Connecting a Decade of Failure: An AI-Powered Submission Revealing the Causes, Risks and Future Trajectory of the NDIS Crisis.
This is My Last Submission on the NDIS.
EDITORIAL NOTE: On 1 June 2026, I provided a submission to the Community Affairs Legislation Committee Inquiry into the National Disability Insurance Scheme Amendment (Securing the NDIS for Future Generations) Bill 2026.
Title: “Connecting a Decade of Failure: An AI-Powered Submission Revealing the Causes, Risks and Future Trajectory of the NDIS Crisis.”
PDF of the Submission can be found here. The submission is protected by Parliamentary Privilege.
This article, from 3 September published elsewhere, updates the data and reporting in that submission. Since 3 September 2026, there have been another six reported outages of NDIS systems. Due to the load of analysis from the escalating outages, that data is not included in this article. No other G20 country has national systems with this level of instability. Whilst this will be my last submission (for many reasons), my AI will continue to track the profoundly concerning NDIS systems outages.
As at 3 September 2026, the cumulative documented total since 2015 has now reached:
8,261 Hours 40 Minutes of Documented NDIS Systems Outages…and Counting
Or approximately: 344 days - more than 49 weeks - of cumulative system-hours outage.
So far for 2026, as at 3 September 2026, official NDIS outage notices document 2,628 hours 10 minutes of system-hours in 2026 alone. That is approximately 109½ days of cumulative system unavailability in just over eight months.
So, with almost four months of 2026 still remaining: 2026 is already the highest outage year in the current 12-year master series.
The significance is no longer simply the quantity of downtime. The evidence increasingly points to a tightly coupled national digital environment experiencing recurring operational interruption at the same time that cyber-security, recovery, authentication and disaster-resilience controls are themselves becoming visible areas of activity.
The 2026 evidence shows an escalating convergence of availability, resilience, cyber-security and accessibility risk. These evidence strands should not be collapsed into an unsupported claim of common causation. But their temporal and operational intersection is now sufficiently significant that they should no longer be examined in isolation.
➡️ July alone produced another exceptionally large multi-system shutdown
The 3–5 July event contributed 441 system-hours from a single published outage: 49 hours × 9 systems = 441 system-hours.
The systems included participant and provider portals, both myplace portals, the mobile app, Integrity Portal, Digital Partner Portal, NAPIC Gateway and API services. This matters because the risk is not simply that one interface periodically becomes unavailable.
The continuing pattern is simultaneous unavailability across multiple connected components of the NDIS digital environment.
➡️ August demonstrates that the pattern continued rather than resolving
The 8–9 August in-app notice alone added 379.5 system-hours. The outage covered 34.5 hours and listed eleven system lines across participant, provider, app, integrity, developer, registration,partner and gateway services.
A further 11-system outage followed on 15 August. This is significant longitudinally. By August, the outage footprint was continuing to extend beyond participant-facing portals into: Developer Portal, Registration Portal, Digital Partner Portal, NAPIC Gateway and Integrity Portal.
The outage problem therefore cannot reasonably be characterised simply as repeated maintenance of a participant website or app. The published notices themselves describe interruption across a wider interconnected digital architecture.
➡️ The cyber-security evidence introduces a new risk dimension
The August reporting of the TeamPCP supply-chain compromise materially changes the context in which the 2026 outage record should now be examined.
The NDIA confirmed that its environment was affected by the TeamPCP supply-chain campaign in March 2026. According to the NDIA, the activity was identified within hours and the Agency undertook “reset and recovery actions.”
The reporting identified NDIA GitLab infrastructure, CI runner data, code repositories, identities and various credentials within the compromised material. The NDIA stated that protected, sensitive and participant information was not accessed or compromised and that its security controls prevented exploitation of NDIA systems.
The outage dataset independently shows significant March activity, including:
7 March: 16 system-hours
13–16 March: 393 hours 10 minutes
16 March: 18 hours 40 minutes
The 13–16 March event alone involved seven systems across a 56-hour 10-minute outage window.
Temporal and operational intersection. This creates an important temporal and operational intersection. There was: a confirmed software supply-chain cyber-security event affecting NDIA development/ build infrastructure in March. At the same time that: March was a period of significant documented multi-system outage activity.
The currently available evidence does not establish that the TeamPCP incident caused any of those outages. The report about this cyber event, does not provide a sufficiently precise incident date or timestamp to establish direct overlap with an individual outage window.
Accordingly, the evidence supports investigation of the intersection, but not a causal assertion.
➡️ Cyber resilience and operational resilience can no longer be examined separately
The TeamPCP disclosure also broadens the risk question. The issue is no longer only: Why are NDIS systems repeatedly unavailable? It is also: How resilient is the environment during periods when systems, software-development infrastructure and security controls are simultaneously under operational pressure?
The TeamPCP reporting describes a software supply-chain compromise involving automated build environments and credentials. Hudson Rock’s material reportedly included 175 NDIA-related CI runner dumps, 18 repositories and various tokens and other secrets.
The correct inference is not that participant systems were breached. The NDIA expressly denies that. The systemic issue is that cyber-security, software delivery, recovery activity and service availability now occupy the same operational risk environment.
That warrants examination as one interconnected resilience problem.
➡️ The August backup and disaster-recovery procurement raises a further resilience question
A further contextual development is the August 2026 reporting that the NDIA had gone to market for a backup and disaster-recovery solution for PACE. PACE had already been operational for years.
The appropriate systems-governance question is:
Why was a dedicated backup and disaster-recovery solution for a core national case-management platform still being procured years after PACE entered operational use?
The timing becomes particularly important when viewed alongside:
record levels of cumulative system outage;
repeated broad multi-system shutdowns;
a confirmed software supply-chain cyber incident;
continuing reset/recovery and security activity; and
growing dependency on PACE and its surrounding digital ecosystem.
This is yet another temporal and operational intersection, that warrants examination.
➡️ Security remediation is also creating an accessibility risk
On 25 August 2026, the NDIS announced additional identity-security checks, including the use of a one-time code sent by mobile phone or email when people contact the Agency concerning personal or protected information.
The security objective is understandable. The systems-design issue is whether the control is accessible to the population that must use it. A one-time-code process can assume that a participant can receive, locate, read, understand, retain and communicate a temporary numerical code - sometimes while moving between devices or applications.
Those assumptions may create barriers for people with: physical impairments affecting device use, including for example, people with tremors; blindness or low vision; cognitive or intellectual disability; memory or processing difficulties; numerical literacy difficulties; or other access needs.
The systemic problem is significant: a security measure intended to protect a person’s information can reduce that person’s independence or privacy if they must rely upon another person to complete authentication.
The relevant governance question is therefore not whether stronger authentication is desirable. It is whether security controls were co-designed, accessibility-tested and supported by equivalent accessible alternatives before implementation.
➡️ The central risk pattern remains system coupling
The strongest finding from the 2026 notices remains the repeated appearance of the same connected services in the same outage windows. Participant portals, provider portals, legacy myplace services, the mobile app, partner services, gateways, APIs, developer services, registration services and integrity systems repeatedly appear together.
Previous analysis, including in Parliamentary submissions, identified system coupling as the central risk pattern. The additional June–September notices strengthen that finding.A resilient national system should seek to contain failure.
The published NDIS notices repeatedly demonstrate the opposite characteristic: large outage domains encompassing multiple functional layers at once. That increases the potential consequence of maintenance failure, deployment failure, security remediation, configuration error or other disruption because the affected surface is broad rather than isolated.
➡️ “Planned” does not mean operationally insignificant
Most of these events are described by the NDIA as planned system updates. Note that this analysis does not include unplanned outages, payment disruptions, and other variously described service impacts.
That “planned” classification should not obscure their operational impact.
A 49-hour outage affecting nine separate systems remains 441 system-hours of unavailable digital capability, regardless of whether it was scheduled in advance. Likewise, a 34.5-hour maintenance period involving 11 published system lines represents 379.5 system-hours.
“Planned” downtime often with little or no notice, does not eliminate: participant access loss; provider access loss; integration interruption; administrative workarounds; deferred transactions; operational backlog; or dependency risk.
The increasing reliance on lengthy, broad maintenance windows is therefore itself a resilience indicator.
AI Statement:
And for those who feel compelled to run this article through an AI-text detection tool, I say - go for it.
What you're reading draws on almost four decades of professional technology experience, direct insider knowledge, and the lived experience of family with disability. A rather unique perspective through which to make this commentary.
Yes, I've used AI to help shape and refine this article. Why wouldn't I? I've spent much of my professional life working with technology and AI to extend what's possible, and to shine a light on bureaucratic misfeasance.
But here's what your AI text detector won't find.
The decades of human endeavour. The lived experience. The intellectual curiosity. The imagination. The creativity. And the sheer determination to show how co-design can and must change the way in which people and systems interact.
You can't detect that with an algorithm.