Cyber Security Act 2024 manufacturer, importer, and supplier duties

Manufacturers must make an in-scope relevant connectable product in line with the applicable security standard when the product is in the covered class and the manufacturer is aware, or could reasonably be expected to be aware, that it will be acquired in Australia in the specified circumstances. The Smart Devices Rules target consumer-grade relevant connectable products, with listed exclusions for desktops and laptops, tablets, smartphones, therapeutic goods, road vehicles, and road vehicle components.

Suppliers must not supply a non-compliant covered product in Australia when they are aware, or could reasonably be expected to be aware, that it will be acquired in Australia in the specified circumstances. Suppliers must also supply the product with a statement of compliance and retain a copy for the period set by the Rules.

Importers are not given a separate importer-specific duty in the Act or Rules. The Act adopts the Australian Consumer Law meanings of manufacturer and supply, with supplied and supplier taking corresponding meanings. Under that manufacturer definition, a person who imports goods into Australia is a manufacturer where the goods were made outside Australia and the maker does not have a place of business in Australia. An importer may also be a supplier if its conduct meets the adopted supply definition. Record each role separately; an overseas purchase or logistics movement alone does not settle the answer.

The timing boundary also matters. Part 2 of the Act applies to relevant connectable products manufactured on or after 29 November 2025, or supplied other than as second-hand goods on or after that date. The second-hand exclusion applies to the supply limb; a product manufactured on or after that date may still meet the manufacture limb. Part 2 and Schedule 1 of the Smart Devices Rules commenced on 4 March 2026.

Keep records that show why the product and actor were placed inside or outside the smart-device obligations. Use a product-scope file, a role file, a security-standard file, and a statement-of-compliance file. A generic compliance memo does not capture those separate decisions.

The statement of compliance must be prepared by, or on behalf of, the manufacturer and include the product type and batch identifier, manufacturer and authorised representative details, compliance declarations, defined support period, signatory details, and place and date of issue. Both manufacturers and suppliers must retain a copy for the Rules' five-year period.

Escalate cases where the supply-chain label does not answer the legal-role test. An offshore original equipment manufacturer (OEM), Australian distributor, online marketplace seller, local importer, and reseller may each need a separate manufacturer-or-supplier assessment based on who meets the adopted statutory definition, who supplies in Australia, and who knows or should know the product will be acquired in Australia by a consumer.

Also escalate products near the Rules' scope boundary: bundled products, accessories with their own connection capability, consumer energy resources, business devices that may still be consumer acquisitions, and excluded product categories. Do not use ransomware reporting or Security of Critical Infrastructure Act workflows as substitutes for the smart-device product duties; those are separate regimes unless the same facts independently trigger them.