Confidentiality
Protect participant information from inappropriate access, use or disclosure.
AI for NDIS providers
AI is not inherently safe. Your environment needs to be.
Your organisation holds sensitive participant information, confidential files and personal records. Using AI should not mean exposing that information to unnecessary risk.
Holiday provides a trusted environment where your organisation controls what AI can access, what information stays protected and how AI activity is governed.
Do not trust the AI. Trust the environment it operates in.
The trust problem
Sensitive information should not be exposed simply because someone wants to use AI.
NDIS providers hold medical records, behaviour support plans, incident reports, financial information and deeply personal details about participants and their lives.
The risk is not only what an AI says. It is what information the AI receives, who can use it and whether anyone can see what happened.
Protect information before it reaches AI. Do not depend on the AI to protect information it should never have received.
Which sensitive files remain protected?
What approved information can AI use?
Who is permitted to ask for that information?
Can your organisation see what AI accessed?
NDIS Practice Standards
Protecting participant information is already part of your responsibilities.
The NDIS Practice Standards establish expectations for how registered providers manage participant information. For AI adoption, three themes are especially important.
Introducing AI does not remove these responsibilities.
AI governance should strengthen your existing safeguards, not create exceptions to them.
Consent
Understand when consent is required and explain how personal information will be collected, used, retained and disclosed.
Accountability
Demonstrate how sensitive information is protected and how organisational safeguards are implemented.
From safeguard to control
How Holiday can support your existing safeguards.
Confidentiality
Keep selected sensitive information outside AI access
Consent
Apply your approved information use and access settings
Accountability
Record AI activity and provide evidence of safeguards
Consent, lawful processing, deidentification and professional judgement remain the provider's responsibility. Holiday's safeguards do not replace those responsibilities.
Read the NDIS Practice Standards
Holiday is not endorsed or approved by the NDIS Commission. Its controls may assist providers with managing relevant risks. Providers remain responsible for their own legal obligations and the applicable NDIS Practice Standards.
A trusted AI environment
Do not trust the AI. Trust the environment it operates in.
Holiday gives your organisation a dedicated AI environment with defined permissions, approved connections and safeguards that do not depend on the AI following an instruction.
Staff can use AI with authorised business information without automatically granting the AI unrestricted access across participant records and connected applications.
Your organisation decides what information can be made available, what remains protected and which people are permitted to use AI with approved information.
The rules are enforced by the environment, not by the AI model.
Example of protected information
What information can this AI use?
Approved information
- General team procedures
- Approved service information
- Non sensitive schedules
- Authorised operational records
Protected sensitive files
- Medical records
- Behaviour support plans
- Incident reports
- Financial information
Participant information
Keep sensitive information outside the AI's reach.
A staff member may have access to many participant files. That does not mean AI should automatically receive the same access.
Within supported and configured connections, Holiday can restrict selected records and fields before information is made available to AI.
This is different from giving sensitive information to an AI and then relying on a prompt that tells it not to disclose that information.
Protect sensitive information by controlling access before the AI receives it.
This is a conceptual example, not an actual participant record. Available restrictions depend on supported connections, configuration and organisational permissions. Holiday does not automatically protect all information regardless of configuration.
Responsible AI use
The NDIS Commission has identified specific risks when AI is used in behaviour support.
In February 2026, the NDIS Quality and Safeguards Commission issued a position statement about AI in behaviour support plans. It identifies privacy, disclosure, overseas processing, accuracy and human oversight risks.
For this behaviour support use, the Commission expects information to be appropriately deidentified and no participant personal information disclosed to AI systems.
This statement is specifically about behaviour support plans. It is not a blanket statement about every administrative use of AI by NDIS providers.
What your organisation should assess
- Is the intended use appropriate?
- Is participant information involved?
- Is consent or other legal authority required?
- Must information be deidentified or excluded?
- Must a qualified person review the outcome?
- Can the organisation demonstrate the controls followed?
A trusted AI environment can support safeguards, but it does not replace professional judgement or legal obligations.
Use AI inside the environment
Start with protected information and clear responsibility.
Once your organisation has decided what information AI may use, Holiday can provide staff access through Business Chat and assign defined administrative responsibilities to Digital Employees.
Business Chat
Ask questions within approved access.
Staff can work with approved connected information while remaining subject to the organisation's configured permissions.
Explore Business ChatDigital Employees
Give AI defined administrative responsibility.
Digital Employees operate within assigned responsibilities and permissions, with human review where required.
Explore Digital EmployeesAI governance
Know who used AI, what it accessed and what happened.
A written AI policy says what should happen. Governance records help show what actually happened.
Holiday gives managers visibility into activity inside its managed environment, including who requested the work, what information was accessed and what review or approval occurred.
Make AI governance something your organisation can demonstrate, not simply a policy document.
Visibility
See available records of how AI was used inside the Holiday environment.
Accountability
Connect activity to the person who requested it and the AI identity that performed the work.
Evidence of safeguards
Support internal reviews with evidence of configured permissions, recorded activity and available approval outcomes.
Activity Log
A traceable record of controlled AI activity across users, identities, systems and data sources.
Reporting
The work record, including instructions, outputs, review, approval, escalation and available outcome.
Questions and answers
Questions NDIS providers are asking about AI.
Can NDIS providers use AI with participant information?
Providers must consider their privacy, confidentiality, consent and other legal obligations before using AI with participant information. The OAIC recommends that organisations do not enter personal information, particularly sensitive information, into publicly available generative AI tools.
A trusted environment can reduce unnecessary exposure, but it does not automatically make every proposed use appropriate.
What information should staff avoid entering into public AI tools?
The OAIC recommends that organisations do not enter personal information, particularly sensitive information, into publicly available generative AI tools. For NDIS providers this can include medical records, behaviour support plans, incident reports, financial information and other confidential participant documents.
Can Holiday keep sensitive documents away from AI?
Within supported and configured connections, Holiday can restrict the records and fields made available to AI. What remains protected depends on the organisation's configuration, permissions and connected systems. Holiday does not automatically protect all data regardless of configuration.
Why is a trusted environment safer than relying on prompts?
A prompt asks an AI to follow an instruction. It does not remove information the AI has already received. A trusted environment can restrict sensitive information before it reaches the AI, subject to the organisation's supported connections and configuration.
Do we need participant consent to use AI?
Consent requirements depend on the information involved, the purpose of use or disclosure, the provider's legal obligations and the circumstances. Providers should assess each proposed use rather than assuming that existing system access constitutes participant consent.
Can NDIS providers use AI to develop behaviour support plans?
The NDIS Commission does not endorse or approve AI tools for developing or reviewing behaviour support plans. Its February 2026 statement expects information to be appropriately deidentified and no participant personal information disclosed to AI systems for those activities. Holiday's controls do not override this guidance.
Does using Holiday make us NDIS compliant?
No software product automatically makes an organisation compliant with the NDIS Practice Standards or privacy legislation. Holiday provides controls for AI access, permissions, governance and accountability that may help providers manage relevant risks.
Read the OAIC guidance on privacy and commercially available AI products.
Trusted AI for NDIS providers
Your participants trust your organisation. Give your AI an environment you can trust.
Give your organisation a trusted place to use AI while keeping sensitive information, permissions and accountability under your control.
Control. Chat. Operate.