Australia Cyber Security Act 2024 Deadlines and Compliance Calendar

The Australia Cyber Security Act 2024 (No. 98, 2024) received Royal Assent on 29 November 2024. The day after Royal Assent, 30 November 2024, triggered the first wave of commencement dates. Part 1 (Preliminary), Part 4 (Coordination of significant cyber security incidents), and Parts 6 and 7 (Enforcement and Miscellaneous) all commenced on 30 November 2024. These are the earliest Australia Cyber Security Act 2024 deadlines and they brought the foundational definitions, the National Cyber Security Coordinator framework, and the enforcement machinery into force.

Part 1 of the Australia Cyber Security Act 2024 establishes core definitions that the rest of the Act relies on, including the meaning of cyber security incident (section 9), permitted cyber security purpose (section 10), relevant connectable product, reporting business entity, and ransomware payment. Part 4 created the framework for voluntary information sharing with the National Cyber Security Coordinator during significant cyber security incidents, together with safe harbour protections in Divisions 2 and 3 that limit secondary use and disclosure of shared information. Parts 6 and 7 activated the civil penalty provisions, enforceable undertakings, injunctions, monitoring and investigation powers, and infringement notices, meaning the enforcement apparatus was live from day one, even before the substantive obligations in Parts 2, 3, and 5 commenced.

Part 3 (Ransomware reporting obligations) and Part 5 (Cyber Incident Review Board) of the Australia Cyber Security Act 2024 each used a conditional commencement model. Each Part was to commence on a single day fixed by Proclamation, but if no Proclamation was issued within 6 months of Royal Assent, both Parts would automatically commence on the day after the end of that period. Column 3 of the commencement table in section 2 records the backstop commencement date as 29 May 2025 for both Part 3 and Part 5.

Part 3 of the Australia Cyber Security Act 2024 introduced Australia's first mandatory ransomware payment reporting obligation. Section 26 defines who is a reporting business entity and what constitutes a ransomware payment. Section 27 requires the reporting business entity to give the designated Commonwealth body a ransomware payment report within 72 hours of making the payment or becoming aware that the payment was made. The civil penalty for failing to report within 72 hours is 60 penalty units (section 27(5)). Part 5 established the Cyber Incident Review Board, which conducts no fault reviews of significant cyber security incidents. The Board Chair can request information (section 48) or require certain entities to produce documents (section 49) under a civil penalty of 60 penalty units for noncompliance. These commencement dates are essential entries in any Australia Cyber Security Act 2024 compliance calendar.

Part 2 (Security standards for smart devices) of the Australia Cyber Security Act 2024 used a 12 month backstop. If no Proclamation fixed an earlier date, Part 2 would automatically commence on the day after the end of the 12 month period beginning on the day of Royal Assent. Column 3 of the commencement table records this backstop commencement date as 29 November 2025.

Part 2 of the Australia Cyber Security Act 2024 is the legislative foundation for the smart device security standard. Section 14 gives the rules the power to prescribe security standards for specified classes of relevant connectable products. Section 15 requires manufacturers to comply with the security standard and prohibits suppliers from supplying noncompliant products. Section 16 requires manufacturers to provide a statement of compliance and suppliers to supply the product with that statement. Both manufacturers and suppliers must retain the statement of compliance for the period specified in the rules (5 years under section 10 of the Smart Device Rules). The enforcement tools in Division 3 of Part 2, including compliance notices (section 17), stop notices (section 18), and recall notices (section 19), also became available from the 29 November 2025 commencement date. The compliance calendar should note that the enforcement escalation path runs from compliance notice to stop notice to recall notice to public notification of failure to comply with a recall notice (section 20).

The Cyber Security (Security Standards for Smart Devices) Rules 2025 (F2025L00276) were signed by the Minister for Home Affairs on 27 February 2025 and registered on 4 March 2025. The Rules have their own two stage commencement table. Part 1 (Preliminary) commenced on the day the instrument was registered (4 March 2025). Part 2 (Security standards for smart devices) and Schedule 1 (Security standards) commence on 4 March 2026, which is the day after the end of the 12 month period beginning on the registration date.

The 12 month gap between registration and the commencement of Part 2 and Schedule 1 of the Smart Device Rules was designed to give manufacturers time to update product designs, build password compliance into firmware, set up vulnerability disclosure channels, publish defined support periods, and prepare statements of compliance. The commencement date of 4 March 2026 is the most operationally significant of all Australia Cyber Security Act 2024 deadlines for manufacturers and suppliers of consumer grade relevant connectable products. From this date, all three security standard requirements in Part 1 of Schedule 1 and the statement of compliance obligation become enforceable.

The 72 hour ransomware payment reporting obligation under section 27(1) of the Australia Cyber Security Act 2024 is event driven. The reporting clock starts when a reporting business entity makes a ransomware payment or becomes aware that a ransomware payment has been made on its behalf. The report must be submitted to the designated Commonwealth body within 72 hours of that trigger. This is one of the most demanding Australia Cyber Security Act 2024 deadlines because it can strike at any time and leaves minimal room for preparation.

The Ransomware Reporting Rules 2025 (F2025L00278) define which businesses are caught by this obligation and what information the report must contain. Section 6 of the Rules sets the annual turnover threshold at $3 million. For businesses that operated for only part of the previous financial year, the threshold is prorated using the formula: $3 million multiplied by the number of days the business operated, divided by the total number of days in the financial year. Any responsible entity for a critical infrastructure asset under Part 2B of the Security of Critical Infrastructure Act 2018 is also a reporting business entity regardless of turnover. Section 7 of the Rules clarifies that information is only required to the extent that the reporting business entity knows or can discover through reasonable search or enquiry within the 72 hour period.

Section 88 of the Australia Cyber Security Act 2024 requires the Parliamentary Joint Committee on Intelligence and Security (PJCIS) to review the operation of the Act. The PJCIS must begin this review as soon as practicable after 1 December 2027. This review will evaluate how well the Act and its subordinate rules are working and may recommend amendments to the security standard, the reporting thresholds, or the enforcement powers.

Organizations should anticipate that the PJCIS review may result in changes to the Australia Cyber Security Act 2024 deadlines, the scope of the smart device security standard, the ransomware reporting turnover threshold, or the enforcement model. Start documenting compliance evidence, incident response metrics, and product compliance outcomes now so that your organization can contribute meaningfully to any consultation process and be prepared for regulatory changes that may follow the review.

The following compliance calendar consolidates every statutory commencement date from the Australia Cyber Security Act 2024 and its subordinate Rules into chronological order. This is the master list of Australia Cyber Security Act 2024 deadlines. Use it as the foundation for your internal compliance tracking and add your own operational milestones for product launches, incident readiness exercises, and governance reviews.

Organizations building an Australia Cyber Security Act 2024 compliance calendar should record each of these commencement dates and map them to the specific obligations that become enforceable on that day. The timeline shows four distinct waves of obligations spreading across approximately 16 months from Royal Assent to the Smart Device Rules commencement, plus the PJCIS review date approximately three years after Royal Assent.

Product teams that manufacture or supply consumer grade relevant connectable products into Australia should build their compliance calendar around the 4 March 2026 commencement date for the Smart Device Rules. Treating 4 March 2026 as a single drop dead date is risky because the security standard requires changes to product design, firmware, manufacturing processes, website content, and supply chain documentation. The Australia Cyber Security Act 2024 deadlines are best managed by working backward from the commencement date and setting internal milestones at regular intervals.

The compliance calendar below assumes a product that is already in development or on the market. If the product has not yet entered development, shift the milestones further back. All milestone dates are illustrative; the key point is that each workstream needs its own lead time and that the milestones should be tracked against the Australia Cyber Security Act 2024 deadlines.

The 72 hour ransomware payment reporting obligation under the Australia Cyber Security Act 2024 is event driven rather than calendar driven. However, the compliance calendar should still include recurring readiness checks. A 72 hour deadline is extremely tight for preparing a report that must include incident details, demand details, payment details, entity information, ransomware variant details, vulnerability details, and a description of all communications with the extorting entity. Organizations that do not rehearse their reporting workflow will almost certainly struggle to meet the Australia Cyber Security Act 2024 deadlines for ransomware payment reporting.

The compliance calendar for ransomware readiness should start from the commencement date of 29 May 2025 and continue indefinitely. The readiness activities below apply to any reporting business entity, meaning any entity carrying on a business in Australia with annual turnover exceeding $3 million (or the prorated amount for a partial year), and any responsible entity for a critical infrastructure asset under Part 2B of the Security of Critical Infrastructure Act 2018.

Part 5 of the Australia Cyber Security Act 2024 established the Cyber Incident Review Board with a commencement date of 29 May 2025. While Part 5 does not create recurring compliance deadlines for private sector entities in the same way as Parts 2 and 3, it does create the power for the Board Chair to request information (section 48) or require the production of documents (section 49). Failure to comply with a section 49 notice carries a civil penalty of 60 penalty units. Disclosure of information from a draft review report received under section 51 also carries a 60 penalty unit civil penalty (section 59). Organizations should include Board related readiness activities in their Australia Cyber Security Act 2024 compliance calendar.

The Board conducts no fault reviews of significant cyber security incidents. The reviews produce recommendations for government and industry about actions that could prevent, detect, respond to, or minimize the impact of similar incidents in the future. Draft review reports are shared with affected entities before final reports are issued. Certain information must be redacted from published final reports (section 53). The compliance calendar should ensure that the organization has an internal process for handling Board requests and protecting confidential review materials.

An effective Australia Cyber Security Act 2024 compliance calendar combines all of the commencement dates listed above with recurring operational checkpoints. The commencement dates are the legal anchors, but the compliance calendar must also include internal milestones, periodic reviews, training refreshers, and governance reporting cycles. Without recurring reviews, governance meetings, and readiness exercises, the compliance program will decay between statutory deadlines.

The Australia Cyber Security Act 2024 compliance calendar should be owned by a designated compliance function and reviewed at least quarterly. Each entry should have a responsible owner, a due date, and a clear deliverable. Treat missed compliance calendar entries the same way you treat missed audit findings: escalate, remediate, and track to closure.