We use privacy-by-default, cookieless analytics.

Optional analytics cookies are used only if you accept them.

Read our Terms of Use and Privacy Policy.

Applicability guideAustraliaSmart device scope

Australia Cyber Security Act Smart device applicability and product scope

A product enters the smart-device security regime only if it is a , falls within the -grade class, avoids the listed exclusions, and is expected to be acquired in Australia by a consumer.

The output should be a product-scope record that product, legal, security, and supply-chain teams can connect to the statement of compliance and launch evidence.

Back to main artifactReview sources
Author
Sorena AI
Published
May 9, 2026
Updated
Oct 15, 2026
4 sections6 primary sources
Overview

Australia's Cyber Security Act 2024 does not make every connected device subject to the smart-device security standard. First decide whether the item is a . Part 2 applies when that product was manufactured on or after 29 November 2025 or supplied in Australia, other than as second-hand goods, on or after that date. The operative standard, which commenced on 4 March 2026, then covers -grade products that will be acquired in Australia by a consumer, subject to the listed exclusions.

Section 1

Start with the Act's relevant connectable product test

A product can only move into the Smart Devices Rules if it is a under Part 2 of the Cyber Security Act 2024. That means the product must be an internet-connectable product or a network-connectable product, and it must not be exempted under the rules.

For product reviews, treat direct internet connectivity, indirect network connectivity, companion-device connectivity, and bundled device sets as evidence questions. The Act covers internet-connectable products, network-connectable products, and certain connected input products designed to be used together with a computer, while excluding a product that is merely a wire or cable used to connect another product.

  • Record whether the product can send and receive data over the internet using an internet-protocol communication protocol.
  • If it is not directly internet-connectable, test whether it can send and receive data by electrical or electromagnetic transmission and connect directly to an internet-connectable product.
  • For multi-product kits or peripherals, identify the linking product and whether other wireless input products connect to it as described in the Act.
  • Do not treat a plain cable or wire as in scope merely because it connects other products.
Section 2

Apply the consumer-grade class and listed product exclusions

The Smart Devices Rules prescribe a security standard for . The class is limited to relevant connectable products that the manufacturer intends for personal, domestic or household use or consumption, or that are of a kind likely to be used that way.

The Rules then remove specific product classes even if they otherwise look -grade: desktop computers and laptops, tablet computers, smartphones, therapeutic goods, road vehicles, and road vehicle components. These exclusions should be recorded as product-scope findings, not as informal assumptions.

  • Use the , including labels, instructions, promotional material, sales statements, and product documentation, to support the personal, domestic or household use finding.
  • Check the explicit exclusion list before assigning smart-device controls to complex electronics, medical or therapeutic goods, vehicles, or vehicle components.
  • For products with companion applications, include the hardware, internal software, pre-installed software, and device external software in the scope evidence.
  • For energy resources such as rooftop solar inverters or small-scale batteries, do not assume exclusion only because the product connects to energy infrastructure; the explanatory material says consumer energy resources are within the reform scope.
Section 3

Check the Australian consumer acquisition circumstance

The Schedule 1 security standard applies to a -grade only when it will be acquired in Australia by a consumer. The Rules adopt section 3 of the Australian Consumer Law. That test can cover goods priced at no more than the prescribed $100,000 amount or goods ordinarily acquired for personal, domestic or household use, including some business purchases. It excludes goods acquired for resale and goods acquired for specified use-up or transformation in production, manufacture, repair, or treatment.

Sales, import, distribution, and channel evidence matter here. The Act's manufacturer and supplier duties turn on whether the entity is aware, or could reasonably be expected to be aware, that the product will be acquired in Australia in the specified circumstances.

  • Keep Australian stock-keeping unit (SKU), listing, distributor, import, reseller, direct-to-, and marketplace evidence with the scope record.
  • For business-facing products, check whether the goods are still acquired as a under the Australian Consumer Law criteria referenced in the explanatory statement.
  • Record the price, ordinary use, buyer purpose, and any resale or production-use exclusion; buyer type and sales channel alone do not settle the test.
  • Use the explanatory statement's examples carefully: smart meters are described as outside scope because they are supplied, installed, and used by electricity retailers, while point-of-sale or contactless payment products can be in scope if the -acquisition criteria are met.
  • Do not rely on a global launch classification if the Australian channel, product bundle, price point, or acquisition route is different.
Section 4

Connect the scope decision to compliance evidence

For an in-scope product, the manufacturer-side record should connect the product to the Schedule 1 security standard: password requirements, a published security-issue reporting mechanism, and a published defined support period for security updates.

The statement-of-compliance evidence should also be prepared early enough for supply decisions. The Rules require the statement to include the product type and batch identifier, manufacturer and authorised representative details, declarations about compliance, the defined support period at the date of issue, signatory details, and the place and date of issue. The Rules set a five-year retention period for statements of compliance.

  • Store the scope conclusion with the source section used, product identifiers, batch or model identifiers, and the Australian acquisition evidence.
  • For in-scope products, attach the password design evidence, vulnerability-reporting publication, and defined support-period publication to the same product file.
  • For out-of-scope products, record the exact reason: not relevant connectable, not -grade, listed exclusion, will not be acquired in Australia by a consumer, or neither of the Act's manufacture and supply application triggers applies.
  • For a second-hand supply, check manufacture date before concluding that Part 2 is outside scope. The second-hand qualification limits the supply trigger in paragraph 13(1)(b), but it does not displace the separate manufacture trigger in paragraph 13(1)(a).
  • Review the scope record when the manufacturer changes intended use, firmware or companion-app architecture, Australian channels, bundles, product claims, or the defined support period.
Recommended next step

Turn the Australian smart-device scope test into product evidence

Connect product classification, Australian acquisition evidence, exclusions, security-standard controls, and statement-of-compliance records in Sorena.

Assessment workflow
Open Assessment Autopilot for Australia Cyber Security Act

Create a product-scope intake for relevant connectable products, consumer-grade use, exclusions, and Australian acquisition evidence.

Explore next step
Research workflow
Review source evidence

Use Research Copilot to trace a smart-device scope answer back to the Act, Rules, and explanatory statement.

Explore next step
Talk to Sorena
Discuss smart-device readiness

Review product scope, statement records, and security-standard evidence for Australian supply.

Explore next step
Primary sources

References and citations

Cyber Security (Security Standards for Smart Devices) Rules 2025
legislation.gov.au4 citations
Referenced sections
  • Primary rules source for the consumer-grade smart-device class, exclusions, Australian consumer acquisition circumstance, security requirements, and statement records.
  • Section 5 of the Rules explains that the smart-device standards apply to products that can directly or indirectly connect to the internet.
  • Section 8 identifies the consumer-grade product class and the six excluded product categories.
Show 1 more
  • Sections 6 and 8 tie the specified circumstance to acquisition in Australia by a consumer.
"consumer grade relevant connectable products"
More quoted passages
"directly or indirectly connect to the internet"
"acquired in Australia by a consumer"
Cyber Security Act 2024
legislation.gov.au4 citations
Referenced sections
  • Primary statutory source for the relevant connectable product definition, manufacturer and supplier duties, statement-of-compliance duty, and Part 2 application rule.
  • Section 13 defines relevant connectable products, internet-connectable products, network-connectable products, and the wire-or-cable exclusion.
  • Sections 15 and 16 use the awareness or reasonable-expectation test for products acquired in Australia in specified circumstances.
Show 1 more
  • Section 13 applies Part 2 to relevant connectable products manufactured after commencement or supplied, other than as second-hand goods, after commencement.
"relevant connectable product"
More quoted passages
"could reasonably be expected to be aware"
"supplied (other than as second hand goods)"
Explanatory Statement to the Smart Devices Rules 2025
legislation.gov.au3 citations
Referenced sections
  • Official explanatory source for product examples, companion-app scope context, consumer-acquisition examples, and policy context for consumer energy resources.
  • The explanatory statement clarifies that a smart-device product is typically the device, internal software, and device external software such as a companion app.
  • The explanatory statement gives smart-meter and contactless-payment examples for applying the consumer acquisition test.
"device external software"
More quoted passages
"smart meters"

Related guides

Australia Compliance Statement Evidence Workflow

Evidence workflow for preparing, supplying, and retaining statements of compliance under Australia's Cyber Security Act 2024 and Smart Devices Rules.

Australia Cyber Security Act 2024 scope and definitions

Scope guide for Australia's Cyber Security Act 2024: relevant connectable products, consumer-grade smart devices, reporting business entities, ransomware payment reports, and SOCI overlap.

Australia Cyber Security Act and SOCI Act overlap

How the Australia Cyber Security Act overlaps with the Security of Critical Infrastructure Act for responsible entities, ransomware payment reporting, smart devices, and evidence records.

Australia Cyber Security Act Applicability Test

Decide whether the Australia Cyber Security Act 2024 applies to a smart-device product, supplier, manufacturer, or ransomware payment reporting scenario.

Australia Cyber Security Act Commencement Timeline

Cyber Security Act 2024 commencement timeline for ransomware reporting, CIRB reviews, smart-device duties, statement retention, and statutory review.

Australia Cyber Security Act Compliance Checklist

Concrete checklist items for Australian Cyber Security Act smart-device and ransomware duties, with SOCI and APRA CPS 234 evidence checks.

Show all related guides (29)

Australia Cyber Security Act Compliance Guide

A cited compliance guide for Australia Cyber Security Act smart-device statements, ransomware payment reporting, incident coordination, and review-board readiness.

Australia Cyber Security Act Deadlines and Calendar

Cyber Security Act 2024 dates and event-driven deadlines for ransomware payment reports, smart-device duties, records, notices, and statutory review.

Australia Cyber Security Act FAQ

Answers to Australia Cyber Security Act questions on smart device scope, statements of compliance, ransomware reports, enforcement notices, and incident review.

Australia Cyber Security Act penalties and fines

Cyber Security Act 2024 civil penalties explained by section, including ransomware reports, protected information, CIRB notices, and smart-device enforcement.

Australia Cyber Security Act Requirements

Australia Cyber Security Act requirements for smart-device security standards, statements of compliance, ransomware payment reports, notices, and evidence records.

Australia Cyber Security Act Statement of Compliance Evidence

Evidence guide for Australia Cyber Security Act smart-device statements of compliance: required fields, manufacturer and supplier records, five-year retention, and examination readiness.

Australia Cyber Security Act templates

Source-backed field lists for Australia Cyber Security Act smart-device scope, statements of compliance, ransomware reports, notices, SOCI overlap, and records.

Australia Cyber Security Act vs EU Cyber Resilience Act

Compare Australia's Cyber Security Act 2024 with the EU Cyber Resilience Act across smart-device duties, ransomware reporting, product-with-digital-elements scope, actors, records, and enforcement routes.

Australia Cyber Security Act vs UK PSTI Act Guide

Compare Australia's Cyber Security Act 2024 smart-device, ransomware, and SOCI-adjacent obligations with the UK's PSTI connected-product regime.

Australia ransomware payment reporting 72-hour duty

Explain when Australia's Cyber Security Act 2024 requires a ransomware payment report, when the 72-hour clock starts, and what information the report must contain.

Australia Ransomware Payment Reporting Workflow

Operational workflow for Australia Cyber Security Act 2024 ransomware payment reports: scope, 72-hour trigger, report fields, owners, evidence, and cited Act and Rules sources.

Australia Smart Device Applicability Workflow

Decide whether Australia's mandatory smart-device security standard applies, including commencement, connectivity, consumer use, exclusions, roles, and evidence.

Australia Smart Device Compliance Statement

What a smart-device statement of compliance must contain under Australia's Cyber Security Act 2024 and Smart Devices Rules, who prepares and supplies it, how long to retain it, and how to prepare for examination.

Australia Smart Device Security Standards under the Cyber Security Act

Plain-English guide to Australia's Cyber Security (Security Standards for Smart Devices) Rules 2025: scope, passwords, vulnerability reporting, support periods, statements of compliance, and evidence records.

Cyber Security Act 2024 Smart Device Compliance Checklist

Checklist for Australia Cyber Security Act 2024 smart-device scope, password controls, vulnerability reporting, security-update support periods, statements of compliance, retention, and evidence.

SOCI overlap triage workflow for Australia Cyber Security Act

Triage SOCI Act overlap with Australia Cyber Security Act ransomware reporting and smart-device standards using separate owners, evidence, and cited scope checks.

Australia Cyber Security Act recordkeeping FAQ

What records to keep for Cyber Security Act 2024 smart-device statements, ransomware payment reports, and supported SOCI or APRA overlap checks.

Australia Ransomware Payment Reporting: Threshold and Report Content

FAQ answer on Australia's Cyber Security Act ransomware payment reporting scope, $3 million turnover threshold, 72-hour trigger, report fields, and evidence.

Cyber Security Act 2024 Statements of Compliance FAQ

Australian smart-device statements of compliance: covered products, responsible actors, required contents, supporting evidence, and five-year retention.

How do notices and recalls work under the Australia Cyber Security Act?

FAQ on Australia Cyber Security Act compliance notices, stop notices, recall notices, public notifications, owners, evidence fields, and cited timing.

How does the Australia Cyber Security Act overlap with the SOCI Act?

FAQ on when Australia Cyber Security Act ransomware reporting overlaps with SOCI critical infrastructure assets, responsible entities, and smart-device duties.

Manufacturer, Importer, and Supplier Duties under Australia's Cyber Security Act 2024

Cyber Security Act 2024 smart-device duties for manufacturers, importers, and suppliers, including role tests, scope, statements, and records.

Which smart devices are in scope under Australia's Cyber Security Act 2024?

FAQ on Cyber Security Act 2024 smart-device scope: relevant connectable products, consumer-grade criteria, exclusions, Australian consumer acquisition, and records to keep.