Australia Cyber Security Act Statement of Compliance Evidence
For consumer-grade relevant connectable products, the evidence record should prove that the right product is in scope, the manufacturer prepared the statement, the required statement fields are complete, and the manufacturer or supplier can retain and produce the statement.
Structure records for product launches, imports, supplier onboarding, retailer checks, and a request by the Secretary to provide the product, statement, or both for examination.
Australia's Cyber Security Act 2024 requires manufacturers and suppliers to handle a for each when the regulated class, awareness, and Australian consumer-acquisition conditions are met. The Smart Devices Rules set the statement fields and a five-year retention period for consumer-grade relevant connectable products. The requirements commenced on 4 March 2026.
1
Section 1
What statement-of-compliance evidence is in scope?
Keep this evidence file focused on Part 2 smart-device duties, not ransomware reporting, critical-infrastructure obligations, privacy breach records, or general cyber controls. Part 2 applies to a manufactured on or after 29 November 2025 or supplied other than as second-hand goods on or after that date. The statement trigger also requires the consumer-grade class, Australian acquisition by a consumer, and the Act's awareness condition. The official explanatory statement gives smart TVs, smart watches, home assistants, baby monitors, and consumer energy resources as examples, but the binding Act and Rules still require a product-specific connectivity, intended-use, acquisition, awareness, date, and exclusion analysis.
For this purpose, the Rules use the Australian Consumer Law acquisition test. A consumer can be an individual or business where the goods cost no more than the current $100,000 threshold or are ordinarily acquired for personal, domestic, or household use, subject to the separate vehicle-or-trailer limb and exclusions for acquisitions such as resupply or use up or transformation in production, manufacture, repair, or treatment.
The minimum evidence set should connect one product type and batch identifier to the manufacturer, the named in the statement, any other authorised representatives in Australia, the applicable security standard, the manufacturer's compliance opinion, the at issue, and the signed place and date of issue. Section 9 requires one authorised representative and separately asks for each other Australian representative, if any; it does not state an exception for a manufacturer with none.
Record the product type, batch identifier, model or SKU, intended consumer use, and any scope exclusion considered.
Identify whether the business is acting as manufacturer, supplier, importer, distributor, retailer, or marketplace for the Australian supply.
Keep the statement prepared by or on behalf of the manufacturer with the product launch or supplier onboarding record.
Store the statement beside the password, vulnerability-reporting, and defined-support-period evidence used to support the manufacturer's declaration.
Which statement fields should the evidence pack prove?
Build the evidence pack around each statement field specified by the Smart Devices Rules.
For each statement, capture the source record that proves the field value, the person who approved it, and the version of product or support-period information used when the statement was issued.
Product identifiers: product type, batch identifier, model references, and the internal release or purchase-order record that links them.
Entity details: manufacturer name and address; the name and address of an ; and the name and address of each other authorised representative in Australia, if any. Treat only the "other" Australian-representative field as expressly conditional on the face of section 9.
Declarations: confirmation that the statement was prepared by or on behalf of the manufacturer and records supporting the manufacturer's compliance opinion.
Support-period field: the for security updates at the date of issue, with evidence that the period was published and not shortened.
Execution fields: signature, signatory name and function, place of issue, date of issue, and approval workflow record.
What technical evidence should support the manufacturer's declaration?
The statement says whether, in the manufacturer's opinion, the product was manufactured in compliance with the security standard and whether the manufacturer met the other obligations in that standard. That opinion should be backed by technical records for the three security-standard areas in Schedule 1.
The Rules require publication of the security-issue reporting information and , but they do not require the supporting technical file itself to be public. Product security, legal, compliance, and supplier-management reviewers should be able to use that file to explain why the statement was accepted.
Password evidence: configuration records showing passwords are user-defined or unique per product. For unique-per-product passwords, show that they do not use incremental counters or public information; document an accepted encryption or keyed-hashing method if a unique product identifier is used; and show that they are not otherwise unacceptably guessable.
Security-issue reporting evidence: the published reporting contact, acknowledgement and status-update timing, and proof that the information is accessible without prior request, in English, free of charge, and without requiring personal information.
Security-update evidence: the expressed with an end date, publication proof, and controls preventing unsupported shortening.
Release evidence: product firmware, companion app, software dependency, test, and approval records aligned to the batch or version named in the statement.
Exception evidence: a documented reason when a device, component, or software item is outside the covered consumer-grade smart-device class.
How long should manufacturers and suppliers retain records, and how should they prepare for examination?
For consumer-grade relevant connectable products covered by the Smart Devices Rules, the statement-of-compliance retention period is five years. The Act applies retention duties to both the manufacturer that provides the statement and the supplier that supplies the product with it. Section 10 does not specify the event from which the five years is calculated, so the record should document its retention calculation.
The Secretary may arrange an independent examination of the product, the statement, or both. Keep evidence retrievable by product and batch so the business does not have to rebuild the file after a request arrives.
Manufacturer record: final statement, source technical file, signatory authority, defined-support-period evidence, issue date, and any authorised-representative details.
Supplier record: copy of the statement received, product and batch mapping, Australian supply channel, supplier acceptance check, and retention owner.
Retailer or distributor record: supplier communication, system field showing statement availability, and escalation route when a statement is missing or incomplete.
Five-year clock: retain the statement for the period specified in the Rules and avoid deleting supplier/manufacturer copies during product, vendor, or system migrations.
Examination pack: product sample or location, statement copy, manufacturer identity, tested security-standard requirements, and contact for notices or regulator requests.
Current official explanation of the Australian Consumer Law acquisition test, including business purchases, the $100,000 threshold, and acquisition exclusions.
Official explanatory material supplies representative examples of consumer-grade smart devices; the binding Act and Rules still control classification.