Cyber Security Act 2024 manufacturer, importer, and supplier duties

Manufacturers must make an in-scope relevant connectable product in line with the applicable security standard when the product is in the covered class and the manufacturer is aware, or could reasonably be expected to be aware, that it will be acquired in Australia in the specified circumstances. The Smart Device Rules target consumer-grade relevant connectable products, with listed exclusions for desktops and laptops, tablets, smartphones, therapeutic goods, road vehicles, and road vehicle components.

Suppliers must not supply a non-compliant covered product in Australia when they are aware, or could reasonably be expected to be aware, that it will be acquired in Australia in the specified circumstances. Suppliers must also supply the product with a statement of compliance and retain a copy for the period set by the Rules.

Importers are not given a separate importer-specific duty label in the cited Act and Rules. Treat an importer as in scope when its facts also make it a manufacturer or a supplier, such as importing a covered consumer-grade smart device for supply in Australia. Keep the role analysis explicit instead of assuming that every overseas purchase, distributor, or logistics movement is automatically covered.

Keep records that show why the product and actor were placed inside or outside the smart-device obligations. The useful evidence set is a product-scope file, a role file, a security-standard file, and a statement-of-compliance file, not a generic compliance memo.

The statement of compliance should be prepared by, or on behalf of, the manufacturer and include the product type and batch identifier, manufacturer and authorised representative details, compliance declarations, defined support period, signatory details, and place and date of issue. Both manufacturers and suppliers should be able to retrieve the statement for the Rules' five-year retention period.

Escalate cases where the supply-chain label does not match the legal role. An offshore OEM, Australian distributor, online marketplace seller, local importer, and reseller may each need a separate manufacturer-or-supplier assessment based on who manufactures, who supplies in Australia, and who knows or should know the product will be acquired in Australia by a consumer.

Also escalate products near the Rules' scope boundary: bundled products, accessories with their own connection capability, consumer energy resources, business devices that may still be consumer acquisitions, and excluded product categories. Do not use ransomware reporting or Security of Critical Infrastructure Act workflows as substitutes for the smart-device product duties; those are separate regimes unless the same facts independently trigger them.