Australia smart device security standards

Start with product scope. The Rules cover relevant connectable products that are intended by the manufacturer for personal, domestic or household use or consumption, or are of a kind likely to be used that way, where the product will be acquired in Australia by a consumer.

The consumer test comes from section 3 of the Australian Consumer Law. It can include a business buyer, including where the price does not exceed the current $100,000 threshold, unless a statutory exclusion such as acquisition for resupply or use up or transformation in production applies. Record the actual acquisition facts instead of treating retail and business labels as decisive.

Do not treat every connected product as covered. The Rules exclude desktop computers and laptops, tablet computers, smartphones, therapeutic goods, road vehicles, and road vehicle components.

Part 2 applies to a relevant connectable product manufactured on or after 29 November 2025 or supplied in Australia, other than as second-hand goods, on or after that date. A second-hand supply can still involve a product captured by the separate manufacture trigger.

Section 15 also contains a narrow constitutional exception for requirements that do not relate to internet or like-service connection, use, or protection. It applies only where the entity is neither a constitutional corporation nor acting in interstate, Territory, or international trade or commerce. Do not assume a small or unincorporated manufacturer is exempt without applying those conditions to the particular requirement.

For covered products with password functionality, passwords used with covered hardware and software must either be unique per product or defined by the user. The rule applies to product hardware when not in the factory default state, pre-installed software when not in the factory default state, and software that must be installed for all manufacturer-intended purposes that use covered hardware or software. The Rules' definition of password excludes cryptographic keys, personal identification numbers used for pairing over communication protocols outside the internet protocol suite, and application programming interface keys.

A unique-per-product password cannot be a simple sequence, public-information derivative, or plain serial-number derivative. If it is based on a unique product identifier such as a serial number, the Rules require an encryption method or keyed hashing algorithm accepted as good industry practice.

Manufacturers of covered products must publish information on how a person can report security issues for the product's hardware, pre-installed software, required software for intended purposes, and software used for or in connection with the manufacturer's intended purposes.

The publication must include at least one point of contact, plus when the reporter will receive acknowledgement of receipt and status updates until the reported security issues are resolved. The information must be accessible, clear, transparent, in English, free of charge, available without a prior request, and available without requesting personal information just to access the reporting information.

Manufacturers must publish the defined support period for security updates for covered product hardware and software that can receive security updates. The defined support period is the period, expressed as a period of time with an end date, during which security updates will be provided by or on behalf of the manufacturer.

The publication must be accessible, clear, transparent, in English, free of charge, available without prior request or a request for personal information, and understandable without prior technical knowledge. Once published, the defined support period must not be shortened. If it is extended, the new support period must be published as soon as practicable. For manufacturer-controlled websites that offer the product, the support-period information must be prominently published with consumer purchase information and given equal prominence where the product's main characteristics are published.

For covered products, the statement of compliance must be prepared by or on behalf of the manufacturer. It must identify the product type and batch identifier, manufacturer and authorised representative details, the compliance declarations, the defined support period at issue date, signatory details, and the place and date of issue.

The Rules set a five-year retention period for statements of compliance made for the consumer-grade relevant connectable product standard. Pair that retained statement with the technical and publication evidence that supports the manufacturer's declarations.