Who Does the NDIS Code of Conduct Apply To? All Roles Covered
This is one of the most common questions we receive from new and growing NDIS providers, and the answer matters more than most realise. The NDIS Code of Conduct applies far more broadly than most providers assume. Getting this wrong means some workers operate without training, creating compliance gaps that surface at audit time. HCPA has helped 10,500+ providers understand and implement Code obligations across their entire workforce – not just their permanent employees.
This guide covers every role and entity type the Code applies to, what obligations look like for each, and how to build a workforce compliance system that holds up under audit scrutiny.
The Short Answer: The Code Applies to Everyone
The NDIS Code of Conduct applies to all NDIS providers and all NDIS workers. This is not a qualified statement – it is the legal position under the NDIS (Code of Conduct) Rules 2018. The Code does not distinguish between registered and unregistered providers, between employees and contractors, or between large organisations and sole traders.
What does vary is how compliance is demonstrated and who carries the primary accountability. Providers (organisations) are responsible for ensuring their workers comply. Workers are individually responsible for their own conduct. Both can face Commission action if the Code is breached.
NDIS Providers: Registered and Unregistered
Registered NDIS Providers
Registered providers are subject to the full suite of NDIS Quality and Safeguards Commission requirements, including the Code of Conduct. Registration requires providers to demonstrate that their systems, policies, and training programs meet Code standards. This is assessed at initial NDIS registration and re-verified at every renewal audit.
Registered providers must ensure that every worker – regardless of role or employment type – understands and complies with the Code. The organisation is accountable for workforce-wide compliance, not just for its own conduct as an entity.
Unregistered NDIS Providers
Unregistered providers delivering supports to self-managed or plan-managed participants are also bound by the NDIS Code of Conduct. This surprises many unregistered providers who assume the Code only applies to those within the Commission’s registration framework. It does not.
The NDIS Commission can investigate complaints about unregistered providers and take action for Code breaches. Unregistered providers who deliver supports without Code-compliant systems carry real regulatory and reputational risk.
NDIS Workers: Every Employment Type
The term “NDIS worker” is defined broadly in the legislation. It is not limited to direct support workers or those in clinical roles. The Code applies to anyone who delivers NDIS supports or who works for an NDIS provider in a role connected to those supports.
Employees
Full-time, part-time, and casual employees are all covered. Employment status does not affect Code obligations. Casual workers who deliver NDIS supports on an irregular basis must still receive Code training, and their completion must be documented. Many providers overlook casuals when updating training records – this is a frequent audit gap our team identifies during audit preparation reviews.
Contractors and Subcontractors
Independent contractors engaged to deliver NDIS supports are NDIS workers for the purposes of the Code. Providers cannot outsource their Code obligations by using contractors instead of employees. The provider must ensure contractors receive appropriate training and comply with the Code – and must document that training.
This extends to subcontractors engaged by contractors. If your provider subcontracts support delivery, you remain responsible for ensuring those subcontractors meet Code standards. Contractual agreements should include explicit Code of Conduct obligations for all subcontractors.
Volunteers
Volunteers who deliver NDIS supports are covered by the Code. This includes volunteers in support roles, not administrative volunteers who have no participant contact. Providers using volunteers in service delivery must include them in Code training programs and maintain training records accordingly.
Agency and Labour Hire Staff
When providers engage workers through labour hire agencies, the Code still applies. The registered provider – not the agency – is responsible for ensuring Code compliance among agency-supplied workers during the period they deliver supports. Relying on the agency to handle Code training is not sufficient. Providers should verify training completion before deploying agency staff.
Key Personnel and Leadership
Key personnel – including directors, CEOs, managers, and others with significant influence over the provider’s operations – are not exempt from Code obligations. In fact, the conduct of key personnel is closely scrutinised by the Commission because leadership behaviour shapes organisational culture.
Key personnel are also subject to the suitability requirements under the NDIS Practice Standards. The Commission assesses whether key personnel have the skills, integrity, and character required to lead a compliant NDIS organisation. A Code breach by a key personnel member carries more weight than the same breach by a frontline worker.
Our team works directly with leadership teams during NDIS compliance reviews to ensure governance structures reflect Code obligations at every level of the organisation.
Sole Traders Delivering NDIS Supports
Sole traders who deliver NDIS supports – whether registered or unregistered – are both the provider and the worker. The Code applies in both capacities. A sole trader support worker has no employer to hold them accountable – they are accountable to themselves, and ultimately to the Commission.
Sole traders operating as registered providers must meet the same Code compliance requirements as larger organisations, including maintaining documented policies, completing required training, and having functional incident management processes. The size of the organisation does not reduce the compliance obligation.
Building a Workforce Compliance Register
Given the breadth of the Code’s application, providers need a systematic approach to tracking workforce compliance. A worker compliance register is the most efficient tool for this. It is a single document – typically a spreadsheet – that tracks each worker’s Code compliance status.
A complete register includes: worker name and role, employment type (employee, contractor, volunteer, agency), NDIS Worker Screening clearance number and expiry date, Code of Conduct training completion date, NDIS Worker Orientation Module completion date, and last supervision date. This register becomes your primary evidence source at audit time.
Providers with this register in place typically complete the workforce compliance section of their audit in under 30 minutes. Those without it spend days scrambling to produce evidence – and often cannot produce all of it.
Frequently Asked Questions
Does the Code apply to support coordinators working for a plan management organisation?
Yes. Support coordinators are NDIS workers and are bound by the Code regardless of their employer’s primary service type. Plan management organisations that also employ support coordinators must ensure those staff receive Code training and comply with all 7 obligations.
Does the Code apply to administrative staff who never meet participants?
This depends on whether the administrative role involves accessing participant information or influencing support delivery. Administrative staff who handle participant records, coordinate services, or make decisions affecting participants are generally considered NDIS workers. Purely administrative roles with no participant connection may be outside the Code’s scope, but most providers train all staff to avoid ambiguity.
What happens if a contractor breaches the Code?
Both the contractor (as an individual worker) and the registered provider may face Commission scrutiny. The Commission will assess whether the provider took reasonable steps to ensure Code compliance, including training and supervision. If the provider cannot demonstrate this, both parties may face enforcement action. Strong contractual obligations and documented training are your best protection.
Do LAC or support coordinator referrers need to comply with the Code?
Local Area Coordinators (LACs) work for NDIA-contracted organisations and are subject to their own conduct frameworks. However, if an LAC also delivers NDIS supports through a registered provider, the Code applies in that capacity. Support coordinators employed by or contracting to registered providers are covered by the Code in full.
How do I prove to an auditor that all workers have completed Code training?
Training records are the standard evidence. These must show each worker’s name, the training content covered, the date of completion, and a signed attestation (digital or physical). Training completion certificates where available, plus a master register cross-referencing all workers, gives auditors the evidence package they need. Verbal assurances are not sufficient.
As Australia’s Regulatory Growth Consultants, HCPA supports providers across Australia to build workforce compliance systems that work under real audit conditions. Our client managers – who average 3 years with the same clients – understand your workforce, your business model, and your compliance history. We build the systems that protect you.
Book a workforce compliance review – and know exactly who is covered and what you need to prove it.
