Search every question across sub-FAQs

Yes. If an entity has a section 15 or 16 obligation for a relevant connectable product, the Secretary may engage an appropriately qualified and experienced expert to examine whether the product complies with the security standard, whether its statement of compliance meets section 16, or both.

For that examination, the Secretary may request the product, the statement, or both in writing. The request must identify the product, identify the manufacturer if known when the recipient is not the manufacturer, set a reasonable response period, describe the retention period and testing requirements for the product, explain the kind of testing or analysis, and explain possible consequences of non-compliance. The Commonwealth must pay reasonable compensation for complying with the request.

The Cyber Security Act does not supersede the Security of Critical Infrastructure Act 2018 (SOCI Act). It imports SOCI concepts for a critical infrastructure asset and a responsible entity, and its ransomware payment reporting regime expressly covers a responsible entity for a critical infrastructure asset to which SOCI Act Part 2B applies.

The same event can therefore require a Cyber Security Act ransomware payment report and a SOCI Act Part 2B cyber security incident report. The triggers differ: the Cyber Security Act report follows a payment or benefit tied to an extortion demand, while SOCI reporting turns on the incident's impact on a covered asset. One report does not replace the other. For SOCI, a significant impact on availability uses the test in section 30BEA; other reportable incidents use the broader relevant impact concept, which includes availability, integrity, reliability, and specified confidentiality impacts.

Keep the smart-device product regime outside the SOCI overlap analysis. Cyber Security Act Part 2 applies to relevant connectable products and product supply obligations. The SOCI overlap concerns critical infrastructure assets, responsible entities, SOCI Part 2B incident notification, and Cyber Security Act ransomware payment reporting.

A manufacturer or supplier may have smart-device duties for a relevant connectable product even when it is not the responsible entity for a SOCI asset. Conversely, a SOCI responsible entity can have ransomware reporting exposure even when the incident is not about placing a smart device on the Australian market.

Keep a short overlap record covering the asset, entity, incident, and payment analysis. Record which asset was affected, why SOCI Part 2B did or did not apply, who the responsible entity was, whether a ransomware payment was made, when each reporting clock started, and which report fields could be completed within each window.

If the same event also touches a connected product, keep that product compliance file separate so SOCI incident triage is not confused with smart-device security-standard evidence.

Manufacturers must make an in-scope relevant connectable product in line with the applicable security standard when the product is in the covered class and the manufacturer is aware, or could reasonably be expected to be aware, that it will be acquired in Australia in the specified circumstances. The Smart Devices Rules target consumer-grade relevant connectable products, with listed exclusions for desktops and laptops, tablets, smartphones, therapeutic goods, road vehicles, and road vehicle components.

Suppliers must not supply a non-compliant covered product in Australia when they are aware, or could reasonably be expected to be aware, that it will be acquired in Australia in the specified circumstances. Suppliers must also supply the product with a statement of compliance and retain a copy for the period set by the Rules.

Importers are not given a separate importer-specific duty in the Act or Rules. The Act adopts the Australian Consumer Law meanings of manufacturer and supply, with supplied and supplier taking corresponding meanings. Under that manufacturer definition, a person who imports goods into Australia is a manufacturer where the goods were made outside Australia and the maker does not have a place of business in Australia. An importer may also be a supplier if its conduct meets the adopted supply definition. Record each role separately; an overseas purchase or logistics movement alone does not settle the answer.

The timing boundary also matters. Part 2 applies to relevant connectable products manufactured on or after 29 November 2025 or supplied in Australia on or after that date, except second-hand goods. Part 2 and Schedule 1 of the Smart Devices Rules commenced on 4 March 2026.

Keep records that show why the product and actor were placed inside or outside the smart-device obligations. Use a product-scope file, a role file, a security-standard file, and a statement-of-compliance file. A generic compliance memo does not capture those separate decisions.

The statement of compliance must be prepared by, or on behalf of, the manufacturer and include the product type and batch identifier, manufacturer and authorised representative details, compliance declarations, defined support period, signatory details, and place and date of issue. Both manufacturers and suppliers must retain a copy for the Rules' five-year period.

Escalate cases where the supply-chain label does not answer the legal-role test. An offshore OEM, Australian distributor, online marketplace seller, local importer, and reseller may each need a separate manufacturer-or-supplier assessment based on who meets the adopted statutory definition, who supplies in Australia, and who knows or should know the product will be acquired in Australia by a consumer.

Also escalate products near the Rules' scope boundary: bundled products, accessories with their own connection capability, consumer energy resources, business devices that may still be consumer acquisitions, and excluded product categories. Do not use ransomware reporting or Security of Critical Infrastructure Act workflows as substitutes for the smart-device product duties; those are separate regimes unless the same facts independently trigger them.

First, classify the product. Under the Act, a relevant connectable product is an internet-connectable product or a network-connectable product that is not exempted under the rules. Internet-connectable means capable of connecting to the internet using a communication protocol in the internet protocol suite to send and receive data. Network-connectable covers products that can both send and receive data by electrical or electromagnetic transmission, are not internet-connectable, and meet one of the Act's direct-connection tests. A non-internet-protocol connection must satisfy the detailed multi-product test in section 13(7), subject to the cable and computer-input-product rules in sections 13(8) and 13(9).

Next, apply the Smart Devices Rules. The current security standard covers relevant connectable products intended by the manufacturer to be used, or of a kind likely to be used, for personal, domestic, or household use or consumption. The specified circumstance is that the product will be acquired in Australia by a consumer. The Rules use section 3 of the Australian Consumer Law: goods costing no more than the current $100,000 threshold can qualify, as can higher-priced goods ordinarily acquired for personal, domestic, or household use and certain vehicles or trailers. The test excludes goods acquired for re-supply and goods acquired to be used up or transformed in trade or commerce during production, manufacture, repair, or treatment of other goods or fixtures. A business purchase is not automatically outside scope. The vehicle-or-trailer consumer limb does not override the Smart Devices Rules' separate exclusion for road vehicles and road vehicle components.

Check timing separately. Part 2 applies to a relevant connectable product manufactured on or after 29 November 2025, or supplied in Australia on or after that date other than as second-hand goods. The operative product class and security standard in Part 2 and Schedule 1 of the Smart Devices Rules commenced on 4 March 2026.

The Smart Devices Rules do not prescribe the current security standard for every connected product. Even when a product is a relevant connectable product and looks consumer-facing, section 8 excludes six product groups from the consumer-grade class.

The excluded groups are desktop computers or laptops, tablet computers, smartphones, therapeutic goods within the meaning of the Therapeutic Goods Act 1989, road vehicles within the meaning of the Road Vehicle Standards Act 2018, and road vehicle components within the meaning of that Act.

Keep enough evidence to re-run the answer without relying on memory. The record should show why the product is, or is not, a relevant connectable product; why it is, or is not, consumer-grade; whether an exclusion was checked; and whether the Australian consumer acquisition circumstance is present.

For products that are in scope, keep the downstream compliance records with the scope file. The Act and Rules tie covered products to manufacturer and supplier duties, statement-of-compliance records, password requirements, security-issue reporting information, and defined support-period publication. Only the five-year statement retention period is prescribed here; the broader scope file is a practical record rather than a separately prescribed retention duty.