravened s 73J of the NDIS Act when it failed to notify the Commission of 104 reportable incidents that were required to be reported within 24 hours, and 370 reportable incidents that were required to be reported within five business days.
Declarations that on each occasion that Oak provided supports and services to five of its clients (all of whom were NDIS participants), it contravened s 73V of the NDIS Act because it failed to comply with its conditions of registration as a NDIS provider, s 6(c) of the Code of Conduct and/or relevant Practice Standards.
Declarations that on each occasion Oak provided supports and services to those five clients, it contravened s 73V of the NDIS Act because it failed to comply with s 6(c) of the Code of Conduct, in that it did not provide supports and services in a safe and competent manner, with care and skill.
Orders requiring Oak to pay the Commonwealth a pecuniary penalty for each contravention.
The proceeding was determined by reference to a Statement of Agreed Facts and Admissions (SAFA).
The facts and statutory provisions
Oak is a registered charity and not-for-profit organisation that has been a registered NDIS provider since 1 July 2019.
As a registered NDIS provider, Oak was subject to several conditions of registration including that it:
Implement and maintain an appropriate and compliant incident management system.
Comply with all applicable requirements relating to reportable incidents prescribed by the National Disability Insurance Scheme (Incident Management and Reportable Incidents) Rules 2018 (IMRI Rules).
Under the IMRI Rules a registered NDIS provider must notify the Commissioner of certain serious incidents that occur, or are alleged to have occurred, in connection with the provision of services or supports within 24 hours and other incidents within 5 business days after it becomes aware of the incident.
To that end, the key personnel of a registered NDIS provider or the person responsible for reporting reportable incidents to the Commissioner must take “all reasonable steps” to ensure reportable incidents are notified to the Commissioner, and employees who become aware of a reportable incident must notify those persons “as soon as possible”.
In this proceeding, the Commissioner alleged that in the period from 1 July 2019 to 1 December 2023 Oak failed to notify the Commissioner of:
104 reportable incidents within 24 hours as required by r 20 of the IMRI Rules, and thereby contravened s 73J of the NDIS Act.
370 reportable incidents within five business days as required by r 21 of the IMRI Rules, and thereby contravened s 73J of the NDIS Act.
The Commissioner also alleged that Oak failed to comply with the Code of Conduct by failing to provide supports and services in a safe and competent manner, with care and skill and/or the Practice Standards in relation to mealtime management, identification and management of risks to participants, workers and the provider, and timely and appropriate access to supports without interruption on six occasions for five of its clients. The table below provides an overview of Oak’s contraventions in respect of its five clients.
Person | Contravening conduct | Failure to comply with | Contravention of | Penalty amount | |
Ms D | Failure to ensure employees complied with Ms D’s catheter care plan | sub-s 6(1)(c) of the Code of Conduct | s 73V of the NDIS Act | $100,000 | |
Failure to ensure employees complied with Ms D’s meal management plan | sub-s 6(1)(c) of the Code of Conduct cl 26A, sch 1 of the Practice Standards (mealtime management) | ss 73V and 73J of the NDIS Act | $100,000 | ||
Ms H | Failure to comply with occupational therapist’s report that recommended using a sling hoist to move Ms H | sub-s 6(1)(c) of the Code of Conduct | s 73V of the NDIS Act | $150,000 | |
Mr S | Failure to monitor the behaviour of Mr S or to prevent Mr S from purchasing and consuming a large volume of food that led to his hospitalisation | sub-s 6(1)(c) of the Code of Conduct | s 73V of the NDIS Act | $120,000 | |
Ms C | Failure to follow Ms C’s complex care plan, including in relation to the provision of insulin when required and to seek medical advice when Ms C’s blood sugar level reached 20mmol/L | sub-s 6(1)(c) of the Code of Conduct cl 10, sch 1 of the Practice Standards (risk management) | ss 73V and 73J of the NDIS Act | $150,000 | |
Ms W | Failure to ensure its employee was present at a respite centre for an entire shift when it knew that continuous supervision of Ms W throughout the night was necessary | sub-s 6(1)(c) of the Code of Conduct cl 16, sch 1 of the Practice Standards (continuity of supports) | ss 73V and 73J of the NDIS Act | $130,000 |
The admissions
Oak admitted that it did not comply with:
The requirements under the NDIS Act for notifying the Commissioner of serious incidents within the prescribed timeframes and that it contravened s 73J of the NDIS Act on 474 occasions.
The Code of Conduct and Practice Standards and contravened s 73J and/or s 73V of the NDIS Act on six occasions when providing care and support services to five of its clients.
The Court’s task
As noted above, the proceeding was determined by way of a SAFA. In those circumstances, the Court’s task was to determine whether it was satisfied of three matters before making the declarations and orders sought by the Commissioner. Those three matters were that:
Liability was established.
It was appropriate to make the proposed declarations.
It was appropriate to impose the pecuniary penalty that had been agreed between the parties.
The Court was satisfied that liability was established, that it was appropriate to make the proposed declarations and that it was appropriate to impose the agreed penalty.
Why the agreed penalty was appropriate
The Court noted that it was not bound to accept the penalty amount that was agreed between the parties and was required to determine an appropriate penalty on the evidence and in accordance with the statutory framework.
In assessing the appropriateness of the penalty, the Court applied relevant legal principles for assessing the quantum of civil penalties, including:
The primary purpose of pecuniary penalty regimes is deterrence, both specific and general.
A penalty should not be so high that it is oppressive, but it should not be so low as to be regarded by the contravener as “an acceptable cost of doing business” and must have the necessary “sting or burden” to achieve its primary purpose.
There must be “some reasonable relationship between the theoretical maximum and the final penalty imposed”. The required relationship will be established where the penalty imposed does not exceed what is reasonably necessary to deter future contraventions.
s 82(6) of the Regulatory Powers (Standard Provisions) Act 2014 (Cth) (RP Act) requires the Court to take into account “all relevant matters”, including the matters specified in that sub-section. Other relevant matters have been established in the cases considering pecuniary penalties. They include:
The circumstances in which the conduct took place.
The size of the contravener.
The deliberateness of the contravention and the period over which it extended.
Whether the contravener has a corporate culture of compliance.
Whether the contravener has cooperated with the authority responsible for the enforcement of the relevant Act in relation to the contravention.
The Court must determine an “appropriate” penalty, through a process involving “multi-factorial decision making”, to arrive at a result through a process of intuitive or “instinctive synthesis”.
Where conduct engaged in by a contravener can be characterised as a single act or course of conduct, any penalty “should be attuned to reflect that fact” to avoid double punishment and ensure proportionality.
Relatedly, s 85(1) of the RP Act empowers the Court to make “a single civil penalty order against a person for multiple contraventions of a civil penalty provision if proceedings for the contraventions are founded on the same facts, or if the contraventions form, or are part of, a series of contraventions of the same or a similar character”.
In determining the appropriate penalty for multiple contraventions, the Court should have regard to the totality principle as a final consideration of whether the penalty is just and appropriate and not excessive.
The process for fixing the quantum of a penalty is not “exact” and there is a permissible range in which the “courts have acknowledged that a particular figure cannot necessarily be said to be more appropriate than another”. In cases such as this one (which involve an agreed penalty), the question for the Court is whether the agreed penalty falls within the range of appropriate penalties and that penalty is an appropriate penalty as opposed to the appropriate penalty.
Nature, extent and circumstances of the contravening conduct
The Court:
Found that the nature, extent and circumstances of the contravening conduct were serious given that “reportable incidents are serious matters which centre around the safety of individuals who are some of the most vulnerable in Australian society”.
Accepted the Commissioner’s submissions that:
The legislative regime’s purpose will be defeated if NDIS providers fail to notify reportable incidents within the prescribed timeframes.
In cases involving a failure to notify reportable incidents, late reporting “deprives the Commissioner of information to which she is entitled” and “compromises the ability of the Commissioner to keep participants safe”.
Acknowledged that in the context of statutory reporting requirements, a failure to report deprives the regulator of timely information and hinders law enforcement efforts.
Found that while there was no evidence that Oak intended to breach the law, the Court accepted the parties’ position that the contraventions could have been avoided with adequate reporting processes and guidelines for staff members for reporting incidents within the prescribed timeframes.
The harm/loss suffered as a result of the contravening conduct
The Court accepted that because of Oak’s failures, the persons impacted by each reportable incident may have been deprived of “prompt, adequate and necessary treatment or responses” to the harm that they suffered, or that there was a risk of that being so.
The Court also accepted the Commissioner’s submission and Oak’s admission that its failures caused harm and suffering, or the risk of harm and suffering, to persons with disability and their family members, friends and carers.
The size and financial position of Oak Tasmania
Oak is a public company limited by guarantee and a not-for-profit organisation and a registered charity.
The Court followed the decision in Commissioner of the NDIS Quality and Safeguards Commission v Australian Foundation for Disability [2023] FCA 629 and found that the fact that Oak was a not-for-profit entity did not obviate the significance of specific deterrence or the serious nature of the contraventions.
Given the seriousness of Oak’s contraventions and their potential to cause significant detriment (including fatality) to vulnerable members of the community, the Court accepted that Oak’s conduct “required a strong specific and general deterrent message”.
Prior contraventions
The Court found that Oak had not been found liable for similar conduct to that which was the subject of this proceeding.
Cooperation
The parties agreed that Oak had been cooperative with the Commissioner’s investigation and made appropriate admissions at an early stage of the proceeding and before evidence was filed.
It was acknowledged that Oak’s approach to the investigation and proceeding meant that a protracted investigation and litigation was avoided and this in turn enabled the Commission’s resources and the Commissioner to focus on other investigations, and to spare the Court’s own resources.
Corrective measures
The Court accepted that Oak had since put in place several corrective measures in response to the admitted contraventions. They included implementing:
Comprehensive incident reporting and management procedures.
A Complex Health Care Policy.
A Learning and Development (Complex Care) Credentialling procedure.
Oak also took steps to improve the supports and services it provided to the five people who had been impacted by its conduct, including by way of training and communication with staff and, in some cases, disciplinary action.
The Court also cautioned that the ultimate measure and efficacy of any policy depended on its “implementation and adherence”.
The acquisition of Oak’s parent company
The Court considered the fact that Oak’s parent company had undergone a merger since the contravening conduct had occurred and that all existing directors of Oak and its former parent company had resigned and been replaced. It also considered that there had been a “complete turnover” of Oak’s senior leadership and accepted that these matters could moderate the need for specific deterrence as a penalty consideration.
The proposed pecuniary penalty
The Court found that the theoretical total maximum penalties for the contraventions of:
Sections 73J and 73V in respect of the six non-compliances with the Code of Conduct and the Practice Standards in the relevant period, was $1,797,500.
Section 73J in respect of the 474 times it failed to notify the Commissioner of a reportable incident within the prescribed timeframes in the relevant period, was $129,202,500.
However, the Court accepted the Commissioner’s submission that in cases which involve so many contraventions it may become an “arid exercise to engage in a mere arithmetical calculation” and may not be useful to calculate a maximum aggregate penalty by reference to such a high number of contraventions. Particularly because the potential aggregate maximum penalty would result in an amount that was “well beyond” what a Court would ever impose.
In the circumstances, the Court “adopted an approach of determining the appropriate penalty by reference to all relevant considerations and by taking a broad view of the course or courses of conduct”.
“After weighing all relevant matters, and endeavouring to balance the need for specific and general deterrence with the importance of ensuring the amount of the pecuniary penalty is not so high as to punish and be oppressive”, the Court found that the proposed agreed total aggregate penalty of $1.1 million was appropriate. That amount comprised:
$350,000 for failing to notify the Commissioner of 474 reportable incidents within prescribed timeframes, being $250,000 for failing to notify the Commissioner of 104 incidents within 24-hours and $100,000 for failing to notify the Commissioner of 370 incidents within five business days; and
$750,000 for various contraventions of the NDIS Act in relation to services and supports provided to five of Oak’s clients.
The Court’s declarations and orders
The Court made the declarations sought by the Commissioner and ordered Oak to pay $1,100,000 within 30 days and the Commissioner’s costs fixed in the amount of $200,000 within 21 days.
Key takeaways for providers
Registered NDIS providers must comply with their conditions of registration. Failure to comply with all conditions of registration may result in regulatory action, including civil penalty proceedings.
The notification of serious incidents to the Commissioner within prescribed timeframes is integral to the Commissioner’s protective functions. Any delay may defeat the purpose of the statutory regime and compromise participant safety.
The overall governance, systems and processes of registered NDIS providers are critical to maintaining compliance with mandatory obligations imposed by the NDIS Act. NDIS providers should promote a corporate culture of compliance.
Key personnel and the person responsible for reporting serious incidents to the Commissioner must take “all reasonable steps” to ensure those incidents are notified to the Commissioner. Employees of, or persons otherwise engaged by, a NDIS provider who become aware of a serious incident must escalate that incident within the provider “as soon as possible”.
Contraventions of statutory conditions imposed on NDIS providers will be viewed by the Court as serious and the Court will, in appropriate circumstances, impose significant pecuniary penalties.
Read our NDIS in focus series: