Australia Cyber Security Act Smart Device Applicability Workflow

Start the workflow when a team plans to manufacture, import, distribute, list, relabel, materially redesign, or continue supplying a connected product for the Australian market. Part 2 of the Act applies to a relevant connectable product manufactured on or after 29 November 2025, or supplied other than as second-hand goods on or after that date. The prescribed smart-device standard and statement requirements commenced on 4 March 2026.

Record both manufacture and Australian supply dates before testing product scope. A product manufactured before Part 2 commenced can still enter the workflow when it is supplied other than as second-hand goods after commencement and the prescribed class and acquisition conditions are met.

First decide whether the item is a relevant connectable product. The Act covers an internet-connectable product and defined network-connectable products. The network test includes products that connect directly to an internet-connectable product using an internet-protocol communication, and certain products that can connect directly to two or more products at the same time and to an internet-connectable product using a non-internet-protocol communication. Wires or cables used merely to connect products do not meet that latter test.

If the product is a relevant connectable product, apply the class prescribed by the Smart Devices Rules. The covered class is intended by the manufacturer to be used, or is of a kind likely to be used, for personal, domestic, or household use or consumption. The specified circumstance is acquisition in Australia by a consumer, using the Australian Consumer Law meaning of consumer. Record the manufacturer's intended purpose from labels, instructions, promotional material, sales material, and statements.

The Australian Consumer Law test can include a business buyer. The current monetary limb covers goods priced at no more than $100,000, while goods ordinarily acquired for personal, domestic, or household use can qualify regardless of price. Specified acquisitions for resupply or for use up or transformation in production, manufacture, repair, or treatment are excluded. Apply the transaction facts as well as the product's market.

Product names do not determine scope. A product that looks consumer-facing can still fall outside the standard if it belongs to an excluded group. The explanatory statement discusses smart TVs, smart watches, home assistants, baby monitors, and consumer energy resources as examples considered for the standard.

When the product is in scope, split the workflow by statutory role. A manufacturer must manufacture the product in compliance with the standard when it is aware, or could reasonably be expected to be aware, that the product will be acquired in Australia by a consumer. The manufacturer must also comply with the standard's other manufacturer requirements. A supplier must not supply a non-compliant covered product in Australia when the same awareness test is met.

Section 15 contains a limited constitutional exception for requirements outside internet or like-service connection, use, or protection where the entity is neither a constitutional corporation nor acting in interstate, Territory, or international trade or commerce. Record case-specific advice before using this exception; entity size or an unincorporated structure alone does not establish it.

Keep statement-of-compliance work in the same applicability record. A supplier must supply the product in Australia with a statement that meets the Rules. The statement must be prepared by, or on behalf of, the manufacturer and include the product type and batch identifier, manufacturer and authorised-representative details, compliance declarations, defined support period, signatory details, and place and date of issue.

After classifying a consumer-grade relevant connectable product as covered, security engineering and product operations must check the three Schedule 1 control areas: passwords, security-issue reporting, and defined support periods for security updates.

For website listings controlled by the manufacturer, the support-period check should be linked to the publication workflow. The explanatory statement says a consumer should not need to navigate unnecessarily or know about the Act, Rules, or Schedule to discover the defined support period.

Re-run the workflow when a product line changes enough to affect connectivity, intended purpose, consumer acquisition, exclusions, manufacturer identity, supplier channel, statement contents, password design, vulnerability reporting, or support-period publication. A prior answer for one batch or model should not be reused where the facts that support the statement of compliance have changed.

Escalation should be concrete. Product counsel should resolve statutory scope issues, security engineering should resolve control evidence, channel operations should resolve supply facts, and compliance should block release where the statement or publication evidence is missing for an in-scope product.