Artifact GuideAustraliaAustralia Cyber Security Act vs UK PSTI Act
Australia Cyber Security Act vs UK PSTI Act
Australia's Cyber Security Act 2024 covers connected-product security as well as ransomware payment reports, significant cyber incident coordination, and review-board powers. The UK PSTI comparison on this page concerns connected-product security.
This comparison helps separate reusable connected-product evidence from Australia-only reporting, notice, and critical-infrastructure workstreams.
Use this comparison when a connected product, ransomware payment decision, or Australian critical-infrastructure dependency could be affected by Australia's Cyber Security Act 2024 while the same product program is already tracking the UK's and 2023 security requirements regulations. The Federal Register displays 29 May 2025 for Australia's ransomware provisions, while Home Affairs guidance says 30 May 2025; obtain case-specific advice for an event on 29 May. Cyber Security Act Part 2 commenced on 29 November 2025, while the Smart Devices Rules' consumer-grade standard and statement requirements commenced on 4 March 2026. The has applied since 29 April 2024.
Side-by-side comparison
Australia Cyber Security Act 2024 vs UK PSTI Act: concrete compliance differences
Compare connected-product security, statements, retention and enforcement in Australia and the UK. Ransomware reporting, incident coordination, review-board powers and require separate Australian assessments.
Covers smart-device security standards where the product, consumer-acquisition circumstance, and manufacturer or supplier knowledge tests are met, plus separate ransomware payment reporting, significant incident coordination, Cyber Incident Review Board, and regulatory-powers workstreams.
Second framework
UK PSTI Act
The UK product-security framework assigns duties for relevant consumer connectable products to manufacturers, importers, distributors and authorised representatives.
Australia Cyber Security Act 2024 vs UK PSTI Act: concrete compliance differences
Australia: the Smart Devices Rules apply when a manufacturer or supplier knows, or could reasonably be expected to know, that a consumer will acquire in Australia a relevant connectable product intended, or likely, to be used for personal, domestic, or household use. The Rules exclude listed categories including desktop and laptop computers, tablets, smartphones, therapeutic goods, road vehicles, and road-vehicle components.
Grounds the Australian consumer grade relevant connectable product class, specified Australian consumer-acquisition circumstance, and listed exclusions.
consumer grade relevant connectable products
UK PSTI: the regime covers consumer connectable products made available to UK consumers. Official guidance lists exclusions and exceptions, including certain Northern Ireland products, EV charge points, medical devices, smart meters, specified computers without cellular connectivity, and vehicle categories covered by the 2025 amendment.
Official guidance supports the UK consumer-connectable-product scope and listed exclusions and exceptions, including the 2025 vehicle amendment.
What is covered
A product can reuse part of the product-security analysis only after the Australian consumer-grade and acquisition-in-Australia tests are documented separately from the UK PSTI scope decision.
Australia: the Smart Devices Rules place duties on manufacturers and suppliers. The must be prepared by or on behalf of the manufacturer, and suppliers must supply the covered product in Australia with that statement.
Grounds the Australian manufacturer and supplier duties and the manufacturer-prepared statement of compliance.
prepared by, or on behalf of, the manufacturer
UK PSTI: manufacturers, importers, and distributors have duties under the Act and 2023 Regulations, including statement-of-compliance duties. Authorised representatives also have duties when a manufacturer's compliance failure arises.
Official guidance supports manufacturer, importer, distributor, and authorised-representative roles and their compliance duties.
Manufacturers, importers, and distributors
Confirm the Australian actor role (manufacturer or supplier) and the UK actor role (manufacturer, importer, or distributor) separately, because the same business can hold different duties in each market.
Australia: the smart-device duty turns on the product class, the specified consumer-acquisition circumstance, and what the manufacturer or supplier knows or could reasonably be expected to know. The separate ransomware duty arises only when all section 26 incident, demand, payment, and reporting-business-entity conditions are met.
Grounds the Australian acquisition-in-Australia trigger for the smart-device standard.
acquired in Australia by a consumer
UK PSTI: the product-security duties apply when an in-scope relevant connectable product is made available to UK consumers. The UK regime has been in force since 29 April 2024.
Official guidance supports the UK consumer-supply scope and confirms the 29 April 2024 commencement date.
from that date
Pin the trigger to a market event in each regime: Australian acquisition by a consumer versus UK availability on the UK market, and never assume a UK availability event satisfies the Australian acquisition test.
Australia: the product standard covers password requirements, publication of security-issue reporting information, and publication of the defined support period for security updates; manufacturers and suppliers also need statement-of-compliance evidence.
Grounds Australian password, security-issue reporting, support-period publication, and statement-of-compliance duties.
Requirements in relation to passwords
UK PSTI: the Australian explanatory statement says the Australian Schedule 1 standards closely follow the UK 2023 security requirements regulations. Check each UK requirement before reusing password, security-issue reporting or support-period evidence.
UK source for the comparator security requirements referenced by the Australian explanatory statement.
security requirements
Map password, vulnerability-reporting, and support-period controls once, but keep an Australian compliance matrix showing each Australian clause and statement requirement is met.
Australia: the statement must be prepared by or on behalf of the manufacturer and include product type and batch identifier, manufacturer and authorised-representative details, compliance declarations, defined support period, signatory details, and place and date of issue; statements must be retained for five years.
Grounds the Australian statement fields and five-year retention period.
the period is 5 years
UK PSTI: the statement must accompany the product and meet the UK requirements. A UK manufacturer or importer must retain a copy for the longer of 10 years from the issue date and the product's defined support period. The Australian explanatory statement allows the same information to support Australia only when every Australian section 9 requirement is met.
Regulations 7 to 9 support minimum statement information and the manufacturer and importer retention period.
whichever is the longer of
Reuse one document only after separate Australian and UK field, accompaniment, actor, and retention checks. Otherwise keep a UK PSTI statement and an Australian statement as separate records.
Australia: the Federal Register displays 29 May 2025 for Part 3, while Home Affairs guidance says the ransomware regime started on 30 May 2025. A must report when all ransomware-payment conditions apply; the rules set a $3 million previous-financial-year turnover threshold for non- businesses, subject to the Act's exclusions and the pro-rated rule for a business carried on for only part of that year. The report is due within 72 hours after payment or awareness of an on-behalf payment.
Home Affairs says the ransomware payment reporting rules start from 30 May 2025, one day after the date displayed in the Federal Register's Act commencement table.
start from 30 May 2025
UK PSTI: the consumer connectable product regime has applied since 29 April 2024. It is a product-security regime, not a ransomware-payment reporting regime.
Official guidance confirms the UK product-security regime's 29 April 2024 start date and product-security focus.
came into effect on 29 April 2024
Do not merge ransomware-payment playbooks with UK product-security evidence; route these cases to Australian incident response, legal, and executive approval owners.
Australia: sections 15 and 16 smart-device duties are enforced through compliance, stop, and recall notices, public notification of recall-notice failure, expert examination, monitoring, and enforceable undertakings. The Act's express civil penalties, infringement notices, and injunctions concern specified civil-penalty provisions elsewhere, including ransomware reporting and certain review-board or protected-information contraventions. A smart-device breach does not automatically carry those penalties.
Grounds additional matters that may be published after failure to comply with a recall notice.
recall notice
UK PSTI: enforces the product-security regime on behalf of the Department for Science, Innovation and Technology (DSIT) and says it carries out regulatory activity on a risk-based basis. Businesses must also investigate potential compliance failures, keep records, and act on compliance failures as required by the legislation.
Official OPSS and DSIT guidance supports the enforcement authority, risk-based regulatory approach, and compliance-failure duties.
Office for Product Safety and Standards
Keep jurisdiction-specific response files. Australian remediation may involve compliance, stop, or recall notices and examinations; UK remediation should record contact, the suspected failure, the investigation, required notifications, and corrective action.
Australia: the explanatory statement says the Schedule 1 smart-device security standards closely follow the UK 2023 relevant-connectable-product security requirements regulations, so password, vulnerability-reporting, and support-period controls are the genuine overlap area with the UK regime.
Grounds the Australia-only SOCI critical-infrastructure track that has no UK PSTI overlap.
Notification of cyber security incidents
UK PSTI: the 2023 security requirements regulations set the comparable password, security-issue reporting, and minimum-support-period duties for relevant connectable products that the Australian standard mirrors, while UK-only market-surveillance and enforcement detail stay outside this overlap.
UK source for the comparable connected-product security requirements that the Australian standard mirrors.
Relevant Connectable Products
Reuse mapped product-security controls across both regimes, but keep ransomware payment reporting, Cyber Incident Review Board, and critical-infrastructure obligations strictly Australia-only because they have no UK PSTI counterpart.
Australia: run the smart-device workstream when the product, specified consumer-acquisition circumstance, and manufacturer or supplier knowledge tests are met. Run ransomware, incident-coordination, review-board, and workstreams only when their separate triggers apply.
Grounds the Australian multi-workstream split across smart devices, ransomware reporting, incident coordination, review board, and regulatory powers.
Cyber Security Act 2024
UK PSTI: run the UK workstream when an in-scope relevant connectable product is made available to UK consumers. Confirm the UK actor role, security requirements, statement, exclusions, and any compliance-failure action.
UK source for the PSTI comparator as the controlling UK product-security framework.
Product Security and Telecommunications Infrastructure Act 2022
Run both product assessments for products entering both markets. Reuse technical evidence where it proves each rule, but keep the Australian and UK legal artifacts, dates, actor findings, and incident-only records separate.
Supports routing ransomware payment events to the Australian workstream rather than UK PSTI evidence.
ransomware payment report
Scope boundary
Australia Cyber Security Act 2024
Australia: the Smart Devices Rules apply when a manufacturer or supplier knows, or could reasonably be expected to know, that a consumer will acquire in Australia a relevant connectable product intended, or likely, to be used for personal, domestic, or household use. The Rules exclude listed categories including desktop and laptop computers, tablets, smartphones, therapeutic goods, road vehicles, and road-vehicle components.
Grounds the Australian consumer grade relevant connectable product class, specified Australian consumer-acquisition circumstance, and listed exclusions.
consumer grade relevant connectable products
UK PSTI Act
UK PSTI: the regime covers consumer connectable products made available to UK consumers. Official guidance lists exclusions and exceptions, including certain Northern Ireland products, EV charge points, medical devices, smart meters, specified computers without cellular connectivity, and vehicle categories covered by the 2025 amendment.
Official guidance supports the UK consumer-connectable-product scope and listed exclusions and exceptions, including the 2025 vehicle amendment.
What is covered
Operational implication
A product can reuse part of the product-security analysis only after the Australian consumer-grade and acquisition-in-Australia tests are documented separately from the UK PSTI scope decision.
Supports the need for a distinct Australian scope finding before evidence reuse.
acquired in Australia by a consumer
Who carries the duty
Australia Cyber Security Act 2024
Australia: the Smart Devices Rules place duties on manufacturers and suppliers. The must be prepared by or on behalf of the manufacturer, and suppliers must supply the covered product in Australia with that statement.
Grounds the Australian manufacturer and supplier duties and the manufacturer-prepared statement of compliance.
prepared by, or on behalf of, the manufacturer
UK PSTI Act
UK PSTI: manufacturers, importers, and distributors have duties under the Act and 2023 Regulations, including statement-of-compliance duties. Authorised representatives also have duties when a manufacturer's compliance failure arises.
Official guidance supports manufacturer, importer, distributor, and authorised-representative roles and their compliance duties.
Manufacturers, importers, and distributors
Operational implication
Confirm the Australian actor role (manufacturer or supplier) and the UK actor role (manufacturer, importer, or distributor) separately, because the same business can hold different duties in each market.
Supports recording the Australian actor role separately from the UK actor role before reusing evidence.
supplier
What triggers the obligation
Australia Cyber Security Act 2024
Australia: the smart-device duty turns on the product class, the specified consumer-acquisition circumstance, and what the manufacturer or supplier knows or could reasonably be expected to know. The separate ransomware duty arises only when all section 26 incident, demand, payment, and reporting-business-entity conditions are met.
Grounds the Australian acquisition-in-Australia trigger for the smart-device standard.
acquired in Australia by a consumer
UK PSTI Act
UK PSTI: the product-security duties apply when an in-scope relevant connectable product is made available to UK consumers. The UK regime has been in force since 29 April 2024.
Official guidance supports the UK consumer-supply scope and confirms the 29 April 2024 commencement date.
from that date
Operational implication
Pin the trigger to a market event in each regime: Australian acquisition by a consumer versus UK availability on the UK market, and never assume a UK availability event satisfies the Australian acquisition test.
Supports treating the Australian trigger as a distinct market event from the UK availability trigger.
personal, domestic or household
Core product obligations
Australia Cyber Security Act 2024
Australia: the product standard covers password requirements, publication of security-issue reporting information, and publication of the defined support period for security updates; manufacturers and suppliers also need statement-of-compliance evidence.
Grounds Australian password, security-issue reporting, support-period publication, and statement-of-compliance duties.
Requirements in relation to passwords
UK PSTI Act
UK PSTI: the Australian explanatory statement says the Australian Schedule 1 standards closely follow the UK 2023 security requirements regulations. Check each UK requirement before reusing password, security-issue reporting or support-period evidence.
UK source for the comparator security requirements referenced by the Australian explanatory statement.
security requirements
Operational implication
Map password, vulnerability-reporting, and support-period controls once, but keep an Australian compliance matrix showing each Australian clause and statement requirement is met.
Supports maintaining Australian clause-level evidence even where UK evidence is reused.
defined support period
Evidence and retention
Australia Cyber Security Act 2024
Australia: the statement must be prepared by or on behalf of the manufacturer and include product type and batch identifier, manufacturer and authorised-representative details, compliance declarations, defined support period, signatory details, and place and date of issue; statements must be retained for five years.
Grounds the Australian statement fields and five-year retention period.
the period is 5 years
UK PSTI Act
UK PSTI: the statement must accompany the product and meet the UK requirements. A UK manufacturer or importer must retain a copy for the longer of 10 years from the issue date and the product's defined support period. The Australian explanatory statement allows the same information to support Australia only when every Australian section 9 requirement is met.
Regulations 7 to 9 support minimum statement information and the manufacturer and importer retention period.
whichever is the longer of
Operational implication
Reuse one document only after separate Australian and UK field, accompaniment, actor, and retention checks. Otherwise keep a UK PSTI statement and an Australian statement as separate records.
Supports conditional reuse of statement evidence because Australia specifies its own statement requirements.
Requirements for statement of compliance
Timing and separate incident duties
Australia Cyber Security Act 2024
Australia: the Federal Register displays 29 May 2025 for Part 3, while Home Affairs guidance says the ransomware regime started on 30 May 2025. A must report when all ransomware-payment conditions apply; the rules set a $3 million previous-financial-year turnover threshold for non- businesses, subject to the Act's exclusions and the pro-rated rule for a business carried on for only part of that year. The report is due within 72 hours after payment or awareness of an on-behalf payment.
Home Affairs says the ransomware payment reporting rules start from 30 May 2025, one day after the date displayed in the Federal Register's Act commencement table.
start from 30 May 2025
UK PSTI Act
UK PSTI: the consumer connectable product regime has applied since 29 April 2024. It is a product-security regime, not a ransomware-payment reporting regime.
Official guidance confirms the UK product-security regime's 29 April 2024 start date and product-security focus.
came into effect on 29 April 2024
Operational implication
Do not merge ransomware-payment playbooks with UK product-security evidence; route these cases to Australian incident response, legal, and executive approval owners.
Supports a separate Australian evidence workflow for ransomware payment reports.
ransomware payment report
Enforcement and oversight
Australia Cyber Security Act 2024
Australia: sections 15 and 16 smart-device duties are enforced through compliance, stop, and recall notices, public notification of recall-notice failure, expert examination, monitoring, and enforceable undertakings. The Act's express civil penalties, infringement notices, and injunctions concern specified civil-penalty provisions elsewhere, including ransomware reporting and certain review-board or protected-information contraventions. A smart-device breach does not automatically carry those penalties.
Grounds additional matters that may be published after failure to comply with a recall notice.
recall notice
UK PSTI Act
UK PSTI: enforces the product-security regime on behalf of the Department for Science, Innovation and Technology (DSIT) and says it carries out regulatory activity on a risk-based basis. Businesses must also investigate potential compliance failures, keep records, and act on compliance failures as required by the legislation.
Official OPSS and DSIT guidance supports the enforcement authority, risk-based regulatory approach, and compliance-failure duties.
Office for Product Safety and Standards
Operational implication
Keep jurisdiction-specific response files. Australian remediation may involve compliance, stop, or recall notices and examinations; UK remediation should record contact, the suspected failure, the investigation, required notifications, and corrective action.
Supports separate Australian remediation evidence for notices, examination, and regulatory-powers escalation.
Regulatory powers
Where the regimes overlap
Australia Cyber Security Act 2024
Australia: the explanatory statement says the Schedule 1 smart-device security standards closely follow the UK 2023 relevant-connectable-product security requirements regulations, so password, vulnerability-reporting, and support-period controls are the genuine overlap area with the UK regime.
Grounds the Australia-only SOCI critical-infrastructure track that has no UK PSTI overlap.
Notification of cyber security incidents
UK PSTI Act
UK PSTI: the 2023 security requirements regulations set the comparable password, security-issue reporting, and minimum-support-period duties for relevant connectable products that the Australian standard mirrors, while UK-only market-surveillance and enforcement detail stay outside this overlap.
UK source for the comparable connected-product security requirements that the Australian standard mirrors.
Relevant Connectable Products
Operational implication
Reuse mapped product-security controls across both regimes, but keep ransomware payment reporting, Cyber Incident Review Board, and critical-infrastructure obligations strictly Australia-only because they have no UK PSTI counterpart.
Supports keeping review-board obligations outside the UK PSTI overlap area.
Cyber Incident Review Board
Decision rule
Australia Cyber Security Act 2024
Australia: run the smart-device workstream when the product, specified consumer-acquisition circumstance, and manufacturer or supplier knowledge tests are met. Run ransomware, incident-coordination, review-board, and workstreams only when their separate triggers apply.
Grounds the Australian multi-workstream split across smart devices, ransomware reporting, incident coordination, review board, and regulatory powers.
Cyber Security Act 2024
UK PSTI Act
UK PSTI: run the UK workstream when an in-scope relevant connectable product is made available to UK consumers. Confirm the UK actor role, security requirements, statement, exclusions, and any compliance-failure action.
UK source for the PSTI comparator as the controlling UK product-security framework.
Product Security and Telecommunications Infrastructure Act 2022
Operational implication
Run both product assessments for products entering both markets. Reuse technical evidence where it proves each rule, but keep the Australian and UK legal artifacts, dates, actor findings, and incident-only records separate.
Supports routing ransomware payment events to the Australian workstream rather than UK PSTI evidence.
ransomware payment report
Practical decision rule
How to use the comparison without overreaching
Start with the Australian scope split: smart-device standard, ransomware payment report, significant incident coordination, Cyber Incident Review Board, or overlap.
Reuse UK PSTI evidence only for connected-product security where Australian statement, support-period, retention, and consumer-acquisition requirements are independently satisfied.
Use official UK guidance for commencement, actor, scope, exclusion, and facts; check the Act, current Regulations, and enforcement policy before stating penalty amounts or case-specific enforcement consequences.
UK source for the PSTI security-requirements comparator, for comparison with the Australian requirements.
Relevant Connectable Products
1
Section 1
What is comparable between the Australian and UK regimes?
Connected-product security is the main overlap. Australia's Smart Devices Rules establish a security standard for that manufacturers or suppliers know, or could reasonably be expected to know, will be acquired in Australia by a consumer. The Australian explanatory statement says those standards closely follow the UK's 2023 relevant-connectable-product security requirements regulations.
Australia's Cyber Security Act 2024 also contains ransomware payment reporting, significant cyber incident coordination, and Cyber Incident Review Board provisions. remains a separate Australian critical-infrastructure regime. UK PSTI evidence does not cover those Australian workstreams.
Use product-security evidence across both regimes only for password requirements, vulnerability-reporting publication, support-period publication, and statement-of-compliance content where the Australian rules are met.
Create separate Australian records for ransomware payment reporting, including the test, payment trigger, 72-hour report clock, and required report fields.
Keep asset scoping separate from UK PSTI product scope because SOCI is about Australian critical infrastructure assets, reporting, risk management, and enhanced cyber obligations.
Treat Cyber Incident Review Board requests and significant incident coordination as Australia-only governance matters unless another source creates a separate UK duty.
UK source for the comparator product-security requirements referenced by the Australian explanatory statement.
relevant connectable products
2
Section 2
Which evidence can be reused, and which must stay Australia-specific?
For connected products, the Australian explanatory statement allows responsible entities operating across similar consumer-grade smart-device frameworks to use the same statement-of-compliance information for Australia, including UK-market products, if every Australian section 9 requirement is met. The Office for Product Safety and Standards () remains the UK enforcement authority; Australian product notices follow the separate Cyber Security Act process.
Reuse remains conditional. Australian records still need the Australian product class and consumer-acquisition analysis, manufacturer-prepared statement fields, defined support period, five-year retention, and any Australian supply decision. UK manufacturers and importers must retain their statement for the longer of 10 years from issue and the defined support period. Ransomware payment reports and records are not PSTI artifacts.
Product owner: maintain product type, batch identifier, manufacturer and authorised-representative details, support-period text, and compliance declaration for Australian statement-of-compliance use.
UK product owner: record how the statement accompanies the product and retain the UK statement for the longer of 10 years from issue and the defined support period.
Security engineering: prove unique or user-defined passwords, security-issue reporting details, acknowledgement and status-update process, and security-update support period publication.
Incident response and legal: keep Australian ransomware payment report facts separate, including Australian Business Number (ABN) and address details where applicable, incident impact, demand, payment, and communications fields.
Critical infrastructure owner: document whether asset obligations apply separately from product-security duties before reusing any control or audit evidence.
Regulations 8 and 9 support the UK manufacturer and importer retention period: the longer of 10 years from issue and the product's defined support period.
whichever is the longer of
Recommended next step
Turn the Australia and UK product-security split into assigned work
This comparison helps assign Australian smart-device, ransomware-reporting, SOCI, and UK PSTI evidence work without merging different legal triggers.
Australian smart-device rules for consumer grade relevant connectable products, statement contents, security issue reporting, support periods, and retention.
Defines the Australian smart-device security standard, statement-of-compliance requirements, and five-year retention period.
Grounds statement-of-compliance fields, security-standard requirements, support-period publication, and retention evidence.
Show 13 more
Grounds the Australian consumer grade relevant connectable product class, specified Australian consumer-acquisition circumstance, and listed exclusions.
Supports the need for a distinct Australian scope finding before evidence reuse.
Grounds the Australian manufacturer and supplier duties and the manufacturer-prepared statement of compliance.
Supports recording the Australian actor role separately from the UK actor role before reusing evidence.
Grounds the Australian acquisition-in-Australia trigger for the smart-device standard.
Supports treating the Australian trigger as a distinct market event from the UK availability trigger.
Grounds Australian password, security-issue reporting, support-period publication, and statement-of-compliance duties.
Supports maintaining Australian clause-level evidence even where UK evidence is reused.
Grounds the Australian statement fields and five-year retention period.
Supports conditional reuse of statement evidence because Australia specifies its own statement requirements.
Grounds additional matters that may be published after failure to comply with a recall notice.
Grounds the Australian password, vulnerability-reporting, and support-period controls that align with the UK requirements.
Supports conditional product-security evidence reuse through Australian statement and security-standard requirements.
Binding UK instrument for relevant-connectable-product password, security-issue reporting, minimum security-update-period, and statement-of-compliance requirements.
UK source for the comparator product-security requirements referenced by the Australian explanatory statement.
Regulations 8 and 9 support the UK manufacturer and importer retention period: the longer of 10 years from issue and the product's defined support period.
Show 4 more
UK source for the comparator security requirements referenced by the Australian explanatory statement.
Regulations 7 to 9 support minimum statement information and the manufacturer and importer retention period.
UK source for the comparable connected-product security requirements that the Australian standard mirrors.
UK source for the PSTI security-requirements comparator, for comparison with the Australian requirements.
Official OPSS and DSIT guidance for commencement, product scope, exclusions, actor duties, security requirements, statements of compliance, and enforcement.
Official guidance supports the UK consumer-connectable-product scope and listed exclusions and exceptions, including the 2025 vehicle amendment.
Official guidance supports manufacturer, importer, distributor, and authorised-representative roles and their compliance duties.
Show 3 more
Official guidance supports the UK consumer-supply scope and confirms the 29 April 2024 commencement date.
Official guidance confirms the UK product-security regime's 29 April 2024 start date and product-security focus.
Official OPSS and DSIT guidance supports the enforcement authority, risk-based regulatory approach, and compliance-failure duties.
Home Affairs says the ransomware payment reporting rules start from 30 May 2025, one day after the date displayed in the Federal Register's Act commencement table.