Cyber Security Act 2024 Smart Device Scope

First, classify the product. Under the Act, a relevant connectable product is an internet-connectable product or a network-connectable product that is not exempted under the rules. Internet-connectable means capable of connecting to the internet using a communication protocol in the internet protocol suite to send and receive data. Network-connectable covers products that can both send and receive data by electrical or electromagnetic transmission, are not internet-connectable, and meet one of the Act's direct-connection tests. A non-internet-protocol connection must satisfy the detailed multi-product test in section 13(7), subject to the cable and computer-input-product rules in sections 13(8) and 13(9).

Next, apply the Smart Devices Rules. The current security standard covers relevant connectable products intended by the manufacturer to be used, or of a kind likely to be used, for personal, domestic, or household use or consumption. The specified circumstance is that the product will be acquired in Australia by a consumer. The Rules use section 3 of the Australian Consumer Law: goods costing no more than the current $100,000 threshold can qualify, as can higher-priced goods ordinarily acquired for personal, domestic, or household use and certain vehicles or trailers. The test excludes goods acquired for re-supply and goods acquired to be used up or transformed in trade or commerce during production, manufacture, repair, or treatment of other goods or fixtures. A business purchase is not automatically outside scope. The vehicle-or-trailer consumer limb does not override the Smart Devices Rules' separate exclusion for road vehicles and road vehicle components.

Check timing separately. Part 2 applies to a relevant connectable product manufactured on or after 29 November 2025, or supplied in Australia on or after that date other than as second-hand goods. The operative product class and security standard in Part 2 and Schedule 1 of the Smart Devices Rules commenced on 4 March 2026.

The Smart Devices Rules do not prescribe the current security standard for every connected product. Even when a product is a relevant connectable product and looks consumer-facing, section 8 excludes six product groups from the consumer-grade class.

The excluded groups are desktop computers or laptops, tablet computers, smartphones, therapeutic goods within the meaning of the Therapeutic Goods Act 1989, road vehicles within the meaning of the Road Vehicle Standards Act 2018, and road vehicle components within the meaning of that Act.

Keep enough evidence to re-run the answer without relying on memory. The record should show why the product is, or is not, a relevant connectable product; why it is, or is not, consumer-grade; whether an exclusion was checked; and whether the Australian consumer acquisition circumstance is present.

For products that are in scope, keep the downstream compliance records with the scope file. The Act and Rules tie covered products to manufacturer and supplier duties, statement-of-compliance records, password requirements, security-issue reporting information, and defined support-period publication. Only the five-year statement retention period is prescribed here; the broader scope file is a practical record rather than a separately prescribed retention duty.