Yes, within strict limits. The NDIS Commission's February 2026 position statement says the current legislative framework does not explicitly prohibit AI, but the Commission does not endorse or approve AI tools for behaviour support plans. Providers who use AI are expected to de-identify all information, disclose no participant's personal information, and keep human oversight and clinical judgement.
That wording matters, because it sets the shape of everything a provider can safely do. A behaviour support plan is a clinical document written by a practitioner in consultation with the participant and the people around them. The Commission's concern is about personal information leaving the provider, content that is wrong or was never developed with the participant, and decisions made without human oversight. A workflow that respects those three points can use AI for a narrow set of drafting jobs. A workflow that does not is exposed to breaches of the NDIS Code of Conduct and the NDIS Act.
What the statement actually says
The statement is four pages and dated February 2026. It begins from the observation that NDIS providers are increasingly using AI when developing and reviewing behaviour support plans, then sets out risks and the Commission's position. The points that matter to a provider are these.
No explicit prohibition. The current legislative framework does not explicitly prohibit the use of AI.
The risks it names. Disclosure of personal participant information to third parties; processing or storage of personal information overseas; a lack of transparency about how data is stored, secured or used once entered into an AI system; inaccurate or misleading content or advice, including content not developed in consultation with the participant or their carers; and automated decision-making without appropriate human oversight or the application of clinical judgement.
The consequence. Unless mitigated, these risks may in certain circumstances breach the NDIS (Code of Conduct) Rules 2018 and other provider obligations. The statement gives an example: disclosing sensitive personal information to a third-party AI platform such as ChatGPT without appropriate safeguards may breach section 6(b) of the Code of Conduct, which requires providers to respect the privacy of people with disabilities.
The position. The Commission does not endorse or approve the use of AI tools in developing and reviewing behaviour support plans. That does not stop providers using AI, so long as the use complies with their legal obligations.
What providers must do. If a provider decides to use AI, the Commission expects all information to be appropriately de-identified and no personal information of participants to be disclosed to AI systems. Any use should be consistent with the national AI Ethics Principles the statement names. If a provider does not do this, they may be breaking the law, including their obligations under the NDIS Act. Specialist behaviour support providers must also meet all registration conditions under the NDIS (Restrictive Practices and Behaviour Support) Rules 2018, which require plans to be person-centred, evidence-informed, reflective of the person's needs, upholding their dignity and privacy, and developed in consultation with the participant, family, carers, guardian, providers and support workers.
Read the statement itself before you write your policy: it is titled "Use of artificial intelligence in the development of behaviour support plans" and sits with the other behaviour support position statements on the Commission's website. This summary cannot replace it. For the wider privacy picture, AI for NDIS providers: what is safe under the privacy principles goes through the everyday jobs.
The Complete Excel Course with AI Integration
From formulas and pivot tables to Power Query, DAX, VBA and AI with Copilot, ChatGPT and Claude — hands-on from the first lesson.
By Sagnik Bhattacharya and Virginia Thorn, Primetime Emmy Award winner
Buy nowWhat this means for a provider, in plain terms
Three practical conclusions follow. First, there is no approved list of AI tools, so a vendor claiming to be "NDIS compliant" for plan writing has no Commission endorsement to point to. Ask what it means. Second, the safe use is narrow: wording and layout work on text that identifies no one, never the clinical thinking. Third, accountability does not move. The practitioner who writes the plan and the provider who registers it remain responsible for every sentence.
The statement also quietly rules out a popular idea: dropping a session recording or a participant's file into an AI tool to generate a plan. Whatever the tool's marketing says, the Commission expects that no participant personal information reaches it. If you cannot show that, do not do it.
A workflow that applies the statement, step by step
The steps below translate the Commission's expectations into a routine. Each step names the part of the statement it serves.
Step 1: Decide the policy before anyone opens a tool
Write a one-page rule that names which AI tools, if any, are approved, what may be entered, who may use them, and who signs plans off. Put it in your policies and procedures, and brief staff. Tailoring NDIS provider policies and procedures with AI shows how to adapt a template to your own service. The policy serves the "transparency and data" concern: you can show what was allowed.
Step 2: Write the plan content yourself, from your assessment
The functional behaviour assessment, the participant's goals, the strategies and the restrictive-practice decisions come from the practitioner and the consultation. Nothing in the statement suggests AI may originate these. Develop them in consultation with the participant, family, carers, guardian and support workers, as the Rules require, and keep the record of that consultation.
Step 3: De-identify a separate working copy
If you want AI help with wording, create a stripped copy. Replace the participant with "the participant" or "Person A". Remove names, dates of birth, addresses, NDIS numbers, provider and school names, staff and family names, and unusual events. Check for indirect identifiers: a rare diagnosis plus a small town plus a specific incident can identify someone. If you cannot remove them without losing the clinical meaning, do not use AI for that passage.
A before and after, illustrative. Before: "[First name] has refused to leave the house since the incident at the [street name] day centre on 3 March." After: "The participant has been reluctant to leave the home since an incident in a community setting earlier this year." The second still carries the clinical point and none of the identifiers.
Step 4: Limit the task to wording and structure
Choose jobs where the AI works only on text you supply and adds nothing clinical. Good examples: converting a strategy into plain English for a carer's one-page summary, checking that a section is consistent in tense and tone, suggesting clearer headings, or producing an Easy Read draft of text that is already agreed. Poor examples: suggesting strategies, proposing replacement behaviours, deciding when a restrictive practice is justified, or summarising a participant's history from notes.
Rewrite the paragraph below into plain English at about a Year 7 reading level.
Keep every instruction exactly as written: do not add, remove or reorder
strategies, and do not add advice. Keep "the participant" as written. If any
sentence is unclear, list it at the end instead of changing its meaning.
[de-identified paragraph pasted here]Illustrative output: the tool returns a shorter paragraph, and in one place changes "offer a choice of two quiet activities" to "encourage the participant to choose a quiet activity". That drops the structure of offering two options, which was a deliberate strategy. This is the kind of change the practitioner must catch, and why the instruction to preserve instructions exactly is not enough on its own.
Step 5: Review as the practitioner, line by line
Treat the draft as unchecked. Compare every sentence with the original and your assessment. Ask whether anything was added, lost or softened. Check that strategies, triggers and responses are unchanged, that any restrictive-practice content is exactly as authorised, and that the tone respects the participant's dignity. The statement's list of risks includes "inaccurate or misleading content or advice", and this review is the control for it.
Step 6: Put the participant and their supporters back in the loop
The Commission's statement singles out content "not developed in consultation with the participant and/or their carers". After the draft is ready, go through the plan with them in the way that suits their communication needs. Ask whether it sounds right, what is missing and what they would change. Record the changes. If AI helped with an Easy Read version, test that version with the person it is for.
Step 7: Assemble the final plan in your own system
Re-insert identifiers only in your own record system, never in the AI tool. Use the Commission's current plan templates and checklists, which the statement points to as the place to get help. Date and sign the plan, and record that AI was used for wording, if it was.
Step 8: Keep the evidence
Store the final plan, the consultation record, the practitioner's sign-off, and a note of which tool was used for what. Keep the policy version in force on that date. If an auditor asks, you can show that de-identification was done, that a human decided the content, and that the participant was consulted. Building the NDIS audit evidence folder with AI covers the folder layout.
A filled-in record line, illustrative: "Comprehensive plan review, internal participant reference only. AI used: the approved business chat tool, for a plain-English rewrite of the carer summary. Input: a de-identified copy prepared by the practitioner and checked by a second practitioner before use. Result: 6 of 9 sentences accepted; one reverted because it merged two separate strategies. Plan signed by the practitioner on [date]; reviewed with the participant and their carer on [date]." One line like this per plan lets an auditor follow what happened without reading your prompts, and it shows the de-identification was checked by someone other than the person who did it.
A decision table for common AI jobs in behaviour support
| Job | Fits the statement? | Condition |
|---|---|---|
| Drafting strategies from a participant's history | No | Clinical judgement and personal information both involved |
| Summarising session recordings or notes | No, in most cases | Participant information would reach the tool |
| Plain-English or Easy Read rewrite of agreed text | Possible | De-identified, no added content, practitioner checks |
| Checking consistency and headings in a draft | Possible | De-identified working copy only |
| Training handouts for staff on general principles | Yes | No participant information at all |
| Policy and procedure drafts | Yes | Provider-level text; manager reviews |
| Rosters, invoices checks, admin emails | Yes | Normal data rules; not a plan task |
A small provider's first quarter, with numbers
Take an illustrative specialist behaviour support provider with three practitioners, each carrying about 14 participants. Each practitioner writes or reviews roughly four plans a month, and spends about 6 hours on each, so around 24 hours a month per person. The owner asks whether AI could cut that.
Following the workflow above, the owner finds that the only part of a plan the Commission's position leaves open is wording work on de-identified, already-agreed text. That is perhaps a tenth of the time: the plain-English carer summary and a formatting check, around 35 minutes of a six-hour plan. If AI halves those, the saving is under 20 minutes a plan, minus about 10 minutes to de-identify and 10 to re-check, so the net is close to zero. The owner concludes that plan wording is not where the money is.
The same provider then looks at its admin. Rostering emails, service agreements, policy updates, staff training handouts and invoice checks together take the practice manager about 30 hours a month. None of that involves participant information in the form a plan does. Even a modest saving of a fifth is six hours a month, and none of it touches the Commission's concerns. The provider writes the AI policy, trains the team over one lunch, and moves on to those jobs first. That is a realistic result: the statement narrows the plan-writing use, and the savings sit in the surrounding work. All figures here are illustrative.
Questions to ask a vendor who says their tool is fine for plans
Because the Commission endorses no tool, a vendor's claims are only claims. Put these questions in writing and keep the answers with your records.
- Where is data processed and stored, and in which countries?
- How long is input kept, and can we delete it on request?
- Is our input used to train or improve any model?
- Who at the vendor, or its suppliers, can see our inputs?
- Does the tool need any participant personal information to work? If yes, why?
- Can the tool run on de-identified text only, with no recording or file uploads?
- What does "NDIS compliant" mean in your materials, and who assessed it?
- What happens to our data if you are acquired or shut down?
Vague answers mean no. A vendor that cannot say where data goes cannot help you meet the "lack of transparency" risk the statement lists. And a tool that needs participant information to work, such as a recording or a file upload, runs straight into the expectation that no personal information is disclosed.
Briefing staff in one short session
Staff do not read policies; they remember examples. Run a 20-minute briefing with three exercises. Hand out a paragraph about an invented participant and ask the group to strike out every identifier, including indirect ones; most groups miss at least one. Show a plain-English rewrite with one changed strategy and ask who can spot it. Finally, ask what each person would do if they had already pasted something into a personal chatbot, and make the answer "tell the manager today, no blame". Record attendance, and repeat when staff join or the policy changes.
Where behaviour support providers get caught out
The scribe in the room. A practitioner records a family meeting with a transcription tool "just to save typing". The recording carries voices, names and the participant's story to a third party. This is the scenario the statement's first risk describes. Do not do it without first establishing that no personal information is disclosed and getting advice.
Overseas processing. Many tools process data on servers in other countries. The statement lists overseas processing or storage as a risk. If you cannot find where a tool processes data, treat that as an answer.
De-identification that is not. Names removed, but the story is unique. A small provider in a small area, with a participant with a rare combination of needs, may be recognisable from a paragraph. Ask a colleague who does not know the participant whether they could guess who it is. If they could, it is not de-identified.
Plausible rewrites that change the meaning. A tidy paragraph can quietly remove a safeguard. This is why the practitioner reads each strategy against the original and why the rewrite job is kept to text that is already agreed.
Support workers using their own accounts. A well-meaning worker pastes a shift note into a personal chatbot. Policy, a short briefing and an approved alternative are the only fixes that work. See how to write NDIS progress notes with an AI-assisted audit checklist for a related workflow, and note that the same privacy rule applies there.
Lower-risk places to start
If the plan-writing boundary seems tight, much of a provider's AI value sits elsewhere. Policies, service agreements, website text, rosters, invoice checks and staff training do not require participant information. An NDIS service agreement template drafted with AI shows how drafting work can be kept apart from personal data. For a ranked view of admin jobs, the NDIS providers automation assessment checklist helps you pick.
A new provider can build confidence on those jobs, write the AI policy, train the team, and only later decide whether the narrow wording uses in behaviour support plans are worth the review effort. For many, the honest answer is that the time saved on a plan is small compared with the care required, and the admin jobs are where the savings sit.
A short AI policy for a behaviour support team
AI and behaviour support plans: our rules
1. We follow the NDIS Commission's position statement (February 2026).
2. AI does not write, suggest or decide clinical content, strategies or
restrictive-practice information.
3. No participant personal information goes into any AI tool. Ever.
4. If AI is used for wording, it works on a de-identified copy only, for
text already agreed by the practitioner.
5. The practitioner reviews every line and signs the final plan.
6. The participant and supporters are consulted on the final plan.
7. We record which tool was used, for what, and who checked it.
8. Only approved tools are used. No personal accounts for work.
9. The policy is reviewed every six months and when the Commission updates
its guidance.Position statements get revised, so put a review date on your policy and check the Commission's site periodically. If you would like help turning this into a workflow for your own team, my AI implementation consultation can cover the policy, the de-identification routine and the choice of admin jobs to automate first.
Questions from behaviour support providers
Does the NDIS Commission ban AI in behaviour support plans?
No. The February 2026 position statement says the legislative framework does not explicitly prohibit AI, and that the Commission does not endorse or approve AI tools for developing or reviewing plans. Providers may use AI only if they meet their legal obligations, which in practice means de-identified inputs and human clinical judgement.
Can I use an AI scribe in a participant session?
The statement expects that no personal information of participants is disclosed to AI systems. A scribe that records and processes a session does exactly that, so it conflicts with the expectation unless you can show it does not disclose personal information. Take advice before using one in plan work.
What does de-identified actually mean here?
Remove names, dates of birth, addresses, NDIS numbers, provider names, family and staff names, and any detail that could point to one person. Distinctive events and locations count. If someone who knows the participant could recognise them, it is not de-identified.
Who is responsible if an AI-written section is wrong?
The provider and the behaviour support practitioner who writes the plan stay accountable under their existing obligations; nothing in the statement shifts that to a tool. It lists inaccurate content, and automated decision-making without human oversight or clinical judgement, as risks that may lead to breaches of provider obligations.
Further reads
- NDIS Incident Report Template: Can AI Draft It? What a Manager Checks — Another sensitive document where a manager checks the draft.
- NDIS Plan Manager Invoices: Checking Claims Against Budgets With AI — A low-risk admin job where AI checks numbers.
- AI for Speech Pathology in Australia: NDIS Reports and Scheduling — How another practitioner group uses AI around NDIS reports.
- How to Get Clients as an NDIS Provider: AI for Enquiries, Referrers — Enquiry and referrer work that needs no participant data.
- NDIS Software for Small Providers: Per-User Costs and What You Get — What provider software costs per user.
- NDIS Invoicing: Checking Claims Against Shift Notes With AI — Checking claims against shift notes, a safer AI job.
- NDIS Occupational Therapy Report Template: A First Draft With AI — A report template that keeps participant data out of drafting.
- AI for ABA Therapy Practices: Seven Admin Jobs and Three to Keep Human — Seven admin jobs an ABA practice can give to AI, three that stay with the BCBA, and the business associate agreement check before any client data moves.
- AI Tools and AI Development: The Complete 2026 Guide — the AI hub, including every tutorial in the AI-for-business series.
Sources: the NDIS Quality and Safeguards Commission position statement, Use of artificial intelligence in the development of behaviour support plans (February 2026, four pages), read in full from the Commission's PDF on 4 November 2026; the plan-writing steps are practice guidance, not Commission requirements.