The NDIS has made prime time over the past few months, with the National Disability Insurance Scheme Amendment (Securing the NDIS for Future Generations) Bill 2026 passing Parliament and receiving Royal Assent on 20 August 2026, following a lengthy Senate inquiry.

In a recent article, we unpacked the NDIS Amendment (Securing the NDIS for Future Generations) Act 2026 and its headline changes, including a new seven-year record-keeping requirement for NDIS providers. Given the latter’s impact on compliance and claiming, we think this change deserves a closer look.

The headline is straightforward: very soon, NDIS providers will (generally) be required to retain prescribed records relating to NDIS claims for seven years from the day the claim is made, unless the NDIS Rules prescribe a shorter period for a particular type of record.

But there’s more at stake than keeping tidy files, with failure to comply attracting a civil penalty. Operationally, missing records can also have consequences for demonstrating your entitlement to payments.

We need to qualify this: we don’t yet have the final list of records that will be prescribed by the NDIS Rules. So, what do providers actually need to do now?

What does the new requirement actually say?

The legislation does not say that every document an NDIS provider creates must be kept for seven years. Instead, new section 45B of the National Disability Insurance Scheme Act 2013 requires providers to keep and retain prescribed records relating to a claim for payment of an NDIS amount, or the provision of an NDIS support to which such a claim relates.

The specific kinds of records that providers will need to retain will be set out in the NDIS Rules. The default retention period is seven years from the day the claim is made, although the Rules can prescribe a shorter period for particular records.

So, what records will providers need to keep?

This is the question that we can’t fully answer. The legislation establishes the seven-year framework, but the detailed categories of prescribed records are to be determined through the NDIS Rules.

Providers shouldn’t assume that every invoice, email, case note, timesheet, service agreement or other document will automatically fall under the seven-year requirement, but it’s unwise to wait until the Rules are finalised before considering whether your systems can support the new obligation.

The direction is clear: providers must maintain appropriate records supporting claims and the provision of the supports to which those claims relate. The Government has indicated that further information will be provided about how providers should keep records.

In other words, the exact details are still coming. But now is a good time to make sure your underlying claiming and record-keeping processes are up to the task.

Why does this matter to claims teams?

Providers have always needed appropriate documentation to support the services they deliver and the claims they make. What’s changing is that the government is formalising the retention requirement and the consequences if you fail to comply.

For claiming and finance teams, the question becomes: Can we still demonstrate what happened when a claim was made, potentially years after the service was delivered? That’s a different challenge from simply having a good filing system today.

A provider might have retained the relevant information but still struggle to reconstruct a claim several years later because the information is spread across different systems, has been archived, or isn’t clearly connected to the original transaction.

The goal should therefore be more than keeping data; it should be maintaining a reliable record of the transaction and the information that supports it.

What should providers be asking now?

While we wait for the Rules to provide the detailed record categories, providers can start by stress-testing their existing systems.

Ask yourself:

• Can we retrieve historical claims easily? Not just the claim itself, but the information surrounding it.
• Can we link a claim to the support it relates to?
• Can we identify the payment associated with a claim?
• Can we retrieve remittance information when we need it?
• Can we identify what documentation or evidence supported the claim?
• Can our systems preserve records in a usable form for seven years?
• If we change billing, CRM or practice-management systems, what happens to our historical records?
• Do our current retention policies reflect the new seven-year framework?
• Can records be produced in English, or readily accessed and converted into English, where required?

These are useful questions regardless of exactly how the final Rules are drafted, because retention isn’t particularly useful if your organisation can’t actually find and interpret the relevant information when it needs it.

There’s more at stake than a penalty

The new rules introduce a civil penalty for failing to comply with the record-retention requirement. However, providers need to understand another important consequence of this.

The legislation provides that where an NDIS amount has been paid, a provider was required to retain a record relating to the claim, and the provider has failed to comply with that requirement, the amount can become a debt due to the Agency if the provider cannot otherwise demonstrate their entitlement to the payment.

This means that record-keeping isn’t simply about satisfying an administrative requirement or avoiding a fine; records form part of the evidence a provider relies on to demonstrate that a payment was properly claimed and received.

That makes the connection between claiming, supporting evidence, payments and record retention particularly important.

What does this mean in practice?

For providers, preparing for the new requirement isn’t necessarily about buying more storage. A few practical steps are worth taking now.

1. Review your retention policy

Look at how long different categories of NDIS records are currently retained and why. Don’t assume that the retention periods you’ve historically used will be sufficient once the new requirements commence. At the same time, don’t automatically label every NDIS document as subject to a seven-year legal requirement before the Rules tell us which records are prescribed.

2. Test historical retrieval

Pick a sample of older claims and see how quickly your team can reconstruct them.

• Can you find the original claim?
• Can you identify the service it relates to?
• Can you find the relevant payment or remittance information?
• Can you locate the supporting records?

If the answer is “yes, but it takes a lot of digging”, that’s useful information about where your systems could be improved.

3. Understand how your systems connect

The risk isn’t that information isn’t being captured, but that information is being captured in several different places without a clear relationship between them. Your billing platform, CRM, rostering system, client management system and accounting software may each hold part of the picture. Consider whether your systems allow you to reconstruct the transaction as a whole.

4. Plan for system changes

Seven years is a long time in technology. The system you use today may not be the system you use in 2030, let alone 2034. When changing billing or practice-management systems, ensure you understand how historical records will be preserved and retrieved after migration. Don’t leave the question of legacy data until after the old system has been switched off.

5. Ask your software providers some direct questions

Don’t assume your billing software automatically solves the problem. Ask:

• How long are claim records retained?
• Can historical claims be retrieved?
• Can claim records be linked to payment and remittance information?
• What supporting information is retained?
• What happens to historical records if we cancel our subscription or migrate platforms?
• Can records be exported in a usable format?
• How is historical data protected from alteration or loss?

These questions are particularly important when your claiming processes rely heavily on technology.

The bigger picture

The seven-year record-retention requirement is part of a broader shift in the NDIS towards stronger oversight, greater scrutiny of claiming and more formal compliance obligations. For providers, that means the quality of the claiming process matters beyond the moment a claim is submitted.

Providers with well-organised, connected claiming records already have a head start. We still need the NDIS Rules to tell us exactly which records will be prescribed, but providers don’t need to wait for that detail to start asking whether their systems are capable of meeting a seven-year retention framework.

Because when a question about a claim eventually comes — whether from an auditor, reviewer or regulator — the answer shouldn’t depend on someone remembering where a spreadsheet was saved seven years earlier.

Good claiming isn’t just about getting paid. It’s about being able to demonstrate why you were entitled to be paid. If you’re reviewing how your claiming and record-keeping processes will need to change, the quickclaim team can help you understand the implications for your current setup.