Australia Cyber Security Act Smart Device Statement of Compliance

The statement duty sits in Part 2 of the Cyber Security Act 2024. Part 2 applies to a relevant connectable product manufactured on or after 29 November 2025, or supplied other than as second-hand goods on or after that date. The prescribed smart-device standard and statement requirements commenced on 4 March 2026.

The Smart Devices Rules prescribe a security standard for consumer-grade relevant connectable products: products intended by the manufacturer to be used, or of a kind likely to be used, for personal, domestic, or household use or consumption, excluding listed product categories such as desktop and laptop computers, tablets, smartphones, therapeutic goods, road vehicles, and road vehicle components. The official explanatory statement gives smart TVs, smart watches, home assistants, baby monitors, and consumer energy resources as examples. Those examples explain the class but do not replace the Rules' product-specific connectivity, intended-use, acquisition, awareness, date, and exclusion tests.

The Rules use the Australian Consumer Law acquisition test. A consumer can be an individual or business where the goods cost no more than the current $100,000 threshold or are ordinarily acquired for personal, domestic, or household use, subject to the separate vehicle-or-trailer limb and exclusions for acquisitions such as resupply or use up or transformation in production, manufacture, repair, or treatment.

For an in-scope product, the manufacturer must provide a statement for supply in Australia if it is aware, or could reasonably be expected to be aware, that the product will be acquired in Australia by a consumer. A supplier must supply the product with the statement when the same awareness condition is met.

The Smart Devices Rules specify mandatory statement fields for consumer-grade relevant connectable products.

The statement must identify the product and batch and give the name and address of the manufacturer and relevant authorised representatives. It must declare that it was prepared by or on behalf of the manufacturer and include the manufacturer's opinion that the product was manufactured in compliance with the security standard and that the manufacturer complied with the standard's other obligations.

The statement must also include the product's defined support period at the date of issue, plus the signature, name, and function of the manufacturer's signatory and the place and date of issue. The Rules prescribe the information, not an official government certificate, fixed layout, or mandatory wording beyond the required declarations.

Section 9 requires one authorised representative's name and address, plus each other authorised representative in Australia if any. It does not define authorised representative or prescribe an appointment form. Record the appointment basis and seek case-specific advice if the manufacturer has no representative rather than treating the field as optional.

The Act requires both the manufacturer and supplier, where the statement duty applies to them, to retain a copy of the statement for the period specified in the rules. For statements of compliance with the consumer-grade smart-device security standard, the Smart Devices Rules set that period at five years.

Section 10 of the Rules specifies a five-year period but does not state how to calculate its start date. Record a conservative retention start and end date with counsel rather than implying that the Rules prescribe a particular starting event.

Tie the record to the exact product type and batch identifier used in the statement. Keep it with evidence for the manufacturer's security-standard position, defined support period publication, security-issue reporting process, and supply-chain handoff so a reviewer can connect the signed statement to the product supplied in Australia.

The Act says the supplier must supply the product with the statement, but neither the Act nor the Rules prescribe a delivery medium. The explanatory statement says a physical statement is not required at the point of sale and that entities may provide or publish it. Record the delivery method used for each supply channel; public availability alone should not be treated as conclusive proof of the supplier's duty without case-specific analysis.

The Cyber Security Act 2024 allows the Secretary to engage an appropriately qualified and experienced expert to conduct an independent examination of a product where an entity must comply with section 15 or 16 obligations. The examination can assess whether the product complies with the security standard, whether the statement complies with section 16 requirements, or both.

For examination readiness, keep the statement retrievable together with the product identifier, manufacturer details, Australian supplier details, support-period publication evidence, and the technical evidence that supports password, security-issue reporting, and security-update support-period controls.

If a written request is made for examination, the Act says the notice may request the product, the statement of compliance, or both, and must specify matters such as the product, the manufacturer if known, the period for providing the item, the period of retention for testing, the security-standard requirements to be tested, the testing or analysis to be done, and what may happen if the entity does not comply.