Aged care compliance in 2026: What the regulator expects to see

The Aged Care Act 2024 now requires registered providers to have working systems for complaints, feedback and whistleblower disclosures. Providers need to show that concerns can be raised safely, assessed consistently and acted on. A policy sitting on a shared drive will not demonstrate that.

Veremark recently joined Inside Ageing for a webinar about what these obligations mean in practice.

The session was presented by David Morgan, Managing Director of Whistleblower Technology Solutions at Veremark. David has more than 20 years of experience handling whistleblower matters, conducting workplace investigations and designing reporting programmes.

His main point was straightforward: a speak-up programme should be treated as part of an organisation’s governance arrangements.

Which Aged Care Act applies?

The correct name is the Aged Care Act 2024.

Although the Act commenced on 1 November 2025, it retained the year in which it was enacted. It works alongside the Aged Care Rules 2025, which provide further detail about how parts of the framework operate.

Under the Act, registered providers must implement and maintain a complaints and feedback management system. They must also implement and maintain a whistleblower system, maintain a whistleblower policy and manage disclosures that qualify for legal protection.

The legislation also strengthened protections against retaliation for people who report suspected breaches of aged care law.

Our report on whistleblowing in the new aged care framework explains these obligations in more detail.

Watch the webinar

The full webinar examines how providers can review their current arrangements and gather better information when concerns are raised.

It also explains how a trusted speak-up programme can help an organisation identify care, culture and governance issues earlier.

A policy is only the starting point

The practical question is what happens when someone raises a concern.

Can an older person or family member find the right channel? Can a worker report a suspected breach confidentially or anonymously? Does the person receiving the report know how to assess it? Is there a clear record of the response?

These are the details that show whether a system is working.

A written policy has limited value when staff cannot find it, managers interpret it differently or reports remain scattered across inboxes and spreadsheets.

Providers also need to consider how complaints, employee grievances, care incidents and whistleblower disclosures relate to one another.

Each may require a different process. They can still reveal a common issue.

A series of service complaints, combined with staff turnover or repeated incidents at one location, may point to a management problem. That pattern is hard to see when HR, quality, compliance and operational teams hold separate records.

Boards need enough visibility to identify recurring issues and question whether concerns are being resolved. Our article on how aged care boards can use whistleblowing data for good governance looks at this responsibility in more detail.

What happens when people lose trust?

The webinar included an anonymised case study involving a growing aged care provider.

According to David’s account, the provider’s governance arrangements had failed to keep pace with its expansion. HR and quality teams used separate spreadsheets. Individual sites followed inconsistent processes, and the complaints system was difficult to use.

Information about resident complaints, employee concerns and incidents was rarely considered together.

Leadership behaviour made the situation worse. Concerns were dismissed, some employees stopped sharing information and others left the organisation.

Internal reporting declined, although the underlying problems continued.

People then began raising concerns externally. Reports reached the regulator, politicians and the media. The provider later faced regulatory intervention, leadership departures and extensive remediation work.

The case illustrates an important point. Low reporting figures do not always indicate a healthy organisation. They can also show that people no longer believe reporting will lead to a fair response.

What should providers review?

Reporting channels should be visible, accessible and suitable for the people expected to use them. Providers should also have a clear process for protecting confidentiality and responding to anonymous disclosures.

Reports need to be assessed consistently, recorded properly and escalated when necessary. Where appropriate, the person who raised the matter should receive updates.

Managers need training because the first response to a concern can determine whether the reporter remains engaged.

Relevant teams should also share information. HR, quality, compliance and safety functions may have separate responsibilities, but senior management and the board still need a reliable view of recurring risks.

For a practical review of your current arrangements, download our 10-step whistleblowing compliance checklist for aged care providers. It covers reporting channels, policy, training, assessment, escalation and the evidence providers should retain to show that their system works.