Australia Cyber Security Act notices and recalls

A compliance notice can be issued by the Secretary when an entity that must comply with section 15 or 16 is not complying, or when information suggests possible non-compliance. A response record should start with the product, the relevant connectable product class, the security-standard requirement, the manufacturer or supplier role, and the specific section 15 or 16 obligation at issue.

A stop notice is the next escalation. It depends on a prior compliance notice and the Secretary being reasonably satisfied that the compliance notice was not met or that attempted remediation was inadequate.

A recall notice is a further escalation after a stop notice. It can be issued where the stop notice was not met or remediation remains inadequate for the same section 15 or 16 non-compliance.

Yes. An entity may apply in writing to the Secretary for internal review of a decision to give or vary a compliance, stop, or recall notice. The application must be made within 30 days after the notice is given. Within 30 days after receiving the application, the decision-maker must review the decision and affirm, vary, or revoke it, then provide written reasons as soon as practicable.

The Secretary may also vary a notice to correct an error, defect, or ambiguity, or to address the non-compliance adequately. Before a variation, the entity must receive at least 10 days to make representations. The Secretary may revoke a notice if no longer satisfied that the grounds for issuing it were met. Once a notice for a particular non-compliance or possible non-compliance is revoked under section 21, no further Part 2 notices may be issued for that same non-compliance.

A recall notice must identify the entity, give brief details of the non-compliance, and specify the action the entity must take. The action can require the entity to stop the product being acquired in Australia, stop the product being supplied to suppliers for supply in Australia, or arrange return of the product to the entity or to the manufacturer.

The notice must also specify a reasonable period for the action. If the Secretary considers it appropriate, the notice can also specify a reasonable period for the entity to provide evidence that the action was taken. The notice must explain what may happen if the entity does not comply and how the entity may seek review.

If an entity fails to comply with a recall notice, the Minister may publish information on the Department's website or another way the Minister considers appropriate. The Act lists the identity of the entity, product details, non-compliance details, and risks posed by the product relating to the non-compliance.

The 2025 Smart Devices Rules add that the public notification may include details of the recall notice and actions consumers are recommended to consider, such as destroying the product or taking extra precautions when using it.

Yes. If an entity has a section 15 or 16 obligation for a relevant connectable product, the Secretary may engage an appropriately qualified and experienced expert to examine whether the product complies with the security standard, whether its statement of compliance meets section 16, or both.

For that examination, the Secretary may request the product, the statement, or both in writing. The request must identify the product, identify the manufacturer if known when the recipient is not the manufacturer, set a reasonable response period, describe the retention period and testing requirements for the product, explain the kind of testing or analysis, and explain possible consequences of non-compliance. The Commonwealth must pay reasonable compensation for complying with the request.