How long does an Australian provider have to report you to PRISMS in 2026?
Thirty-one days is the default. Under section 19 of the Education Services for Overseas Students Act 2000 (ESOS Act), a registered provider must enter information about an accepted student into the computer system established by the Secretary under section 109 — the system generally known as PRISMS — within 31 days of the relevant event, except where the student is under 18 and the report is about non-commencement or termination, in which case the window drops to 14 days. Reports about a breach of a prescribed student visa condition are not measured in days at all: they must be made as soon as practicable after the breach occurs. This reflects the September 2026 official text of the Act published on the Federal Register of Legislation. It is general information rather than advice about any individual's situation, so where a specific enrolment or visa record is at stake, the official text and a qualified professional's reading of it should govern.
What has to be reported within 31 days?
Section 19(1) lists six categories of information, and each is due within the applicable number of days after the event occurs:
- the name and any other prescribed details of each person who becomes an accepted student of the provider;
- for each such person, the name, starting day and expected duration of the course they were accepted into;
- prescribed information about an accepted student who does not begin the course when expected;
- any termination of an accepted student's studies before the course is completed, whether the student, the provider or someone else initiated it;
- any change in the identity or duration of an accepted student's course;
- any other prescribed matter relating to accepted students.
The wording matters in two places. "Termination" is deliberately broad — it covers withdrawal, exclusion and any other ending before completion, not just a student quitting. And "change in the identity or duration of the course" means a shortened or restructured course is reportable even when the student stays enrolled and happy.
When does the deadline shrink to 14 days?
Only in one specific combination, set out in section 19(1A): the student must be under 18, and the information must be of the kind described in paragraph (1)(c) or (1)(d) — that is, the student did not begin the course when expected, or the student's studies were terminated before completion. Everything else stays on the 31-day clock, including the initial enrolment report and any change to course identity or duration.
| Report | Applies to | Deadline under s 19 |
|---|---|---|
| Becoming an accepted student; course name, start and expected duration | All accepted students | 31 days |
| Did not begin the course when expected | Under 18 | 14 days |
| Did not begin the course when expected | 18 or over | 31 days |
| Termination of studies before completion | Under 18 | 14 days |
| Termination of studies before completion | 18 or over | 31 days |
| Change in course identity or duration | All accepted students | 31 days |
| Breach of a prescribed student visa condition | All accepted students | As soon as practicable |
The shorter window for under-18 students is easy to understand once you look at what the two covered events have in common: both mean the provider no longer has a minor in front of it in a classroom. A student who never showed up, or who has left, is a welfare question as much as an enrolment question, and halving the reporting window is how the Act keeps that question from going stale.
Which reports have no fixed number of days?
Section 19(2) deals with breaches of a prescribed condition of a student visa, and it uses a different standard: the provider must give particulars of the breach as soon as practicable after it occurs. There is no grace period to count. Section 19(2A) then closes the obvious loophole — the provider must still report the breach even if the student has stopped being an accepted student of that provider by the time the report is made.
In practice this means the three rhythms run in parallel rather than in sequence. A provider could still be inside its 31 days for a termination report and already be overdue on a breach report about the same student.
When does the clock actually start?
The Act anchors the deadline to the event, not to the provider's awareness of it: information must be given "within the applicable number of days after the event specified below occurs." So the reference point is the day the student failed to commence, the day the studies ended, or the day the course changed — not the day an administrator opened the file.
This is worth knowing because students often assume the countdown begins when they submit a withdrawal form or send an email. Under the text, what triggers the report is the change in circumstances itself, which is why a delay in paperwork between a student and the provider does not necessarily extend the provider's own deadline.
What happens if the provider reports late, or reports wrongly?
Two consequences sit directly in the section. Failing to comply is an offence carrying a penalty of 60 penalty units, and section 19(6) makes it a strict liability offence, so the absence of intent is not itself a defence. Separately, Note 1 records that the ESOS agency for the provider may take action under Division 1 of Part 6 against a provider that breaches the section — a regulatory pathway that runs alongside the penalty rather than instead of it.
Accuracy carries its own exposure. Note 2 points to section 108: it is an offence to provide false or misleading information in complying, or purporting to comply, with the section. For a student, the practical implication is that what the provider types into PRISMS is a formal record with legal weight behind it, not an informal internal note.
One structural detail: if the provider is an unincorporated body, the duty under section 19(4) falls on its principal executive officer personally rather than on the body itself.
Does any of this still matter after you leave or finish?
Yes, and the record-keeping duty runs on a separate timeline. Under section 21, a provider must keep records for each accepted student who is enrolled or who has paid tuition fees, covering the student's current residential address, mobile phone number (if any), email address (if any) and any other details prescribed by the regulations. The provider must have a procedure to confirm those details with the student in writing at least every six months while the student remains an accepted student, and to update the records accordingly.
Where an accepted student completes a unit of study for a course and the student's progress in that unit is assessed, the provider must record the outcome of that assessment and keep the record up to date. And section 21(3) sets the retention floor: records must be kept for at least two years after the person ceases to be an accepted student, though they no longer need to be kept up to date after that point.
The combination is what makes the question practical rather than academic. A report made on day 20 can sit in a record that is retained for two more years after the student has gone. Suppose an applicant withdraws in March, assumes the matter is closed, and only in the following year discovers that a breach report was also filed — the enrolment history and the assessment outcomes from that period are still within the retention window, and that is typically where the factual reconstruction has to begin.
Frequently Asked Questions
Is it 14 days or 31 days?
31 days is the default for every category in section 19(1). The 14-day window applies only when the student is under 18 and the report concerns either non-commencement under paragraph (1)(c) or termination of studies under paragraph (1)(d).
Does the 14-day rule apply to a student who turns 18 during the course?
The provision is written around the student being "less than 18 years old" at the time of the relevant report, and the Act does not set out a separate rule for a student who crosses 18 mid-course. Because the text does not resolve that case explicitly, the official wording and any prescribed regulations should be treated as the governing reference.
Does my provider still have to report a breach after I have withdrawn?
Yes. Section 19(2A) requires the provider to give particulars of a breach of a prescribed student visa condition even if the student has ceased to be an accepted student of that provider. Withdrawing does not extinguish the obligation.
How quickly must a breach be reported?
Section 19(2) sets the standard as "as soon as practicable" after the breach occurs. There is no fixed number of days, which means a provider cannot rely on the 31-day or 14-day windows for this category.
How long does the provider keep my records?
Section 21(3) requires records to be retained for at least two years after the person ceases to be an accepted student. They do not need to be kept up to date after that point, but the retained record still exists.
Can a provider be penalised for getting a report wrong?
Yes. Failing to comply with section 19 is an offence with a penalty of 60 penalty units and is one of strict liability, and providing false or misleading information in complying or purporting to comply is an offence under section 108.