Submission 2780
Submission to the Senate Community Affairs Legislation Committee:
Inquiry into the National Disability Insurance Scheme Amendment
(Securing the NDIS for Future Generations) Bill 2026
Dr Gabrielle Josling
I am not an NDIS participant, but I am an autistic person. The NDIS is one of the genuine achievements of Australian social policy and has been transformative for hundreds of thousands of people. It is worth defending.
My submission focuses specifically on Schedule 3, Part 2 of the Bill, and the power it would create to automate administrative action. My perspective is a practical one. I am a data scientist by profession, and in a personal capacity I also make freedom of information requests aimed at understanding how Commonwealth agencies describe and document the systems they use to make decisions. There is often a gap between how a system is described and how it is actually used.
The question raised by Schedule 3, Part 2, is whether the NDIA has in place the legal framework, governance, and independent oversight needed to use automated decision making (ADM) responsibly and fairly. On the evidence available to me, it does not.
The clearest example of this is the system the NDIA is now preparing to roll out. Under the NDIA’s New Framework Planning model, a participant’s support budget is generated in two steps: an assessment using a tool called I-CAN v6 produces a report on the participant’s needs, and the NDIA then uses that report to calculate a budget. Neither the delegate making the decision nor the Administrative Review Tribunal hearing an appeal has the power to alter the budget the system produces. Whether or not the NDIA accepts the characterisation, this is ADM: a computer program produces a binding administrative output that a human decision-maker cannot alter.
In response to a freedom of information request I made, the NDIA has stated that it holds no documents recording how it has classified I-CAN v6 for ADM purposes, how delegate discretion under New Framework Planning is bounded, how the decision-making workflow operates, what risks were identified, or how budget outcomes are to be explained to participants.
I will discuss below what that finding does and does not mean. The fact remains that Parliament is being asked to confer the power to automate decision-making on an agency that, on its own records, is not ready to govern it.
I therefore ask the Committee to recommend that Schedule 3, Part 2, be removed, and not reintroduced until the whole-of-government legislation for ADM that the Government committed to after Robodebt has been enacted.
What should have preceded this Bill The case for a whole-of-government legislative framework on ADM was not, until recently, controversial. The Government committed to it.
1
Submission 2780
After the Royal Commission into the Robodebt Scheme reported in 2023, the Government accepted Recommendation 17.2, which called for the Commonwealth to consider establishing a body, or expanding an existing body, with powers to monitor and audit ADM. The Government also accepted Recommendation 17.1 and committed to considering legislative reform to introduce a consistent legal framework for automation in Commonwealth government services. The Government also promised Privacy Act reforms that would provide individuals with a right to a meaningful explanation of automated decisions affecting them.
None of these commitments has resulted in legislation.
Schedule 3, Part 2, was intended to operate inside a framework that does not yet exist, and may never. The general framework was meant to come first, and the sector-specific applications were meant to be built on top of it. What is being proposed instead is to begin with the application, and to trust that the general framework will follow.
I do not think this is defensible, and I have not seen it defended.
The NDIA’s readiness to govern ADM The NDIA’s public position is that New Framework Planning is not automated. In February 2026, the agency published on its website that “NDIS plans will continue to be approved by trained NDIS staff, not automated systems.”1 But approval is not the same as decision making. In an internal briefing to several hundred NDIA staff in November 2025, reported by Guardian Australia, a director from the NDIA’s scheme reforms and transition branch confirmed that the budget New Framework Planning produces is not a recommendation, as the only decision the delegate makes is whether to accept the assessment or request a replacement.2 In the same briefing, the general manager of Queensland regional services relayed legal advice that the Administrative Review Tribunal would be able to order a new assessment but would no longer have the power to alter a participant’s budget directly.
In December 2025, I made a freedom of information request for the documents that would show how the agency had reached this position. The request was framed around I-CAN v6 and the planning model built around it: how the NDIA had classified the tool for ADM purposes, how delegate discretion under New Framework Planning was bounded, how the decision-making workflow operated, what risks had been identified, how budget outcomes were to be explained to participants, and what executive consideration had been given to the ADM implications of using the tool for budget generation.
Together, these categories would show how the NDIA has thought about the planning model’s impact on participants, where accountability for budget decisions will sit, and what consideration has been given to the fact that the model automates administrative decisions. They are the categories of documentation that would, on any reasonable view
1 NDIA, ‘Update on the new way of planning for the NDIS’, 9 February 2026, https://www.ndis.gov.au/news/11083-update-new-way-planning-ndis 2 Kate Lyons, ‘NDIS plans will be computer-generated with human involvement dramatically cut under sweeping overhaul’, Guardian Australia, 3 December 2025, https://www.theguardian.com/australia news/2025/dec/03/ndis-plans-computer-generated
2
Submission 2780
of governance, need to exist before a binding budget-generation system was used to make decisions about disabled people’s lives.
In May 2026, the NDIA refused access on the basis that the documents do not exist. A copy of the decision is attached to this submission. The decision letter states that reasonable searches were performed by the business areas most likely to hold such
documents (Integrity, Transformation and Technology Services; Legal, Reviews, Actuarial
and Data; Service Design and Improvement; and Service Delivery) but no documents were found.
By the NDIA’s own account, the agency holds no documentation that even contemplates New Framework Planning’s ADM dimensions. The possibility remains that documents exist within business areas the NDIA did not search. But the business areas it searched appear to be the right ones, and the ones you would expect to hold such documentation if it existed. So either the NDIA is correct and the documents do not exist, or its records and search capability failed on questions central to whether New Framework Planning is ADM. Either way, the public position the agency has taken is one that its own records cannot support.
The absence of these documents should not be read as a sign that the governance work is pending. ADM classification, risk identification, and explainability planning are not compliance artefacts that follow implementation. They should shape how a system is designed and whether it should be used at all. The agency has not failed to get around to the governance work; it has decided that work is not required. This is the same sequencing problem, at agency level, that I described above at the Commonwealth level: legislate now, govern later, with no mechanism to ensure that later arrives.
New Framework Planning will decide individualised support budgets that underpin participants’ daily lives. The existing system already gets decisions wrong often, with 73% of appeals to the Administrative Review Tribunal in the period from 14 October 2024 to 30 June 2025 resulting in a changed decision.3 Under New Framework Planning, the ART will no longer have the power to alter a participant’s budget on appeal. The errors the existing system makes are corrected, imperfectly, through tribunal review, but the errors the new system makes will not be corrected through that pathway. It is hard to see how they will be corrected at all.
Schedule 3, Part 2 would confer statutory authority for ADM on an agency so ill-equipped for that authority that it does not even recognise its own ADM. That should give Parliament pause.
The Bill’s design
I do not propose amendments to Schedule 3, Part 2. The problems I draw to the Committee’s attention are not drafting errors that could be corrected with better wording. These are structural features that, in the absence of the general framework, are doing the
3 Administrative Review Tribunal, ART Caseload Report for the period 14 October 2024 to 30 June 2025, https://www.art.gov.au/sites/default/files/2024-12/ART_Caseload_2024-25.pdf
3
Submission 2780
work that framework was meant to do. And they are being asked to do that work in the context of an agency that cannot even recognise ADM.
The first feature concerns how the Bill’s framework is triggered. Statutory authority for automation is conferred only when the CEO makes a formal arrangement under s 59B(1). No independent body determines whether one is required. Instead, the agency characterises the system itself, and a note to s 59B(1) confirms that statutory authorisation “would not generally be needed if a computer program is only being used to assist a decision-maker.” The Bill’s transparency, reporting, and oversight obligations all depend on a characterisation the agency has demonstrated it cannot reliably make, and one it has an incentive to make in its favour.
The second concerns parliamentary oversight. The Bill creates two kinds of ministerial instruments. Provisions can be added to the automation list under s 59C(2) by legislative instrument, which Parliament can vote to repeal. The standard operating procedures that determine how automation decides cases involving discretion, evaluative judgement, or states of mind are set under s 59D(6) by notifiable instrument. Parliament can vote on whether to automate a provision, but not on how it operates.
The third concerns the saving clauses. Sections 59E(3) and 59E(5) provide that non compliance with the CEO’s reasonable steps and notification obligations does not affect the validity of automated action. The explanatory memorandum justifies these on the basis that validity uncertainty across thousands of daily automated decisions would be disruptive, citing claims and payments processing as its example. That justification holds for high-volume claims processing, but the saving clauses will also apply to any provision added to the automation list under s 59C(2). This includes the New Framework Planning provisions the explanatory memorandum confirms will be added later. A saving clause justified by reference to routine payment processing will then also cover the automation of decisions of a wholly different character and consequence.
The fourth concerns the Bill’s corrective mechanism. Where automated action is not correct or preferable, s 59B(7) permits the CEO to take substituted action. But the power is discretionary, with no obligation to do so even where the CEO is satisfied the automated action was wrong. There is no independent trigger and no obligation to identify errors systematically. The annual reporting requirement under s 59E(7) requires the CEO to report on the “kinds” of substituted actions taken, but not the volume, frequency, or outcome. In the context of New Framework Planning, where the ART will no longer be able to alter a participant’s budget directly, the substituted action mechanism is what remains of the correction pathway. It is entirely discretionary, internally initiated, and reported only in aggregate.
I acknowledge the Bill is not without internal safeguards. The Minister must be satisfied it is appropriate before specifying an evaluative provision (s 59C(3)). The CEO cannot delegate any power in the automation Division (s 202(2A)) and must report annually on ADM in the Agency’s annual report (s 59E(7)). These provisions exist and I do not dismiss them, but they cannot do the work the wider framework was meant to do.
4
Submission 2780
The Minister described the approach in this Bill as “cautious, deliberate and legislated.” We can test this against what the Bill actually does. A framework whose obligations attach only when the agency itself characterises the system as automated is not cautious, particularly where the agency has shown it does not characterise reliably. A design that puts the operational rules of automation beyond parliamentary scrutiny is not deliberate about oversight. And legislated only describes the form of what is being done, not its adequacy.
What this Bill would establish The argument I have made so far is about this Bill and this agency, but the form of Schedule 3, Part 2 will not stay confined to either.
If enacted, this would be among the most significant sector-specific Commonwealth ADM provisions introduced since the Government accepted Robodebt Recommendations 17.1 and 17.2 to consider a whole-of-government legal framework and oversight mechanism for automated decision-making. There is a risk it will also become the established template for how subsequent sector-specific automation legislation is designed. The features I described will become the model: a framework triggered only when the agency characterises a system as automated, operational rules set by notifiable instrument, and saving clauses attached to the general framework. If Parliament accepts those features here, the post-Robodebt commitments become procedural. The Government will be able to say it has consulted, it has legislated, and that will be taken to be enough.
The more immediate concern is within the NDIS itself. The explanatory memorandum is explicit that the initial list of provisions that may be automated under s 59C(1) is conservative, and that New Framework Planning provisions have deliberately not been included. It acknowledges that “more work must be done on establishing the planning process” before decisions about automation can be made. This is a confirmation, in the Government’s own explanatory material, that the governance work has not been done. The provisions will be added later, by ministerial instrument under s 59C(2). The framework Parliament is being asked to consider is therefore not the framework that will do the work. The working framework is whatever the Minister adds to it after this Committee reports. Those additions will receive the scrutiny a single legislative instrument receives, not the scrutiny of a Bill before a committee.
Recommendation
For the reasons I have set out, I ask the Committee to recommend that Schedule 3, Part 2 be removed, and not reintroduced until the whole-of-government legislation on ADM that the Government committed to after Robodebt has been enacted.
The evidence available to this Committee demonstrates that the NDIA is not ready to exercise that power, and the framework that was meant to create that assurance has not been delivered.
5
Submission 2780
Our reference: FOI 25/26-1466 (LEXD 13088)
GPO Box 700
Canberra ACT 2601
1800 800 110
ndis.gov.au 15 May 2026
Gabrielle Josling
By email:
Dear Gabrielle Josling
Freedom of Information request — Notification of Decision
Thank you for your correspondence of 3 December 2025, in which you requested access to
documents held by the National Disability Insurance Agency (NDIA), under the Freedom of
Information Act 1982 (FOI Act).
The purpose of this letter is to provide you with a decision on your request.
Scope of your request
You have requested access to the following documents:
Timeframe:
1 January 2023 to present, or earlier if planning for the New Framework Planning
Model commenced prior to this date.
Documents requested:
- Classification of I-CAN v6 for automated decision-making (ADM) purposes Documents describing or summarising whether, and on what basis, the NDIA has
classified or assessed the use of I-CAN v6 for budget determination as automated
decision-making or non-automated decision-making. This includes any assessments,
reviews, or analysis conducted using the Digital Guide, Commonwealth Automated
Decision-Making guidance, internal ADM frameworks, or equivalent governance
tools.
- Governance papers on the role of human decision-makers Documents describing the respective roles, responsibilities, and decision-making
powers of assessors, planners, and delegates in the I-CAN-based planning model,
1
Submission 2780
including documents that outline any limits on delegate discretion, human-in-the-loop
requirements, or conditions under which I-CAN outputs must or must not be followed.
- Documents outlining decision-making pathways Documents describing or depicting the decision-making workflow or pathway for
generating budgets using I-CAN v6, including high-level process diagrams,
governance flowcharts, role definitions, or descriptions of how I-CAN outputs form
part of the final budget decision. (Explicitly excluding detailed operational business
rules.)
- Risk, governance, or legal issues identified Documents describing or summarising risks, limitations, or legal or administrative
issues identified in relation to:
- classifying I-CAN v6 as automated or non-automated decision-making
- the removal or limitation of delegate discretion
- the capacity for planners or delegates to consider additional evidence
- the implications for review rights under s 48 of the NDIS Act or AAT review This includes internal risk assessments, governance papers, and high-level legal risk
summaries, excluding documents subject to legal professional privilege.
- Documents relating to explainability, transparency, or reason-giving Documents describing how budgets generated using I-CAN v6 are intended to be
explained to participants, including documents addressing transparency, reason
giving obligations, or the capacity to provide meaningful explanations for budget
outcomes.
- Internal briefs or executive papers relating to ADM considerations Any briefs, decision papers, or executive summaries provided to senior NDIA executives that
discuss automated decision-making considerations, governance concerns, or
decision-making implications arising from the use of I-CAN v6 for budget generation.
Consultation and clarification of scope
On 16 December 2025, the NDIA contacted you to advise that some material relevant to
your request may be publicly available and provided links to those resources. As part of this
correspondence, the NDIA also sought your views on whether you wished to withdraw or
revise your request.
2
Submission 2780
On 17 December 2025, you responded, advising that you did not wish to withdraw your
request and raised concerns regarding the characterisation of the scope, including whether
the requested material was publicly available. You clarified that your request relates to NDIA
governance decisions, including automated decision-making classification, delegate
discretion, and transparency obligations, and noted that if such documents do not exist, you
would wish this to be formally confirmed.
Processing Timeframes
The FOI Act provides 30 calendar days for the processing of an FOI request after it is
received. As your valid FOI request was received on 3 December 2025, the original due date
for a decision was 5 January 2026. This timeframe included the Christmas and New Year
period, which contained several public holidays and reduced staffing across the Agency.
On 17 December 2025, you agreed to a 30-day extension of time under section 15AA of the
FOI Act. This extended the due date for a decision to 1 February 2026. I apologise that a
decision was not provided within this extended timeframe.
As a decision was not made by the legislated due date, the NDIA is taken to have refused
your request under section 15AC of the FOI Act. Notwithstanding this, I have continued to
process your request.
I note that you have applied to the Office of the Australian Information Commissioner (OAIC)
for review of the deemed refusal of your request. While I have continued to process your
request following notification of the review, this decision is not made as a revised decision
under section 55G of the FOI Act, as no change has been made to the outcome of the
request.
Decision on access to documents
I am authorised to make decisions under section 23 the FOI Act. My decision on your
request and the reasons for my decision are set out below.
I have decided to refuse your request for access under section 24A of the FOI Act on the
basis that all reasonable steps have been taken to locate the documents you have
requested and I am satisfied that they do not exist.
3
Submission 2780
In reaching my decision, I took into account:
your correspondence outlining the particulars of your request; the FOI Act; the FOI Guidelines; relevant case law and decisions concerning the operation of the FOI Act; and consultation with relevant officers of the NDIA.
Reasons for decisions
Refuse a request for access (section 24A)
Section 24A of the FOI Act provides that an agency may refuse a request for access to a
document if all reasonable steps have been taken to find the document and the agency is
satisfied that the document cannot be found or does not exist.
Paragraph 3.152 of the FOI Guidelines provides that searches should be conducted by the
officers most likely to be able to find requested documents. Accordingly, based on the scope
of your request, I identified a need to consult with the following business areas:
Integrity Transformation and Technology Services
Legal, Reviews, Actuarial and Data
Service Design and Improvement Service Delivery.
These consultations involved relevant NDIA staff who could reasonably be expected to
identify documents within the scope of the request, including staff knowledgeable in the
relevant subject matter and in conducting searches of NDIA systems.
Searches were undertaken of internal systems, including independent checks by staff within
the relevant business areas. Advice from these business areas confirms that there are no
documents held by the NDIA that outline the classification, governance and decision-making
arrangements using the I-CAN v6 assessment tool, and no documents within scope of your
request, including draft materials, were identified for the relevant timeframe.
I am satisfied that all reasonable steps have been taken to locate the documents you have
requested and that the documents cannot be found or do not exist. I have, therefore,
4
Submission 2780
decided to refuse access to your request in accordance with section 24A(1)(b)(ii) of the FOI
Act.
Rights of review
I note that you have applied to the Office of the Australian Information Commissioner (OAIC)
for review of this matter. A copy of this decision will be provided to the OAIC for the
purposes of that review.
If you are satisfied with this decision and do not wish to pursue the review further, you may
advise both the NDIA and the OAIC accordingly.
Please contact us at foi@ndis.gov.au if you have any questions or require help.
Yours sincerely
Carolyn (CJW205)
Assistant Director – Information Access
Information Access and Privacy and Branch
Reviews and Information Release Division
5