How AI Can Transform NDIS Compliance Forever | Podcast

In this episode of the Steadway NDIS Podcast, Chris Hall sits down with Max King, Founder and Executive Chairman of Oscar Support and founder of the compliance platform Cortado, to explore the future of compliance, governance, and technology in the disability sector.

Drawing on more than a decade of experience in support coordination and NDIS operations, Max shares his insights into how providers can move beyond viewing compliance as a burden and instead use technology, automation, and artificial intelligence to improve quality, reduce risk, and strengthen organisational performance.

The conversation covers governance, risk management, audit readiness, data-driven decision-making, AI-assisted workflows, and the role emerging technologies can play in supporting both frontline staff and business leaders. Chris and Max also discuss how providers can build a culture of continuous improvement while maintaining a strong focus on participant outcomes.

Whether you're a disability provider, support coordinator, business owner, or leader looking to future-proof your organisation, this episode offers practical insights into the evolving relationship between compliance, innovation, and quality service delivery.

Read the full transcript below.

[00:12] Chris Hall:
Welcome to the Steadway NDIS Podcast. My name is Chris Hall, your host, and today I've got a friend from the industry, Max King, on the line. 

To introduce Max, he is the Founder and Executive Chairman of Oscar Support, a national support coordination business. After 11 years of support coordination, and previously operating in plan management, Max has now founded a new entity called Cortado. 

Cortado is a compliance-based platform designed specifically for NDIS providers and organisations operating in aged care. 

Max and I regularly catch up and talk strategy, technology, innovation, and systems. Today we're going to discuss how platforms, automation, and AI can help providers build a more effective relationship with the dreaded subjects of compliance and audits. 

So Max, welcome to the podcast. It's great to have you on. 

[01:04] Max King:
Thank you, Chris. That's a wonderful introduction. 

As you say, we're always keen to catch up, have engaging conversations, and go off on various different tangents. So it's great to be here. 

[01:15] Chris Hall:
Likewise, mate. 

I'm sure we'll learn more about Cortado throughout this conversation, but I'd like to start at first principles and look at the sector more broadly. 

When we think about compliance, audits, and governance, my first-principles question is: what actually is compliance? 

The way I think about it, compliance seems to be a combination of documentation, human behaviour, and evidence that you're implementing your policies, procedures, risk registers, and everything else. 

How do you define compliance at its most fundamental level? 

[02:01] Max King:
That's a great question. 

To answer it properly, I think it's important to take a step back and look at the broader context of Governance, Risk, and Compliance — often referred to as GRC. 

Governance is about the decisions a company makes, how those decisions are implemented, and the framework that guides them. 

Risk relates to the risks associated with service delivery and the various stakeholders involved in an organisation. Whether you're providing direct supports, like Steadway does, or support coordination, like we do, we're constantly evaluating risks affecting clients, staff, providers, and the wider community. 

Compliance sits alongside those two pillars. It's about the framework established by regulators and governing bodies, such as the NDIS Quality and Safeguards Commission or the Aged Care Quality and Safety Commission. 

Compliance is really the mechanism through which organisations demonstrate adherence to those standards and expectations. 

[03:40] Chris Hall:
No, that's interesting. 

The reality is there are tens of thousands of providers in the industry. Some are registered, some aren't. Some are start-ups, some are established, and some are very large organisations. 

I'd generally consider providers in the $3–5 million revenue range as becoming established. Once you get into the $10–20 million-plus range, you're dealing with mature organisations, and then of course there are the very large players. 

When I hear the word "governance," I often think about boards of directors and larger organisations. But I'd also argue that technology gives smaller providers the opportunity to think in a governance-focused way from the very beginning. 

You don't need to wait until you're large to implement good governance. 

[04:53] Max King:
Exactly. 

The distinction is that larger organisations often have dedicated people responsible for governance, risk, and compliance. 

In smaller organisations, founders, directors, and managers wear multiple hats. But that doesn't mean governance should be ignored. 

Governance is still critically important, even for smaller providers. It needs to become part of the organisation's language and culture. 

That might mean discussing governance quarterly, annually, or at management meetings. It doesn't need to be a daily conversation, but it should be present. 

Risk management, on the other hand, is part of everyday operations because we're constantly interacting with participants, families, staff, and other stakeholders. 

As organisations grow, governance becomes more formalised. But even at the early stages, it's important that concepts like governance, risk, compliance, codes of conduct, policies, procedures, training manuals, and work instructions become embedded within the business. 

As those ideas permeate throughout the organisation, they create the framework that providers need to operate successfully. 

Over time, that framework shapes behaviour and creates evidence. 

And evidence is really the key point. 

A lot of providers are doing fantastic work. Their teams are delivering outstanding outcomes every day. But when an auditor arrives six months later, the challenge becomes proving that work occurred. 

That's where many providers get caught out. 

The care was delivered. The outcomes were achieved. The team did everything correctly. But the evidence isn't there. 

The documentation isn't complete, or the audit trail isn't sufficient. 

Technology can help bridge that gap by amplifying what people are already doing and helping providers capture evidence of the great work that's taking place. 

[08:38] Chris Hall:
That's a really important distinction. 

There are multiple dimensions to compliance. 

You need a dashboard-level view that shows where the organisation sits overall. That's one layer. 

Then there's the idea of compliance permeating throughout the business. Not everyone needs to understand the entire framework, but people need to understand their role within it. 

For example, at Steadway we have a wonderful Service Coordinator who manages our training systems. She completely understands the importance of maintaining training registers and keeping records up to date. 

That's a perfect example of compliance being embedded throughout the business. 

And then, as you said, there is already good work happening every day. 

That's where technology becomes really exciting because so much evidence already exists. 

It's in our calendars. It's in our meetings. It's in our phone calls. It's in our shift notes. 

The opportunity is finding better ways to capture and organise that evidence so that when an auditor asks for it, it's already there. 

[09:43] Max King:
Absolutely. 

We're already seeing examples of this. 

Voice-recorded shift notes are a great example. A support worker can verbally record their notes after a long shift rather than manually typing everything out. 

But the benefits go beyond efficiency. 

Technology can capture location data, contextual information, and prompt staff to provide additional details. 

It creates a dialogue between the worker and the system. 

Now take that concept and apply it to incidents. 

Incidents often happen when people are under pressure. There's stress, urgency, emergency services may be involved, and staff are focused on participant safety rather than documentation. 

In those situations, technology can guide workers through the process. 

It can prompt them to capture photos, record key information, document observations, and ensure critical details aren't missed. 

The worker remains focused on the participant, while the technology supports evidence collection and compliance requirements. 

Then the information can be escalated to managers and reviewed later. 

Everything is documented, tracked, and auditable. 

If an auditor arrives six or twelve months later, the organisation can clearly demonstrate what happened, how it was managed, and how it aligned with policy and procedure. 

That creates a far better environment for frontline workers, because they're not left trying to remember details months after the fact. 

[12:43] Chris Hall:
I love that. 

People throw around the term AI all the time, but not everything has to be AI. 

Some solutions are automation-based. Some are workflow-based. Some are simply good technology design. 

At the end of the day, certain processes need to be repeatable and consistent. 

From a systems perspective, everything you've described is possible. 

And here's the way I think about it: 

We should never rely on human perfection. 

Human beings are fallible. Everyone forgets things. 

Technology should support people so that critical steps aren't missed. 

You shouldn't be able to move to the next stage of a process without completing the required actions first. 

That's really the opportunity. 

[13:33] Max King:
Exactly. 

And that's only one side of it. 

The other really exciting area is data analysis and pattern recognition. 

For example, imagine a participant who becomes distressed around dogs. 

Over time, support workers might notice that pattern, but the information never gets formally connected. 

Or perhaps a participant experiences severe hay fever during certain seasons, which affects their wellbeing when attending outdoor activities. 

These patterns exist within the data, but human beings simply don't have the capacity to connect every piece of information across years of interactions. 

Technology can. 

It can identify trends, recognise patterns, and surface insights that would otherwise remain hidden. 

And importantly, it's not just about identifying problems. 

It can also identify positive outcomes. 

Maybe a support worker consistently achieves great engagement outcomes by taking participants bowling. 

Maybe a particular activity repeatedly improves participant wellbeing. 

Technology can help identify those positive trends and encourage more of them. 

That's where things start becoming truly powerful. 

[15:10] Chris Hall:
That's fascinating. 

The human brain is amazing, but even the best support coordinator managing forty or fifty participants can't remember every detail about every interaction across many years. 

What you're describing is a system that augments human capability. 

Rather than replacing people, it gives them a bigger brain. 

It helps them understand the nuances and details that already exist but are difficult to process manually. 

[15:47] Max King:
Exactly. 

And that's really our vision. 

We're currently exploring ways to create administrative assistants that support support coordinators. 

We have years of emails, case notes, CRM records, Teams conversations, documents, and organisational knowledge. 

Technology now allows us to ingest that information and create assistants that help coordinators make better decisions. 

Combined with the Cortado platform, it creates a much more holistic approach to delivering quality support coordination. 

[17:21] Chris Hall:
One thing I find fascinating is the difference between collecting data and actually using it. 

Most providers already have enormous amounts of information sitting in various systems. They have CRM records, case notes, shift notes, incident reports, emails, meeting minutes, audits, and training records. 

The challenge isn't necessarily gathering more data. It's understanding what the data is telling us. 

Do you think that's one of the biggest opportunities we have as a sector? 

[17:56] Max King:
Absolutely. 

For years, organisations have been accumulating data. The issue has never been a lack of information. 

The issue has been accessibility and interpretation. 

If someone wanted to understand a trend five years ago, they might have had to manually search through hundreds or thousands of records. 

Now technology allows us to interrogate that information almost instantly. 

That's where things become really exciting. 

Because suddenly you're not just storing information—you can actually learn from it. 

And that learning can happen at multiple levels. 

It can happen at the participant level, helping improve individual outcomes. 

It can happen at the team level, helping managers identify training opportunities. 

And it can happen at the organisational level, helping leadership make strategic decisions. 

[19:03] Chris Hall:
I think that's a really important distinction. 

One of the conversations I often have with providers is that compliance shouldn't be viewed as something separate from operations. 

The organisations that do compliance best are usually the organisations that are operationally strong. 

They're documenting things properly because they're running good systems. 

They're collecting evidence because they've embedded quality practices into their day-to-day work. 

In a sense, compliance becomes a by-product of operational excellence. 

[19:43] Max King:
I completely agree. 

Compliance often gets viewed as a burden. 

People think of it as paperwork, audits, and administrative overhead. 

But if you reframe compliance as quality assurance, it starts looking very different. 

What you're really doing is demonstrating that you're delivering safe, high-quality services. 

The documentation isn't the objective. 

The objective is quality. 

The documentation simply proves that quality exists. 

When providers start viewing compliance through that lens, it changes the conversation. 

[20:28] Chris Hall:
Exactly. 

And I think that's where technology can help shift perceptions. 

If we can reduce the administrative burden associated with compliance, then people can spend more time focusing on participants and outcomes. 

Nobody gets into disability services because they love paperwork. 

People get into disability services because they want to help people. 

[20:52] Max King:
That's right. 

The goal should never be to create more administration. 

The goal should be to create better systems. 

If a support worker is spending excessive time documenting information manually, that's time they're not spending supporting participants. 

Technology should reduce that burden while improving data quality. 

That's the sweet spot. 

[21:23] Chris Hall:
Let's talk about audits for a moment. 

The word "audit" tends to create anxiety for providers. 

People immediately imagine someone arriving with a clipboard looking for faults. 

What's your perspective on audits? 

[21:40] Max King:
I think audits are often misunderstood. 

A good audit isn't about catching people out. 

A good audit is about validating systems and identifying opportunities for improvement. 

The reality is that every organisation has gaps. 

No organisation is perfect. 

Audits provide an opportunity to identify those gaps and strengthen the organisation. 

The providers that perform best during audits are often the providers that view audits as learning opportunities rather than adversarial processes. 

[22:35] Chris Hall:
That's a great point. 

One thing I learned years ago is that auditors generally want to see evidence of continuous improvement. 

They don't expect perfection. 

What they want to see is that when an issue arises, it's identified, documented, addressed, and reviewed. 

That's often more important than pretending problems never occur. 

[22:59] Max King:
Exactly. 

The presence of an incident isn't necessarily a problem. 

Incidents happen. 

What's important is how the organisation responds. 

Did they investigate it? 

Did they learn from it? 

Did they implement corrective actions? 

Did they review whether those actions were effective? 

That's the continuous improvement cycle. 

And technology can support that process enormously. 

[23:49] Chris Hall:
One thing that excites me about AI is its ability to identify trends across large datasets. 

Let's say an organisation has 500 incident reports. 

A human being can review those reports, but it's difficult to identify every pattern. 

AI can potentially identify recurring themes that may otherwise go unnoticed. 

[24:16] Max King:
Absolutely. 

Pattern recognition is one of the most powerful applications. 

Imagine an organisation experiencing a small increase in medication-related incidents. 

Individually, those incidents may not seem significant. 

But collectively they may indicate a training issue, a process issue, or a systems issue. 

Technology can surface those trends much earlier than traditional reporting methods. 

That allows organisations to intervene proactively rather than reactively. 

[25:12] Chris Hall:
That's really where things become interesting. 

Instead of looking backwards, you're looking forwards. 

You're identifying risks before they become major problems. 

[25:24] Max King:
Exactly. 

Historically, compliance has been retrospective. 

Something happened, and then we documented it. 

Technology allows us to become much more predictive. 

We can identify emerging risks, monitor trends, and make decisions based on leading indicators rather than lagging indicators. 

That's a significant shift. 

[26:04] Chris Hall:
One thing I often say is that every organisation already has the answers to many of its challenges. 

The answers are usually hidden somewhere within their own data. 

The challenge is extracting those insights. 

[26:19] Max King:
I couldn't agree more. 

Organisations are sitting on years of knowledge. 

Every participant interaction, every case note, every incident, every meeting, every training session—it's all information. 

The challenge is transforming information into intelligence. 

That's where I think the next evolution of technology in our sector will occur. 

[27:03] Chris Hall:
Let's talk about provider adoption. 

Whenever new technology emerges, there are early adopters and there are people who are hesitant. 

What are you seeing in the sector? 

[27:18] Max King:
It's a mixed picture. 

There are some providers moving very quickly. 

They're experimenting, learning, and investing heavily in technology. 

Then there are providers who are understandably cautious. 

Many people have heard grand promises before. 

They've purchased systems that failed to deliver. 

So there's naturally some scepticism. 

I think the key is focusing on practical outcomes rather than hype. 

Technology should solve real problems. 

If it doesn't solve a real problem, it doesn't matter how impressive it sounds. 

[28:12] Chris Hall:
That's a really important point. 

Sometimes technology gets discussed as though it's the objective. 

It's not. 

The objective is better participant outcomes, stronger organisations, improved compliance, reduced risk, and better experiences for staff. 

Technology is simply a tool that helps us achieve those outcomes. 

[28:37] Max King:
Exactly. 

Technology should always serve people. 

Not the other way around. 

When organisations keep that principle front of mind, they tend to make much better decisions about technology adoption. 

[29:36] Chris Hall:  

Compliance still requires discipline, but the innovation is in bringing all of these fragmented systems together. 

Providers often have what I'd call a "Frankenstein" technology stack. One system handles rostering, another handles case notes, another manages training, another manages incidents, and so on. 

Being able to bring all of that information together into a single dashboard is incredibly powerful. 

[30:40] Max King: That's precisely the point. 

One of the biggest frustrations for business owners is when software vendors tell them they need to change all of their business processes. 

Changing systems is disruptive. We've changed CRM systems. We've changed rostering platforms. Those decisions aren't made lightly. 

Our goal with Cortado is to remain agnostic to the existing technology stack. We don't want providers changing how they operate. 

We simply sit above existing systems, ingest the data and provide meaningful reporting. 

That sounds simple, but technically it's quite challenging because different systems have different APIs and data structures. 

The benefit is that providers can continue operating exactly as they do today while gaining visibility across the organisation. 

That's where modern AI and data processing capabilities become so valuable. 

For the first time, it's practical to ingest large volumes of data from multiple systems and turn it into useful insights. 

[32:19] Chris Hall: And that's where things become really interesting. 

Connecting Microsoft 365 or Google Workspace is one thing, but when you start integrating rostering systems, learning management systems, compliance systems and operational data, you begin to create a truly comprehensive picture of organisational performance. 

A lot of rostering platforms offer some compliance functionality, but that's usually limited to basics like first aid certificates, worker screening checks and mandatory credentials. 

That's important, but it's only a small part of what compliance actually is. 

The broader compliance landscape includes policies, procedures, complaints management, incident management, governance frameworks, training registers and much more. 

[33:33] Max King: I completely agree. 

Checking whether someone's first aid certificate is current is useful, but that's only the starting point. 

The real opportunity lies in understanding the broader picture. 

For example, if a participant requires support from staff with particular competencies, can we verify that the people rostered into that environment actually have those skills? 

Can we identify training gaps before they become risks? 

Can we ensure teams have the right mix of experience and qualifications for the participants they're supporting? 

Those are much more sophisticated questions. 

And that's where AI, automation and intelligent systems can genuinely improve outcomes while also reducing organisational risk. 

[34:42] Chris Hall:
One thing that comes to mind is that compliance often gets viewed as a cost centre. 

Providers look at audits, policies, consultants, governance frameworks, and compliance software and think, "This is all costing money." 

But I think there's another perspective, which is that strong compliance actually protects the business. 

It protects participants, protects staff, protects directors, and ultimately protects the sustainability of the organisation. 

Do you think that's a mindset shift providers need to make? 

[35:15] Max King:
Absolutely. 

I think compliance is often viewed as something that has to be done rather than something that creates value. 

The reality is that poor compliance is incredibly expensive. 

When incidents occur, when complaints aren't handled appropriately, when documentation is missing, when governance structures fail—those situations create significant financial and operational consequences. 

Strong compliance reduces risk. 

Strong compliance improves quality. 

Strong compliance builds trust. 

And trust is one of the most valuable assets any provider can have. 

Participants trust providers. 

Families trust providers. 

Staff trust providers. 

Regulators trust providers. 

The stronger those relationships become, the stronger the organisation becomes. 

[36:21] Chris Hall:
It's almost like preventative maintenance. 

People don't complain about servicing their car because they understand the cost of not servicing it. 

But sometimes compliance gets treated differently. 

[36:33] Max King:
That's a great analogy. 

Nobody enjoys paying for preventative maintenance, but everyone understands the cost of catastrophic failure. 

Compliance is similar. 

The challenge is that the benefits of compliance aren't always immediately visible. 

The benefit is often that nothing goes wrong. 

And that's harder to measure. 

But when things do go wrong, suddenly the value of good systems becomes very obvious. 

[37:15] Chris Hall:
Let's talk about directors and business owners for a moment. 

Because one thing I've noticed is that many founders are incredibly passionate about participant outcomes but aren't necessarily experts in governance, compliance, or risk management. 

That's understandable. Most people didn't start a disability business because they love governance frameworks. 

What advice would you give to provider owners? 

[37:48] Max King:
My first piece of advice is to stop viewing compliance as a separate function. 

Compliance should be integrated into how the organisation operates. 

My second piece of advice is to seek help. 

No one expects business owners to know everything. 

Good providers surround themselves with people who bring different expertise. 

That might be compliance consultants, auditors, governance advisors, lawyers, accountants, technology specialists, or experienced managers. 

You don't have to do everything yourself. 

The third thing I'd say is that governance starts with curiosity. 

Ask questions. 

Understand your risks. 

Understand your obligations. 

Understand how your organisation operates. 

You don't need to become an expert overnight, but you do need to engage with the process. 

[39:06] Chris Hall:
I think that's particularly relevant because the NDIS itself continues to evolve. 

Rules change. 

Requirements change. 

Provider obligations change. 

Technology changes. 

The sector isn't standing still. 

[39:23] Max King:
Exactly. 

And that's why continuous improvement is so important. 

The organisations that succeed long term aren't necessarily the organisations that get everything right the first time. 

They're the organisations that learn. 

They adapt. 

They improve. 

They evolve. 

Continuous improvement isn't just a compliance requirement—it's actually a business survival strategy. 

[40:12] Chris Hall:
One thing I really like about what you're building with Cortado is that it feels proactive rather than reactive. 

Historically, compliance has often involved looking backwards. 

What happened? 

What went wrong? 

What evidence do we have? 

But what you're describing is much more forward-looking. 

[40:35] Max King:
That's exactly right. 

Historically, compliance systems have largely been repositories. 

You store information. 

You retrieve information. 

You prepare for audits. 

What we're trying to create is something that actively assists organisations. 

A system that highlights emerging risks. 

A system that identifies opportunities. 

A system that helps managers make better decisions. 

A system that supports continuous improvement. 

That's a very different proposition. 

[41:28] Chris Hall:
And I think that's where AI becomes genuinely useful. 

Not because it's trendy. 

Not because investors are talking about it. 

But because it can actually help solve real operational problems. 

[41:43] Max King:
Exactly. 

There's a lot of hype around AI at the moment. 

Some of that hype is justified. 

Some of it isn't. 

The organisations that will benefit most are the organisations that focus on practical applications. 

Where can AI save time? 

Where can AI improve quality? 

Where can AI reduce risk? 

Where can AI help people make better decisions? 

If you start with those questions, the value becomes much clearer. 

[42:39] Chris Hall:
Before we wrap up, let's talk about the future. 

When you look five years ahead, where do you think compliance technology is heading? 

[42:51] Max King:
I think we're moving toward a future where compliance becomes far more integrated into everyday operations. 

Instead of separate systems, separate processes and separate reviews, we'll see compliance embedded directly into workflows. 

We'll see greater automation. 

We'll see more predictive analytics. 

We'll see more intelligent decision support. 

We'll see systems that help organisations identify issues before they become problems. 

And importantly, we'll see technology become much more accessible. 

Historically, sophisticated compliance systems were often only available to large organisations. 

I think that's changing. 

Smaller providers will increasingly have access to tools that were previously out of reach. 

That's exciting because it creates a more level playing field. 

[44:07] Chris Hall:
That's a fantastic note to finish on. 

For anyone listening, if you'd like to learn more about Max, Oscar Support, or Cortado, we'll include links in the show notes. 

Max, thank you very much for joining me today. 

It's been a fascinating discussion. 

[44:25] Max King:
Thanks, Chris. It's always a pleasure. 

I appreciate the opportunity to talk about these topics because I genuinely believe they matter. 

Ultimately, if we can improve governance, risk management and compliance, we improve participant outcomes—and that's what we're all here for. 

[44:45] Chris Hall:
Absolutely. 

Thank you again, Max. 

And thank you to everyone listening to the Steadway NDIS Podcast. 

We'll see you next time. 

Steadway supports people with disability to live independent, meaningful lives on their own terms. As a registered NDIS provider and SDA specialist, we deliver high-quality, personalised supports and acoommodation designed around each person’s goals, needs, and aspirations. 

We proudly serve Sydney’s Sydney and Hornsby, as well as the Central Coast, Lake Macquarie, Newcastle, and the Hunter Valley. Our experienced team is committed to compassionate, reliable, and forward-thinking disability support—focused on building trust, consistency, and real outcomes that last.