Australia Cyber Security Act Applicability Test

Start the assessment with the product. Part 2 commenced on 29 November 2025 and applies to a relevant connectable product manufactured on or after that date, or supplied in Australia other than as second-hand goods on or after that date. The current Smart Devices Rules' security standard and statement requirements commenced later, on 4 March 2026.

A product is a relevant connectable product if it is an internet-connectable product or a network-connectable product and is not exempted under the rules. The Act defines an internet-connectable product as one capable of connecting to the internet using a protocol in the internet protocol suite to send and receive data. A network-connectable product can send and receive data by electrical or electromagnetic transmission, is not internet-connectable, and meets the Act's direct-connection tests.

The current smart-device security standard does not cover every relevant connectable product. The Cyber Security (Security Standards for Smart Devices) Rules 2025 prescribe the security standard for consumer-grade relevant connectable products: products intended by the manufacturer to be used, or of a kind likely to be used, for personal, domestic or household use or consumption.

The specified acquisition circumstance is acquisition in Australia by a consumer. Under the Australian Consumer Law test incorporated by the Rules, that can include goods priced at no more than the prescribed $100,000 amount or goods ordinarily acquired for personal, domestic or household use, including some business purchases. Goods acquired for resale or for specified use-up or transformation in production, manufacture, repair, or treatment are excluded from that consumer test. The Rules also carve out six product groups from the smart-device class: desktop computers or laptops, tablet computers, smartphones, therapeutic goods, road vehicles, and road vehicle components.

If a security standard applies, the Act splits duties by role. A manufacturer must manufacture the product in compliance with the security standard when it is aware, or could reasonably be expected to be aware, that the product will be acquired in Australia in the specified circumstances. The manufacturer must also meet other obligations in the standard, such as publishing product security information.

A supplier must not supply a non-compliant product in Australia if it is aware, or could reasonably be expected to be aware, that the product will be acquired in Australia in the specified circumstances. A supplier must also meet the Act's duty to supply the product with a statement of compliance that meets the Rules. The official explanatory statement clarifies that the statement need not be physically provided at the point of sale; it is a regulatory record that an entity may also provide or publish.

For in-scope consumer-grade relevant connectable products, the Rules make the applicability decision operational: the product must meet password requirements, the manufacturer must publish a way to report security issues, and the manufacturer must publish the defined support period for security updates.

The defined support period must be expressed as a period of time with an end date. Once published, the manufacturer must not shorten it; if the period is extended, the new period must be published as soon as practicable.

A ransomware payment scenario is a separate applicability track. Part 3 applies when an incident has occurred, is occurring, or is imminent; the incident is a cyber security incident; it has, is having, or could reasonably be expected to have a direct or indirect impact on a reporting business entity; an extorting entity makes a demand to benefit from the incident or impact; and the reporting business entity provides, or becomes aware that another entity has provided on its behalf, a payment or benefit directly related to the demand.

The entity must also be a reporting business entity at the time the ransomware payment is made. That means either a responsible entity for a critical infrastructure asset to which Part 2B of the Security of Critical Infrastructure Act 2018 applies, or an entity carrying on business in Australia with annual turnover for the previous financial year exceeding the threshold and that is not a Commonwealth body, State body, or responsible entity for a critical infrastructure asset.

The decision record should be short but specific enough to re-run later. Use separate rows for product duties and ransomware reporting because the actor, trigger, threshold, evidence, and deadline are different.

Mark a decision as unresolved if the facts needed for a legal threshold are missing. Common unresolved facts include whether a product is second hand, whether it is likely to be used for personal, domestic, or household use, whether a product is an excluded tablet, smartphone, therapeutic good, road vehicle, or vehicle component, whether the supplier knew or should have known the Australian consumer acquisition circumstance, whether turnover exceeds the threshold, or whether the entity is a responsible entity for a Part 2B SOCI critical infrastructure asset.