Does Your NDIS Provider Have to Keep AI-Assisted Records — and for How Long?

Detailed Explanation

NDIS providers increasingly use AI tools somewhere in their record-keeping — drafting case notes from a support worker's shorthand, generating a first pass at an incident report, or helping produce billing documentation faster than typing it from scratch. A reasonable question follows: if a record was AI-assisted rather than written entirely by a person, does that change what a provider is required to keep, or for how long?

The NDIS Amendment (Securing the NDIS for Future Generations) Act 2026 inserted section 45B, commencing 27 August 2026. It requires providers to retain records relating to a claim or to a support to which a claim relates if the records are of a kind prescribed by the NDIS rules. The default period is 7 years from the day the claim is made, but the rules may prescribe a shorter period. Required records must be in English or readily accessible and convertible into English. A breach of the provider duty can attract a civil penalty of 120 penalty units. The provision does not distinguish between human-written and AI-assisted records.

If a provider fails to retain a record required by section 45B and cannot otherwise demonstrate entitlement to an amount it received, that amount can become a debt due to the Agency. A missing record alone does not automatically create the debt; the inability to otherwise show entitlement also matters.

The Rest of the 2026 Reform Package, Briefly

Section 45B doesn't stand alone — it's one part of a broader set of changes commencing around the same period that affect how providers operate day to day:

• The claim window is being cut from 2 years to 90 days, effective 1 December 2026 — providers will have far less time after delivering a support to actually lodge the claim for it, which raises the operational stakes of any billing delay or backlog.
• Module 5A Supported Independent Living Practice Standards came into force 1 July 2026, alongside mandatory registration for SIL providers and NDIS digital platform providers from the same date.
• Reportable-incident timeframes are unchanged by this reform — 24 hours for incidents involving death, serious injury, abuse, neglect, or unlawful sexual or physical contact; 5 business days for an unauthorised restrictive practice (24 hours if it caused harm). See how do disability support providers automate service agreements and plan-funded billing for how those incident and billing mechanics fit together operationally.

Getting the retention duty right matters alongside the shorter claim window. Providers should check the current rules for prescribed record kinds and any shorter period, then ensure records relied on for claims remain accessible.

What This Means for AI-Assisted Record-Keeping Specifically

For a provider using AI tools in documentation, these points matter where the resulting record falls within section 45B or another applicable retention duty:

• The retention clock starts when the claim is made, not when the AI draft is created. Where a finalised record is prescribed, the workflow should save it into the provider's record-keeping system. See what evidence do you actually need to show you're governing AI for the broader point that a policy is not proof a record was retained.
• "Readily convertible to English" matters if any part of the AI workflow involves a non-English intermediate step. Most business AI tools operate in English throughout, but any provider using a tool that translates, transcribes, or processes information in another language at some stage should confirm the final retained record meets this requirement.
• AI-assisted drafting doesn't reduce the accuracy bar a claim-related record has to meet. A record generated in part by AI still needs to accurately reflect what was actually delivered — the retention duty is about keeping the record, but a record that's kept and inaccurate creates its own separate risk if a claim is ever queried.
• A consistent, systemic approach beats ad hoc saving. Providers relying on individual staff to remember to save AI-drafted notes into a permanent record are more exposed than those with a workflow that automatically retains the finalised version as part of the claiming process itself. Recording which AI tools are used for this purpose in the first place is itself worth doing — see what actually goes in an AI register, and who is going to read it.

Things to Consider

• A civil penalty attaches to the retention failure itself, separate from any dispute about the underlying claim. A provider can be penalised for not keeping the record even if the support in question was genuinely and correctly delivered — the paperwork failure is its own separate exposure.
• The default seven-year period is long for digital records tied to a specific tool. Check whether the rules prescribe a shorter period for the record kind, and plan export or migration if the provider changes vendors. See how long should you keep records of AI tool conversations and outputs for the broader retention question.
• This sits alongside, not instead of, general privacy and data-handling obligations for any personal or health information those records contain — retention duties and privacy obligations both apply and don't cancel each other out.
• A reportable incident and a claim-related record are governed by different rules, but both often live in the same case-management system. See how do you automate health and safety incident reporting and follow-up for the incident side of that overlap.

Common Mistakes

• Assuming an AI-assisted record has a lighter standard. The method of drafting does not remove a prescribed record from section 45B.
• Saving only the AI tool's original output, not the reviewed and finalised version actually relied on for the claim. If a staff member corrects an AI-drafted note before it's used, the corrected version is what should be retained as the record that actually supports the claim.
• Treating the 90-day claim-window change and the 7-year retention duty as the same rule. They commence in different phases of the reform and serve different purposes — confusing them risks a provider thinking it's covered on retention when it's actually only tracking the claim deadline, or vice versa.
• Not adjusting workflows before the practical deadlines actually bite. With the claim window and record-keeping duty both changing in the same reform period, a provider that waits until an audit or a queried claim to check its record-keeping practice is leaving the fix later than it needs to.