What’s moving across your sector.

The legislation question is settled, and the timetable is now the planning tool. The 1 October funding resets reach participant budgets first, which moves volume and revenue for community participation and daily living skills providers within weeks. Registration runs on a longer clock. Once the higher risk support list is published, map your services against it and settle your registration position on your own numbers before the 2027 rollout begins.

CPS 230 is board accountability dressed as an operational standard. The exposure most boards miss is concentration, a single cloud or software dependency that would breach your own disruption tolerance if it failed. The register is the straightforward part. The test is whether the board can name its critical operations and the providers capable of taking them down.

The trap is reading transition to 2029 as breathing room. Ongoing due diligence and the new program structure already bite, and only parts of initial due diligence are deferred. The practical work is to confirm which clock applies to which obligation, then document your program and compliance officer arrangements to the new standard.

The disclosure is the visible part. The work that takes time is the mapping behind it, because you cannot describe what you have not found, and automated decisions hide inside eligibility screening, prioritisation and risk scoring. Starting that system map now is what makes December a routine update, and it is the same map every other AI obligation will ask you for.

Round 3 is capital that flows to whoever is ready to deliver, and an open process rewards the prepared over the fast. Being ready means a pipeline, a delivery partner and a financing position that stand up to scrutiny. The question that decides it is whether you have the capability and the balance sheet to take this up, and if not, which partnership closes that gap before 2029.

Moving super from quarterly to every pay run pulls a recurring outflow forward, and for a thin-margin provider the timing shift is the part to stress-test. With the first quarter of pay runs complete, check how many contributions landed inside 7 business days and fix the cause of any that missed. The administrative uplift is reduced when you lodge a voluntary disclosure, so finding a late payment yourself costs less than waiting for the ATO to find it.

Wages are the cost base, and they rarely move in step with the funding meant to cover them. The 4.75 per cent increase is now in your payroll, and the question for the quarter ahead is whether the indexation and price updates on each funding line arrive in time to cover it. Model the increase against your funding lines now, so any gap shows up in your forecast before it shows up in your accounts.

The 1 December increase lands on NDIS home care work with no funding commitment behind it, so providers of those supports need to cost it against current prices and client agreements this quarter. The 2027 structure reaches every SCHADS employee, and mapping each role to a new classification sets the wage bill. Start that mapping now and cost it against each funding line, so any gap reaches funders before the new rates reach payroll.

The duties now attach to named individuals, no longer the organisation in the abstract, so the board’s question moves from whether you are compliant on paper to whether each responsible person can evidence what they actually did. Most providers built for the start date and then stopped. The exposure now sits in the assurance layer underneath.

The exemption you have relied on for years is now something you actively confirm on a schedule, and a missed return is the kind of administrative lapse that can quietly put your tax status in question. Treat it as a recurring governance item with a named owner and a date in the calendar.

No AI Act does not mean no obligation. Privacy, consumer and anti-discrimination law and directors’ duties all already apply to how you use AI, and the voluntary guidance is the yardstick a regulator or a funder will reach for when something goes wrong. Adopting the Guidance as your baseline now is cheaper than being measured against it after an incident.

The only real question is whether the plan exists before the day it has to work. A reporting duty on a 72-hour clock tests governance and response readiness, and the time to confirm who decides, who reports and how is well ahead of the incident.