--- title: "Australia Cyber Security Act vs EU Cyber Resilience Act" canonical_url: "https://www.sorena.io/artifacts/apac/australia-cyber-security-act/australia-cyber-security-act-vs-eu-cyber-resilience-act" source_url: "https://www.sorena.io/artifacts/apac/australia-cyber-security-act/australia-cyber-security-act-vs-eu-cyber-resilience-act" author: "Sorena AI" description: "Compare Australia's Cyber Security Act 2024 with the EU Cyber Resilience Act across smart-device duties, ransomware reporting, product-with-digital-elements scope, actors, records, and enforcement routes." published_at: "2026-05-09" updated_at: "2026-05-09" keywords: - "Australia Cyber Security Act" - "EU Cyber Resilience Act" - "smart device security standards" - "ransomware payment reporting" - "products with digital elements" - "Smart devices" - "Ransomware reporting" --- **[SORENA](https://www.sorena.io/)** - AI-Powered GRC Platform [Home](https://www.sorena.io/) | [Solutions](https://www.sorena.io/solutions) | [Artifacts](https://www.sorena.io/artifacts) | [About Us](https://www.sorena.io/about-us) | [Contact](https://www.sorena.io/contact) | [Portal](https://app.sorena.io) --- # Australia Cyber Security Act vs EU Cyber Resilience Act Compare Australia's Cyber Security Act 2024 with the EU Cyber Resilience Act across smart-device duties, ransomware reporting, product-with-digital-elements scope, actors, records, and enforcement routes. *Comparison* *Australia and EU* *Cyber product security* ## Australia Cyber Security Act vs EU Cyber Resilience Act Australia's Cyber Security Act 2024 is not a clone of the EU Cyber Resilience Act. It combines Australian smart-device security standards, statements of compliance, ransomware payment reporting, and incident coordination, while the EU CRA sets horizontal cybersecurity requirements for products with digital elements placed on the Union market. Use this page to separate the Australian and EU workstreams before reusing product-security evidence across markets. This comparison focuses on grounded differences between the Australian Cyber Security Act 2024 and Regulation (EU) 2024/2847, the Cyber Resilience Act. It does not treat one regime as evidence of compliance with the other: Australian records should show the relevant connectable product, supplier or reporting business entity analysis, while EU records should show the product-with-digital-elements and economic-operator analysis. ## Australia Cyber Security Act 2024 vs EU Cyber Resilience Act A concrete comparison of the Australian Cyber Security Act 2024 and the EU Cyber Resilience Act for product, security, legal, and compliance teams managing connected products across both markets. - **Australia Cyber Security Act 2024**: Australian obligations focus on relevant connectable products, consumer-grade smart-device security standards, statements of compliance, ransomware payment reporting, incident coordination, and enforcement through Australian notices and regulatory powers. - **EU Cyber Resilience Act**: The EU CRA applies horizontal cybersecurity requirements to products with digital elements placed on the Union market and allocates duties across economic operators such as manufacturers, authorised representatives, importers, and distributors. | Dimension | Australia Cyber Security Act 2024 | EU Cyber Resilience Act | Operational implication | Sources | | --- | --- | --- | --- | --- | | Scope boundary | Australia: start with relevant connectable products that will be acquired in Australia in specified circumstances. The smart-device rules prescribe a standard for consumer-grade relevant connectable products and exclude listed product categories such as desktop computers, laptops, tablet computers, smartphones, therapeutic goods, road vehicles, and road vehicle components. | EU: start with products with digital elements and whether they are placed on the Union market. The CRA is framed as horizontal cybersecurity requirements for hardware and software products with digital elements, not only consumer smart devices. | A connected consumer device may need both reviews, but the Australian scope file should prove the relevant-connectable-product and consumer-grade analysis while the EU file proves the product-with-digital-elements and Union-market analysis. | [Cyber Security (Security Standards for Smart Devices) Rules 2025](https://www.legislation.gov.au/F2025L00276/latest/text?ref=sorena.io) - Supports Australian scope for consumer-grade relevant connectable products and listed product exclusions.
[Regulation (EU) 2024/2847 (Cyber Resilience Act)](https://eur-lex.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Supports keeping the EU product-with-digital-elements analysis separate from Australian smart-device scope.
[Cyber Security Act 2024](https://www.legislation.gov.au/C2024A00098/latest/text?ref=sorena.io) - Supports keeping the Australian relevant-connectable-product analysis separate from the EU CRA analysis. | | Covered actors | Australia: the smart-device duties distinguish manufacturers and suppliers. Manufacturers must manufacture covered products in compliance with the security standard and provide a statement of compliance for Australian supply; suppliers must not supply non-compliant covered products and must supply covered products with the statement of compliance. | EU: the CRA allocates duties across economic operators, including manufacturers, authorised representatives, importers, and distributors. Do not assume the Australian supplier role maps one-to-one to an EU importer or distributor role. | Build a role matrix by market: Australian manufacturer, Australian supplier, EU manufacturer, EU authorised representative, EU importer, and EU distributor may be different legal entities. | [Cyber Security Act 2024](https://www.legislation.gov.au/C2024A00098/latest/text?ref=sorena.io) - Supports Australian manufacturer and supplier duties for relevant connectable products and statements of compliance.
[Regulation (EU) 2024/2847 (Cyber Resilience Act)](https://eur-lex.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Supports the EU CRA economic-operator comparison column.
[Cyber Security (Security Standards for Smart Devices) Rules 2025](https://www.legislation.gov.au/F2025L00276/latest/text?ref=sorena.io) - Supports recording Australian manufacturer, supplier, and statement-of-compliance responsibilities separately. | | Trigger | Australia: the smart-device rules specify concrete consumer-device controls, including password requirements, a published security-issue reporting contact and response information, and a published defined support period for security updates. | EU: the CRA sets essential cybersecurity requirements for products with digital elements and expects cybersecurity to be addressed across the product lifecycle. | A secure-by-design program can support both sides, but the Australian evidence should explicitly show the password, vulnerability-reporting, and support-period items required by the smart-device rules. | [Cyber Security (Security Standards for Smart Devices) Rules 2025](https://www.legislation.gov.au/F2025L00276/latest/text?ref=sorena.io) - Supports the need to keep Australian smart-device rule evidence at the specific control level.
[Regulation (EU) 2024/2847 (Cyber Resilience Act)](https://eur-lex.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Supports EU CRA essential cybersecurity requirements for products with digital elements. | | Core obligations | Australia: for covered consumer-grade relevant connectable products, the statement of compliance must be prepared by or on behalf of the manufacturer, include product and manufacturer details, declare compliance, state the defined support period, and include signature, place, and date of issue. The rules specify a five-year retention period. | EU: the CRA workstream should keep EU product technical documentation, conformity assessment evidence, declarations, CE marking evidence, and economic-operator records separate from the Australian statement of compliance. | Treat the Australian statement of compliance as an Australian artifact. It may reuse underlying test evidence, but it is not automatically the EU CRA conformity file. | [Cyber Security (Security Standards for Smart Devices) Rules 2025](https://www.legislation.gov.au/F2025L00276/latest/text?ref=sorena.io) - Supports the Australian statement-of-compliance content fields and five-year retention period.
[Regulation (EU) 2024/2847 (Cyber Resilience Act)](https://eur-lex.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Supports the EU CRA side of the comparison as a product-with-digital-elements conformity regime.
[Cyber Security Act 2024](https://www.legislation.gov.au/C2024A00098/latest/text?ref=sorena.io) - Supports keeping Australian statement-of-compliance obligations tied to sections 15 and 16 rather than merging them into EU CRA evidence. | | Evidence record | Australia: the Act and ransomware rules create a separate ransomware payment reporting workstream. A reporting business entity includes certain SOCI responsible entities or a business in Australia above the rules' turnover threshold, and the report must cover the incident, extortion demand, payment, and communications to the extent the entity can find the information within the 72-hour reporting period. | EU: the CRA is not a ransomware payment reporting regime. Its incident and vulnerability handling should be managed through the EU product-security workstream, not through the Australian ransomware payment report. | Keep Australian ransomware payment reporting separate from EU CRA product vulnerability handling, even when the same cyber incident affects the same product or customer environment. | [Cyber Security (Ransomware Payment Reporting) Rules 2025](https://www.legislation.gov.au/F2025L00278/latest/text?ref=sorena.io) - Supports treating ransomware payment reporting as its own Australian record set.
[Security of Critical Infrastructure Act 2018](https://www.legislation.gov.au/C2018A00029/latest/text?ref=sorena.io) - Supports SOCI overlap context where ransomware reporting applies to responsible entities for critical infrastructure assets.
[Regulation (EU) 2024/2847 (Cyber Resilience Act)](https://eur-lex.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Supports keeping EU CRA analysis tied to product cybersecurity rather than Australian ransomware payment reporting. | | Timing and deadlines | Australia: the Act provides Australian notice and enforcement tools for smart-device obligations, including compliance notices, stop notices, recall notices, public notification of failure to comply with a recall notice, examinations to assess compliance, monitoring, civil penalty orders, infringement notices, enforceable undertakings, and injunctions. | EU: the CRA workstream should be managed as an EU market-access and market-surveillance file for products with digital elements. The public source in this page supports the EU product-regulation character, but this file does not add unsupported fine amounts or authority assignments. | Escalate enforcement issues by jurisdiction: an Australian notice or examination request and an EU market-surveillance issue require different evidence owners and response files. | [Cyber Security Act 2024](https://www.legislation.gov.au/C2024A00098/latest/text?ref=sorena.io) - Supports separating Australian enforcement response files from EU CRA market-surveillance files.
[Regulation (EU) 2024/2847 (Cyber Resilience Act)](https://eur-lex.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Supports describing the EU CRA as an EU product-with-digital-elements market regime without adding unsupported penalty figures. | | Enforcement | Australia: reuse EU CRA engineering evidence only where it proves the specific Australian requirement, such as password design, security-issue reporting, support-period publication, statement-of-compliance content, or ransomware report content. | EU: reuse Australian engineering evidence only where it maps to the EU CRA product-with-digital-elements obligation and economic-operator file. Australian smart-device statements, SOCI records, and ransomware payment reports do not replace EU CRA conformity evidence. | Maintain a bridge table with three columns: shared engineering evidence, Australian legal artifact, and EU CRA legal artifact. Leave a row blank where the regimes do not match. | [Cyber Security (Security Standards for Smart Devices) Rules 2025](https://www.legislation.gov.au/F2025L00276/latest/text?ref=sorena.io) - Supports the Australian evidence items that may reuse engineering artifacts but still require Australian statement and support-period records.
[Cyber Security (Ransomware Payment Reporting) Rules 2025](https://www.legislation.gov.au/F2025L00278/latest/text?ref=sorena.io) - Supports excluding ransomware payment reports from generic product-security evidence reuse.
[Regulation (EU) 2024/2847 (Cyber Resilience Act)](https://eur-lex.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Supports retaining EU CRA legal artifacts separately when reusing shared product-security evidence.
[Cyber Security Act 2024](https://www.legislation.gov.au/C2024A00098/latest/text?ref=sorena.io) - Supports retaining Australian legal artifacts separately when reusing shared product-security evidence. | | Overlap and reuse | Australia: start with relevant connectable products that will be acquired in Australia in specified circumstances. The smart-device rules prescribe a standard for consumer-grade relevant connectable products and exclude listed product categories such as desktop computers, laptops, tablet computers, smartphones, therapeutic goods, road vehicles, and road vehicle components. | EU: start with products with digital elements and whether they are placed on the Union market. The CRA is framed as horizontal cybersecurity requirements for hardware and software products with digital elements, not only consumer smart devices. | Use this row to spot shared product-security controls, then switch to the decision rule to choose the first file to complete and the evidence to keep separate. | [Cyber Security (Security Standards for Smart Devices) Rules 2025](https://www.legislation.gov.au/F2025L00276/latest/text?ref=sorena.io) - Supports Australian scope for consumer-grade relevant connectable products and listed product exclusions.
[Regulation (EU) 2024/2847 (Cyber Resilience Act)](https://eur-lex.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Supports keeping the EU product-with-digital-elements analysis separate from Australian smart-device scope.
[Cyber Security Act 2024](https://www.legislation.gov.au/C2024A00098/latest/text?ref=sorena.io) - Supports keeping the Australian relevant-connectable-product analysis separate from the EU CRA analysis. | | Practical decision rule | Step 1: decide whether the product is a relevant connectable product acquired in Australia and whether it falls within the consumer-grade smart-device rules. Step 2: if yes, complete the Australian statement of compliance, support-period, and reporting record set. Step 3: separately assess whether the same product is a product with digital elements placed on the Union market and, if so, complete the EU CRA technical, conformity, and economic-operator file. | EU: if the product is not placed on the Union market, the CRA file may not apply. If it is placed on the Union market, proceed with the EU workstream even if the Australian file is already complete. | The decision is not to pick one regime and ignore the other. First classify the market and product, then complete the Australian and EU files that apply in parallel, keeping their legal artifacts separate. | [Cyber Security (Security Standards for Smart Devices) Rules 2025](https://www.legislation.gov.au/F2025L00276/latest/text?ref=sorena.io) - Supports the Australian consumer-grade relevant connectable product standard and statement-of-compliance workflow.
[Regulation (EU) 2024/2847 (Cyber Resilience Act)](https://eur-lex.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Supports the EU side of the decision rule.
[Cyber Security Act 2024](https://www.legislation.gov.au/C2024A00098/latest/text?ref=sorena.io) - Supports the need to keep the Australian and EU files separate while deciding which workstreams apply. | Sources for Scope boundary - Australia Cyber Security Act 2024: - [Cyber Security (Security Standards for Smart Devices) Rules 2025](https://www.legislation.gov.au/F2025L00276/latest/text?ref=sorena.io) - Supports Australian scope for consumer-grade relevant connectable products and listed product exclusions. - Quote: "consumer grade relevant connectable products" Sources for Scope boundary - EU Cyber Resilience Act: - [Regulation (EU) 2024/2847 (Cyber Resilience Act)](https://eur-lex.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Supports EU CRA scope for products with digital elements placed on the Union market. - Quote: "products with digital elements" Sources for Scope boundary - operational implication: - [Cyber Security Act 2024](https://www.legislation.gov.au/C2024A00098/latest/text?ref=sorena.io) - Supports keeping the Australian relevant-connectable-product analysis separate from the EU CRA analysis. - Quote: "relevant connectable products" - [Regulation (EU) 2024/2847 (Cyber Resilience Act)](https://eur-lex.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Supports keeping the EU product-with-digital-elements analysis separate from Australian smart-device scope. - Quote: "products with digital elements" Sources for Covered actors - Australia Cyber Security Act 2024: - [Cyber Security Act 2024](https://www.legislation.gov.au/C2024A00098/latest/text?ref=sorena.io) - Supports Australian manufacturer and supplier duties for relevant connectable products and statements of compliance. - Quote: "Manufacturer must provide statement of compliance" Sources for Covered actors - EU Cyber Resilience Act: - [Regulation (EU) 2024/2847 (Cyber Resilience Act)](https://eur-lex.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Supports the EU CRA economic-operator comparison column. - Quote: "manufacturer, the authorised representative, the importer, the distributor" Sources for Covered actors - operational implication: - [Cyber Security (Security Standards for Smart Devices) Rules 2025](https://www.legislation.gov.au/F2025L00276/latest/text?ref=sorena.io) - Supports recording Australian manufacturer, supplier, and statement-of-compliance responsibilities separately. - Quote: "prepared by, or on behalf of, the manufacturer" Sources for Trigger - Australia Cyber Security Act 2024: - [Cyber Security (Security Standards for Smart Devices) Rules 2025](https://www.legislation.gov.au/F2025L00276/latest/text?ref=sorena.io) - Supports Australian password, security-issue reporting, and defined-support-period requirements for consumer-grade relevant connectable products. - Quote: "Requirements relating to defined support periods" Sources for Trigger - EU Cyber Resilience Act: - [Regulation (EU) 2024/2847 (Cyber Resilience Act)](https://eur-lex.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Supports EU CRA essential cybersecurity requirements for products with digital elements. - Quote: "essential cybersecurity requirements" Sources for Trigger - operational implication: - [Cyber Security (Security Standards for Smart Devices) Rules 2025](https://www.legislation.gov.au/F2025L00276/latest/text?ref=sorena.io) - Supports the need to keep Australian smart-device rule evidence at the specific control level. - Quote: "Passwords must be" Sources for Core obligations - Australia Cyber Security Act 2024: - [Cyber Security (Security Standards for Smart Devices) Rules 2025](https://www.legislation.gov.au/F2025L00276/latest/text?ref=sorena.io) - Supports the Australian statement-of-compliance content fields and five-year retention period. - Quote: "Requirements for statement of compliance" Sources for Core obligations - EU Cyber Resilience Act: - [Regulation (EU) 2024/2847 (Cyber Resilience Act)](https://eur-lex.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Supports the EU CRA side of the comparison as a product-with-digital-elements conformity regime. - Quote: "requirements for placing on the market" Sources for Core obligations - operational implication: - [Cyber Security Act 2024](https://www.legislation.gov.au/C2024A00098/latest/text?ref=sorena.io) - Supports keeping Australian statement-of-compliance obligations tied to sections 15 and 16 rather than merging them into EU CRA evidence. - Quote: "statement of compliance with security standard" Sources for Evidence record - Australia Cyber Security Act 2024: - [Cyber Security (Ransomware Payment Reporting) Rules 2025](https://www.legislation.gov.au/F2025L00278/latest/text?ref=sorena.io) - Supports the Australian reporting business entity threshold and report-content categories for ransomware payments. - Quote: "within the 72 hour time period" - [Security of Critical Infrastructure Act 2018](https://www.legislation.gov.au/C2018A00029/latest/text?ref=sorena.io) - Supports SOCI overlap context where ransomware reporting applies to responsible entities for critical infrastructure assets. - Quote: "Security of Critical Infrastructure Act 2018" Sources for Evidence record - EU Cyber Resilience Act: - [Regulation (EU) 2024/2847 (Cyber Resilience Act)](https://eur-lex.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Supports keeping EU CRA analysis tied to product cybersecurity rather than Australian ransomware payment reporting. - Quote: "cybersecurity requirements for products with digital elements" Sources for Evidence record - operational implication: - [Cyber Security (Ransomware Payment Reporting) Rules 2025](https://www.legislation.gov.au/F2025L00278/latest/text?ref=sorena.io) - Supports treating ransomware payment reporting as its own Australian record set. - Quote: "ransomware payment report" Sources for Timing and deadlines - Australia Cyber Security Act 2024: - [Cyber Security Act 2024](https://www.legislation.gov.au/C2024A00098/latest/text?ref=sorena.io) - Supports Australian compliance, stop, recall, examination, monitoring, civil penalty, infringement notice, undertaking, and injunction routes. - Quote: "compliance notice, a stop notice and a recall notice" Sources for Timing and deadlines - EU Cyber Resilience Act: - [Regulation (EU) 2024/2847 (Cyber Resilience Act)](https://eur-lex.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Supports describing the EU CRA as an EU product-with-digital-elements market regime without adding unsupported penalty figures. - Quote: "Union market" Sources for Timing and deadlines - operational implication: - [Cyber Security Act 2024](https://www.legislation.gov.au/C2024A00098/latest/text?ref=sorena.io) - Supports separating Australian enforcement response files from EU CRA market-surveillance files. - Quote: "Examination to assess compliance" Sources for Enforcement - Australia Cyber Security Act 2024: - [Cyber Security (Security Standards for Smart Devices) Rules 2025](https://www.legislation.gov.au/F2025L00276/latest/text?ref=sorena.io) - Supports the Australian evidence items that may reuse engineering artifacts but still require Australian statement and support-period records. - Quote: "defined support period" - [Cyber Security (Ransomware Payment Reporting) Rules 2025](https://www.legislation.gov.au/F2025L00278/latest/text?ref=sorena.io) - Supports excluding ransomware payment reports from generic product-security evidence reuse. - Quote: "information about the ransomware payment" Sources for Enforcement - EU Cyber Resilience Act: - [Regulation (EU) 2024/2847 (Cyber Resilience Act)](https://eur-lex.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Supports EU CRA reuse only where Australian evidence maps to the EU product-with-digital-elements workstream. - Quote: "products with digital elements" Sources for Enforcement - operational implication: - [Cyber Security Act 2024](https://www.legislation.gov.au/C2024A00098/latest/text?ref=sorena.io) - Supports retaining Australian legal artifacts separately when reusing shared product-security evidence. - Quote: "statement of compliance" - [Regulation (EU) 2024/2847 (Cyber Resilience Act)](https://eur-lex.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Supports retaining EU CRA legal artifacts separately when reusing shared product-security evidence. - Quote: "products with digital elements" Sources for Overlap and reuse - Australia Cyber Security Act 2024: - [Cyber Security (Security Standards for Smart Devices) Rules 2025](https://www.legislation.gov.au/F2025L00276/latest/text?ref=sorena.io) - Supports Australian scope for consumer-grade relevant connectable products and listed product exclusions. - Quote: "consumer grade relevant connectable products" Sources for Overlap and reuse - EU Cyber Resilience Act: - [Regulation (EU) 2024/2847 (Cyber Resilience Act)](https://eur-lex.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Supports EU CRA scope for products with digital elements placed on the Union market. - Quote: "products with digital elements" Sources for Overlap and reuse - operational implication: - [Cyber Security Act 2024](https://www.legislation.gov.au/C2024A00098/latest/text?ref=sorena.io) - Supports keeping the Australian relevant-connectable-product analysis separate from the EU CRA analysis. - Quote: "relevant connectable products" - [Regulation (EU) 2024/2847 (Cyber Resilience Act)](https://eur-lex.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Supports keeping the EU product-with-digital-elements analysis separate from Australian smart-device scope. - Quote: "products with digital elements" Sources for Practical decision rule - Australia Cyber Security Act 2024: - [Cyber Security (Security Standards for Smart Devices) Rules 2025](https://www.legislation.gov.au/F2025L00276/latest/text?ref=sorena.io) - Supports the Australian consumer-grade relevant connectable product standard and statement-of-compliance workflow. - Quote: "consumer grade relevant connectable products" Sources for Practical decision rule - EU Cyber Resilience Act: - [Regulation (EU) 2024/2847 (Cyber Resilience Act)](https://eur-lex.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Supports the EU CRA scope for products with digital elements placed on the Union market. - Quote: "placed on the Union market" Sources for Practical decision rule - operational implication: - [Cyber Security Act 2024](https://www.legislation.gov.au/C2024A00098/latest/text?ref=sorena.io) - Supports the need to keep the Australian and EU files separate while deciding which workstreams apply. - Quote: "statement of compliance" - [Regulation (EU) 2024/2847 (Cyber Resilience Act)](https://eur-lex.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Supports the EU side of the decision rule. - Quote: "Union market" ### How to use this comparison - Start with market and product scope: Australian relevant connectable product and consumer-grade analysis on one side, EU product-with-digital-elements and Union-market analysis on the other. - Assign actors separately: Australian manufacturer and supplier roles do not automatically equal EU manufacturer, authorised representative, importer, or distributor roles. - Keep ransomware payment reporting outside the EU CRA evidence file unless the same incident also creates a separate EU product-security issue. - Use shared engineering controls where possible, but keep the Australian statement of compliance and EU CRA conformity evidence as separate legal artifacts. Sources for the practical decision rule: - [Cyber Security Act 2024](https://www.legislation.gov.au/C2024A00098/latest/text?ref=sorena.io) - Supports the Australian workstream structure for smart-device standards, statements of compliance, ransomware reporting, and enforcement. - Quote: "Cyber Security Act 2024" - [Cyber Security (Security Standards for Smart Devices) Rules 2025](https://www.legislation.gov.au/F2025L00276/latest/text?ref=sorena.io) - Supports the Australian smart-device implementation records used in the comparison decision rule. - Quote: "Security standard for consumer grade relevant connectable products" - [Cyber Security (Ransomware Payment Reporting) Rules 2025](https://www.legislation.gov.au/F2025L00278/latest/text?ref=sorena.io) - Supports separating Australian ransomware payment report triggers and content from EU CRA product-security evidence. - Quote: "ransomware payment report" - [Regulation (EU) 2024/2847 (Cyber Resilience Act)](https://eur-lex.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Supports the EU CRA comparison decision rule for products with digital elements. - Quote: "Cyber Resilience Act" ## Where the regimes overlap and where they do not The closest overlap is connected-product security. Australia uses the Cyber Security Act 2024 and the Cyber Security (Security Standards for Smart Devices) Rules 2025 to regulate relevant connectable products, with a consumer-grade smart-device standard, statement-of-compliance requirements, and notice powers for non-compliance. The EU Cyber Resilience Act is broader on product scope because it is framed around horizontal cybersecurity requirements for products with digital elements. That means a product team may be able to reuse vulnerability-handling, support-period, secure-by-design, and technical-documentation evidence, but it should still keep separate Australia and EU scope records. - Use the Australian workstream for relevant connectable products, consumer-grade smart-device standards, statements of compliance, supplier records, ransomware payment reports, and SOCI overlap checks. - Use the EU CRA workstream for products with digital elements, Union-market placement, economic-operator roles, essential cybersecurity requirements, vulnerability handling, conformity assessment, and CE marking evidence. - Reuse product-security evidence only after confirming the same product version, support period, vulnerability process, market role, and source-linked obligation are actually aligned. Sources for this answer: - [Cyber Security Act 2024](https://www.legislation.gov.au/C2024A00098/latest/text?ref=sorena.io) - Supports the Australian Act's smart-device, statement-of-compliance, ransomware reporting, incident coordination, and enforcement structure. - [Cyber Security (Security Standards for Smart Devices) Rules 2025](https://www.legislation.gov.au/F2025L00276/latest/text?ref=sorena.io) - Supports the consumer-grade relevant connectable product standard and statement-of-compliance requirements. - [Regulation (EU) 2024/2847 (Cyber Resilience Act)](https://eur-lex.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Supports the EU CRA's horizontal cybersecurity requirements for products with digital elements. *Recommended next step* *Placement: after the comparison* ## Separate Australian and EU product-security evidence Use this comparison to split Australian smart-device, ransomware, and SOCI overlap records from EU CRA product-with-digital-elements evidence before assigning implementation work. - [Open Assessment Autopilot](/solutions/assessment.md): Create separate Australia and EU CRA evidence requests for product scope, role, support period, vulnerability handling, and reporting triggers. - [Review source evidence](/solutions/research-copilot.md): Use Research Copilot to verify Australian Act, Australian rules, SOCI overlap, and EU CRA source text before reusing controls. - [Talk through implementation](/contact.md): Review which market, product version, actor, and evidence set controls the next compliance action. ## What evidence should stay separate For Australia, keep the product classification, manufacturer and supplier role analysis, statement of compliance, defined support period, password and vulnerability-reporting evidence, recall or notice correspondence, and any ransomware payment report file in a distinct Australian record set. For the EU CRA, keep the economic-operator role, product-with-digital-elements scope assessment, essential cybersecurity requirement mapping, vulnerability-handling process, technical documentation, conformity evidence, and market-surveillance correspondence in a distinct EU record set. - Do not use an Australian statement of compliance as a substitute for EU CRA conformity evidence without a separate EU CRA analysis. - Do not use EU CRA technical documentation as proof that an Australian supplier supplied the product with the required Australian statement of compliance. - Do not merge ransomware payment reporting with EU CRA vulnerability or incident handling; the Australian ransomware report has its own trigger, threshold, 72-hour clock, and content fields. Sources for this answer: - [Cyber Security (Ransomware Payment Reporting) Rules 2025](https://www.legislation.gov.au/F2025L00278/latest/text?ref=sorena.io) - Supports the Australian ransomware reporting threshold and required report-content categories. - [Cyber Security (Security Standards for Smart Devices) Rules 2025](https://www.legislation.gov.au/F2025L00276/latest/text?ref=sorena.io) - Supports the Australian statement-of-compliance fields and five-year retention period for consumer-grade relevant connectable products. - [Regulation (EU) 2024/2847 (Cyber Resilience Act)](https://eur-lex.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Supports the EU CRA comparison column for products with digital elements and Union-market cybersecurity requirements. ## Primary sources - [Cyber Security Act 2024](https://www.legislation.gov.au/C2024A00098/latest/text?ref=sorena.io) - Supports the Australian workstream structure for smart-device standards, statements of compliance, ransomware reporting, and enforcement. - Quote: "Cyber Security Act 2024" - [Cyber Security (Security Standards for Smart Devices) Rules 2025](https://www.legislation.gov.au/F2025L00276/latest/text?ref=sorena.io) - Supports the Australian smart-device implementation records used in the comparison decision rule. - Quote: "Security standard for consumer grade relevant connectable products" - [Cyber Security (Ransomware Payment Reporting) Rules 2025](https://www.legislation.gov.au/F2025L00278/latest/text?ref=sorena.io) - Supports separating Australian ransomware payment report triggers and content from EU CRA product-security evidence. - Quote: "ransomware payment report" - [Security of Critical Infrastructure Act 2018](https://www.legislation.gov.au/C2018A00029/latest/text?ref=sorena.io) - Supports SOCI overlap context where ransomware reporting applies to responsible entities for critical infrastructure assets. - Quote: "Security of Critical Infrastructure Act 2018" - [Regulation (EU) 2024/2847 (Cyber Resilience Act)](https://eur-lex.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Supports the EU CRA comparison decision rule for products with digital elements. - Quote: "Cyber Resilience Act" ## Related Topic Guides - [Australia Cyber Security Act 2024 scope and definitions](/artifacts/apac/australia-cyber-security-act/scope-and-definitions.md): Grounded scope guide for Australia's Cyber Security Act 2024: relevant connectable products, consumer-grade smart devices, reporting business entities, ransomware payment reports, and SOCI overlap. - [Australia Cyber Security Act and SOCI Act overlap](/artifacts/apac/australia-cyber-security-act/security-of-critical-infrastructure-act-overlap.md): How the Australia Cyber Security Act overlaps with the Security of Critical Infrastructure Act for responsible entities, ransomware payment reporting, smart devices, and evidence records. - [Australia Cyber Security Act Applicability Test](/artifacts/apac/australia-cyber-security-act/applicability-test.md): Decide whether the Australia Cyber Security Act 2024 applies to a smart-device product, supplier, manufacturer, or ransomware payment reporting scenario. - [Australia Cyber Security Act Compliance Checklist](/artifacts/apac/australia-cyber-security-act/checklist.md): Concrete checklist items for Australian Cyber Security Act smart-device and ransomware duties, with SOCI and APRA CPS 234 evidence checks. - [Australia Cyber Security Act Compliance Guide](/artifacts/apac/australia-cyber-security-act/compliance.md): A source-linked compliance guide for Australia Cyber Security Act smart-device statements, ransomware payment reporting, incident coordination, and review-board readiness. - [Australia Cyber Security Act Deadlines and Compliance Calendar](/artifacts/apac/australia-cyber-security-act/deadlines-and-compliance-calendar.md): Calendar of grounded Australia Cyber Security Act milestones for ransomware reporting, smart-device security standards, statements of compliance, and statutory review. - [Australia Cyber Security Act FAQ](/artifacts/apac/australia-cyber-security-act/faq.md): Answers to Australia Cyber Security Act questions on smart device scope, statements of compliance, ransomware reports, enforcement notices, and incident review. - [Australia Cyber Security Act penalties and fines](/artifacts/apac/australia-cyber-security-act/penalties-and-fines.md): Grounded guide to Australia Cyber Security Act civil penalties, smart-device enforcement notices, ransomware reporting exposure, Board notice failures, and evidence records. - [Australia Cyber Security Act recordkeeping FAQ](/artifacts/apac/australia-cyber-security-act/faq/recordkeeping.md): What records to keep for Cyber Security Act 2024 smart-device statements, ransomware payment reports, and supported SOCI or APRA overlap checks. - [Australia Cyber Security Act Requirements](/artifacts/apac/australia-cyber-security-act/requirements.md): Australia Cyber Security Act requirements for smart-device security standards, statements of compliance, ransomware payment reports, notices, and evidence records. - [Australia Cyber Security Act Statement of Compliance Evidence](/artifacts/apac/australia-cyber-security-act/statement-of-compliance-evidence.md): Evidence guide for Australia Cyber Security Act smart-device statements of compliance: required fields, manufacturer and supplier records, five-year retention, and examination readiness. - [Australia Cyber Security Act templates](/artifacts/apac/australia-cyber-security-act/templates.md): Grounded template fields for Australia Cyber Security Act smart-device scope, statements of compliance, ransomware reports, notices, SOCI overlap, and records. - [Australia Cyber Security Act Timeline And Commencement Guide](/artifacts/apac/australia-cyber-security-act/timeline-and-commencement.md): Australia Cyber Security Act guidance for Timeline And Commencement, with practical decisions, evidence, edge cases, and external source citations. - [Australia Cyber Security Act vs UK PSTI Act Guide](/artifacts/apac/australia-cyber-security-act/australia-cyber-security-act-vs-uk-psti-act.md): Compare Australia's Cyber Security Act 2024 smart-device, ransomware, and SOCI-adjacent obligations with the UK's PSTI connected-product regime. - [Australia ransomware payment reporting 72-hour duty](/artifacts/apac/australia-cyber-security-act/ransomware-payment-reporting-72-hours.md): Explain when Australia's Cyber Security Act 2024 requires a ransomware payment report, when the 72-hour clock starts, and what information the report must contain. - [Australia Smart Device Security Standards under the Cyber Security Act](/artifacts/apac/australia-cyber-security-act/smart-device-security-standards.md): Plain-English guide to Australia's Cyber Security (Security Standards for Smart Devices) Rules 2025: scope, passwords, vulnerability reporting, support periods, statements of compliance, and evidence records. - [Australia Smart Device Statement of Compliance Evidence Workflow](/artifacts/apac/australia-cyber-security-act/statement-of-compliance-evidence-workflow.md): Evidence workflow for preparing, supplying, and retaining statements of compliance under Australia's Cyber Security Act 2024 and Smart Devices Rules. - [CSA 2024 Ransomware Payment Reporting Workflow](/artifacts/apac/australia-cyber-security-act/ransomware-payment-reporting-workflow.md): Operational workflow for Australia Cyber Security Act 2024 ransomware payment reports: scope, 72-hour trigger, report fields, owners, evidence, and cited Act and Rules sources. - [CSA 2024 Ransomware Threshold & Report FAQ](/artifacts/apac/australia-cyber-security-act/faq/ransomware-payment-threshold-and-report-content.md): FAQ answer on Australia's Cyber Security Act ransomware payment reporting scope, $3 million turnover threshold, 72-hour trigger, report fields, and evidence. - [CSA 2024 Smart Device Applicability Test](/artifacts/apac/australia-cyber-security-act/smart-device-applicability-and-product-scope.md): Check whether a smart device is a consumer-grade relevant connectable product under Australia's Cyber Security Act and Smart Devices Rules. - [CSA 2024 Smart Device Statement of Compliance](/artifacts/apac/australia-cyber-security-act/statement-of-compliance-and-recordkeeping.md): What a smart-device statement of compliance must contain under Australia's Cyber Security Act 2024 and Smart Device Rules, who prepares and supplies it, how long to retain it, and how to prepare for examination. - [Cyber Security Act 2024 Smart Device Compliance Checklist](/artifacts/apac/australia-cyber-security-act/smart-device-compliance-checklist.md): Checklist for Australia Cyber Security Act 2024 smart-device scope, password controls, vulnerability reporting, security-update support periods, statements of compliance, retention, and evidence. - [Cyber Security Act 2024 Statements of Compliance FAQ](/artifacts/apac/australia-cyber-security-act/faq/statements-of-compliance.md): FAQ answer on Australian Cyber Security Act 2024 statements of compliance for smart devices, including scope, actors, required contents, retention, evidence, and citations. - [Cyber Security Act vs EU CRA: scope and obligations comparison](/artifacts/apac/australia-cyber-security-act/cyber-security-act-vs-eu-cyber-resilience-act.md): Compare Australia's Cyber Security Act 2024 with the EU Cyber Resilience Act across smart-device duties, ransomware reporting, product-with-digital-elements scope, actors, records, and enforcement routes. - [Cyber Security Act vs UK PSTI Act: device security obligations compared](/artifacts/apac/australia-cyber-security-act/cyber-security-act-vs-uk-psti-act.md): Compare Australia's Cyber Security Act 2024 smart-device, ransomware, and SOCI-adjacent obligations with the UK's PSTI connected-product regime. - [How do notices and recalls work under the Australia Cyber Security Act?](/artifacts/apac/australia-cyber-security-act/faq/notices-and-recalls.md): FAQ on Australia Cyber Security Act compliance notices, stop notices, recall notices, public notifications, owners, evidence fields, and grounded timing. - [How does the Australia Cyber Security Act overlap with the SOCI Act?](/artifacts/apac/australia-cyber-security-act/faq/security-of-critical-infrastructure-act-overlap.md): FAQ on when Australia Cyber Security Act ransomware reporting overlaps with SOCI critical infrastructure assets, responsible entities, and smart-device duties. - [Manufacturer, Importer, and Supplier Duties under Australia's Cyber Security Act 2024](/artifacts/apac/australia-cyber-security-act/faq/manufacturer-and-importer-obligations.md): Direct FAQ answer on Cyber Security Act 2024 smart-device duties for manufacturers, importers, and suppliers, including scope, statement records, exceptions, and citations. - [Smart Device Applicability: CSA 2024](/artifacts/apac/australia-cyber-security-act/smart-device-applicability-workflow.md): A source-linked workflow for deciding whether a connected product is covered by Australia's Cyber Security Act 2024 smart-device standard and what evidence to keep. - [SOCI overlap triage workflow for Australia Cyber Security Act](/artifacts/apac/australia-cyber-security-act/soci-overlap-triage-workflow.md): Triage SOCI Act overlap with Australia Cyber Security Act ransomware reporting and smart-device standards using separate owners, evidence, and source-linked scope checks. - [Which smart devices are in scope under Australia's Cyber Security Act 2024?](/artifacts/apac/australia-cyber-security-act/faq/smart-device-scope.md): FAQ on Cyber Security Act 2024 smart-device scope: relevant connectable products, consumer-grade criteria, exclusions, Australian consumer acquisition, and records to keep. --- [Privacy Policy](https://www.sorena.io/privacy) | [Terms of Use](https://www.sorena.io/terms-of-use) | [DMCA](https://www.sorena.io/dmca) | [About Us](https://www.sorena.io/about-us) (c) 2026 Sorena AB (559573-7338). All rights reserved. Source: https://www.sorena.io/artifacts/apac/australia-cyber-security-act/australia-cyber-security-act-vs-eu-cyber-resilience-act