Australian compliance isn’t one-size-fits-all. A disability services provider faces a completely different set of regulatory obligations than a construction company or a local council — and the penalties for getting it wrong can be just as severe.
This guide breaks down the core compliance obligations for five sectors where the regulatory load is especially significant: NDIS providers, aged care operators, healthcare businesses, construction companies, and local governments. If you want to understand the broader cost of compliance across Australian business, see our companion piece on the real cost of compliance for Australian SMEs.
NDIS Providers
Primary regulator: NDIS Quality and Safeguards Commission
Key legislation: National Disability Insurance Scheme Act 2013, NDIS (Provider Registration and Practice Standards) Rules
NDIS providers operate in one of the most closely regulated environments in Australia. Registration with the NDIS Commission is required for most providers delivering funded supports, and with that registration comes a detailed set of ongoing obligations.
The NDIS Practice Standards set the benchmark for quality and safety across all registered providers. Providers must maintain an incident management system with documented processes for identifying, reporting, and investigating incidents — including critical incidents involving abuse or neglect. A complaints management system accessible to participants is mandatory. All workers in risk-assessed roles must hold a current NDIS Worker Screening Check, with accurate records maintained. Internal service delivery audits must be conducted at least quarterly. Governance structures must be demonstrated as actively effective — not just documented on paper.
The 2025 updates raised the bar considerably. Providers must now demonstrate that governance structures are working in practice. Business continuity plans, participant communication strategies for critical incidents, and staff training requirements are now explicit requirements. Expanded registration obligations are also rolling out from late 2025 through 2026, covering SIL providers, online platform-based services, and support coordination. The NDIS Commission has made clear that enforcement is increasing — more audits, greater scrutiny, and tougher consequences for breaches.
Aged Care Providers
Primary regulator: Aged Care Quality and Safety Commission
Key legislation: Aged Care Act 2024 (commenced 1 November 2025)
The aged care sector underwent its most significant regulatory overhaul in a generation when the new Aged Care Act commenced on 1 November 2025. For providers still adapting to the new framework, this is not a minor update — it represents a fundamental reset of obligations and accountability.
The strengthened Aged Care Quality Standards that came into force alongside the new Act replaced the previous eight standards. There are now seven Quality Standards covering: the rights and dignity of people receiving care; governance; care and services; the care environment; clinical care; food and nutrition; and the residential community. Providers are registered in categories from 1 to 6 based on the services they deliver. Core obligations include clinical governance, worker screening, three-yearly registration renewal, and active compliance with a new statutory Statement of Rights. The Commission can suspend a provider’s registration for up to 90 days where serious non-compliance is identified, and civil penalties apply to breaches of the Act.
Healthcare Businesses
Primary regulator: Australian Health Practitioner Regulation Agency (AHPRA) and National Boards
Key legislation: Health Practitioner Regulation National Law Act 2009
Healthcare in Australia is regulated at the practitioner level through AHPRA and 16 National Boards — covering doctors, nurses, pharmacists, physiotherapists, and 12 other registered health professions. For healthcare organisations, compliance obligations span both the obligations on the practitioners they employ and the obligations on the business itself.
All registered practitioners must maintain current registration, meet continuing professional development requirements, and hold appropriate professional indemnity insurance. Healthcare businesses must have systems to verify practitioner registration status — employing an unregistered practitioner is a serious compliance failure. Mandatory notification obligations apply: employers have a legal duty to notify AHPRA if they reasonably believe a registered practitioner has engaged in notifiable conduct, including practising while impaired or placing the public at risk.
AHPRA received 13,327 notifications about health practitioners in 2024–25 — an increase of approximately 19% on the previous year. This trajectory indicates increasing regulatory scrutiny. New AI guidelines from AHPRA (2024) also clarify that individual practitioners remain ultimately responsible for clinical decisions involving AI tools, a compliance dimension becoming increasingly relevant as technology adoption grows in the sector.
Construction Companies
Primary regulator: State and territory WHS regulators (SafeWork NSW, WorkSafe Victoria, etc.)
Key legislation: Work Health and Safety Act 2011, Work Health and Safety Regulation 2025 (NSW)
Construction consistently ranks among Australia’s most hazardous industries, and regulators have responded with tougher rules and significantly higher penalties. Principal contractors must prepare a WHS Management Plan before construction work begins on notifiable projects. Safe Work Method Statements (SWMS) are required for all high-risk construction work. High-risk work licences are required for specific activities including crane operations, scaffolding, and pressure equipment.
Key changes from 2025 include: the nationwide ban on engineered stone containing more than 1% crystalline silica; new silica registers for businesses with silica-exposed workers; strengthened psychosocial hazard management requirements; and new lithium-ion battery storage rules. The maximum penalty under the model WHS laws is $20,441,000 for a body corporate — with industrial manslaughter provisions in NSW and other jurisdictions carrying the potential for up to 20 years’ imprisonment. Managing WHS risk is a legal requirement in construction, not a best practice. The new WHS Regulation 2025 in NSW also introduced significantly higher on-the-spot fines for common site safety failures.
Local Governments
Primary regulators: State government departments (varies by jurisdiction)
Key legislation: State-based Local Government Acts
Local councils operate under an unusually complex compliance environment — simultaneously subject to state local government legislation, the national WHS framework, environmental protection laws, planning and building codes, and their own community obligations. Councils must prepare annual financial statements, submit required returns, maintain meeting records and conflict of interest disclosures, and comply with their state’s procurement rules for government-funded projects.
Victoria’s Local Government Amendment (Governance and Integrity) Act 2024 (Royal Assent June 2024) strengthened obligations significantly — introducing mandatory training for mayors and councillors, improved conduct frameworks, and increased sanctions for misconduct. Full WHS Act obligations apply to councils as employers, including psychosocial hazard management, incident recording, and due diligence obligations for council officers. Managing these obligations effectively requires a structured compliance register — the volume and variety of legislative obligations across planning, environment, finance, HR, and WHS makes spreadsheet management genuinely impractical at scale.
The Common Thread
What’s striking across all five sectors is that compliance obligations are expanding, enforcement is increasing, and the documentation standard expected by regulators is higher than it was five years ago. NDIS providers face more audits and tighter practice standards. Aged care is operating under a completely new legislative framework. Healthcare practitioners face a 19% increase in regulatory notifications. Construction businesses are dealing with new bans, higher penalties, and explicit psychosocial obligations. Local governments are navigating strengthened governance and conduct requirements.
The businesses and organisations that handle this well don’t treat compliance as a filing exercise — they treat it as a live system. That means a current risk register, a functioning compliance register, documented incident records, and processes that actually update when the law changes. Purpose-built GRC software is the practical way to bring all of this into one place, rather than managing it across disconnected spreadsheets and shared folders.
Frequently Asked Questions
What are the main compliance obligations for NDIS providers in 2025?
NDIS providers must maintain incident and complaints management systems, conduct internal service audits at least quarterly, keep accurate workforce documentation, and demonstrate that their governance structures are actively effective. The 2025 Practice Standards updates made these requirements more explicit.
What changed for aged care providers in November 2025?
The new Aged Care Act 2024 commenced on 1 November 2025, introducing seven strengthened Quality Standards, provider registration categories, three-yearly registration renewal, a new Statement of Rights, and stronger clinical governance obligations.
What are AHPRA’s mandatory notification requirements?
Employers must notify AHPRA if they reasonably believe a registered practitioner has engaged in notifiable conduct — including practising while impaired, sexual misconduct with a patient, or placing the public at risk through significantly below-standard practice.
What is an SWMS and when is it required in construction?
A Safe Work Method Statement (SWMS) identifies high-risk construction work activities, the hazards involved, and control measures to be applied. It is legally required before commencing any high-risk construction work as defined under the WHS Regulation — including work at heights over 2 metres, demolition, and excavation.
Are local government councils subject to WHS obligations?
Yes. Local governments are employers subject to the full Work Health and Safety Act — including hazard identification, psychosocial risk management, incident recording, and due diligence obligations for officers.
How can businesses manage multiple compliance obligations across these sectors?
Use a compliance register to track every obligation by source, owner, and status. Linking this to a risk register means that when an obligation changes or is missed, the associated risk is visible and can be actioned — rather than discovered when a regulator or auditor raises it.