What the court found
The case is Commissioner of the NDIS Quality and Safeguards Commission v Oak Tasmania [2026] FCA 7, brought by the Commission itself. Oak Tasmania, a registered provider delivering daily living supports in shared living arrangements and group homes, admitted to 6 contraventions of the NDIS Practice Standards and Code of Conduct and 474 contraventions of the Reportable Incidents Rules, per the Commission’s account of the judgment.
The Commission’s release records the Court finding “instances where care management plans were not followed, staff were not adequately trained to meet participants’ support needs, medical devices and medication were not properly administered, and an adolescent was not properly supervised”. Justice McEvoy said Oak’s conduct caused or risked causing harm “of the utmost seriousness” to people with disability, and that reporting delays meant some individuals “may have been deprived of prompt, adequate and necessary treatment or responses”.
The penalty splits into $750,000 for the Code of Conduct and Practice Standards contraventions and $350,000 for the Reportable Incidents Rules contraventions, plus $200,000 towards the Commission’s costs.
Why 474 late reports carried a third of the penalty
The number worth pausing on is 474. Most of the contraventions were not direct care failures; they were failures to tell the regulator about serious incidents within the required timeframes. The Court, per the Commission’s release, found the reporting failures “deprived the regulator of timely information” and compromised “the ability of the Commissioner to keep participants safe”.
For providers, that is the doctrinal point of the case. Reportable-incident notification is not administrative overhead attached to the real obligations; the Court priced it, on its own, at $350,000. Commissioner Louise Glanville’s framing in the release makes the regulator’s intent explicit: “Registered providers must also report serious incidents to the NDIS Commission, so risks can be identified and addressed… When providers fail to meet these obligations, the NDIS Commission will take strong enforcement action to hold them to account.”
The ladder, visible in one register
Oak Tasmania’s trail on the enforcement register begins long before the court case. A compliance notice effective 23 July 2020 required action on non-compliances with the NDIS Code of Conduct and the Practice Standards; a second, effective 30 July 2021, addressed possible non-compliance with the Restrictive Practices and Behaviour Support Rules. Both entries record that “Oak Tasmania has fulfilled all the requirements of the compliance notice”.
That is the enforcement ladder end to end: corrective notices first, resolved and recorded as resolved; court proceedings when the Commission judged the later failures serious enough to warrant them. It is also a fair-reading caution that cuts both ways. A compliance notice on the register is not a scarlet letter; the register itself records notices being satisfied. And a satisfied notice is not immunity; the question the Oak case answers is what sits at the top of the ladder when obligations fail at scale. As we showed in our reading of the full register, most register entries are bulk deadline enforcement; the Oak case is what the other end of the same system looks like.
We report this case from the Commission’s published release and the register’s published entries only; nothing beyond the regulator’s and the Court’s own recorded findings is asserted. The Commission’s release notes a copy of the judgment is available on the Federal Court website under its citation, [2026] FCA 7.
Primary sources
- NDIS Commission media release, $1.1 million penalty imposed on Tasmanian NDIS provider for serious safety and reporting failures, 19 January 2026 (quoting Commissioner of the NDIS Quality and Safeguards Commission v Oak Tasmania [2026] FCA 7)
- NDIS Commission, compliance and enforcement actions register (Oak Tasmania compliance notices effective 23 July 2020 and 30 July 2021)
- NDIS Commission, enforcement register full CSV export (downloaded 19 July 2026)