Statement of compliance evidence workflow

Start with a product-scope record. Record whether the product was manufactured on or after 29 November 2025 or will be supplied other than as second-hand goods on or after that date, whether it is internet-connectable or network-connectable, whether it will be acquired in Australia by a consumer, and whether the manufacturer or supplier is aware or could reasonably be expected to be aware of that circumstance.

For the Smart Devices Rules, the covered class is consumer-grade relevant connectable products intended, or likely, for personal, domestic, or household use or consumption. The official explanatory statement gives smart TVs, smart watches, home assistants, baby monitors, and consumer energy resources as examples. Treat them as illustrations, not automatic classifications: the binding Rules still require the product-specific connectivity, intended-use, Australian acquisition, awareness, date, and exclusion checks. Do not put excluded products into the statement workflow without a separate legal review.

The Australian Consumer Law test can include business purchases. The current monetary limb covers goods priced at no more than $100,000, while goods ordinarily acquired for personal, domestic, or household use can qualify regardless of price. Specified acquisitions for resupply or for use up or transformation in production, manufacture, repair, or treatment are excluded.

Do not sign the statement until the manufacturer has evidence for the security standard in Schedule 1 of the Smart Devices Rules. Tie the evidence to the product type and batch identifier that will appear in the statement.

The evidence pack should show that passwords, security-issue reporting information, and security-update support information were checked for the product and supporting software covered by the manufacturer's intended purpose. Password testing should cover the factory default state, configured operation, and post-reset behavior, and any identifier-derived password should have evidence showing why its encryption or keyed-hashing method meets good industry practice.

The statement of compliance must be prepared by, or on behalf of, the manufacturer. Control it as a release record: every required field should be present, traceable to evidence, and approved before the supplier uses it for Australian supply.

The workflow should block release when the product type, batch identifier, manufacturer details, authorised representative details, declarations, support period, signatory information, place of issue, or date of issue is missing. The Rules specify the information to include but do not prescribe an official form or fixed layout.

The Rules require one authorised representative's name and address, plus each other authorised representative in Australia if any, but do not define the role or prescribe an appointment form. Record the appointment basis and obtain case-specific advice if no representative exists.

Keep separate manufacturer and supplier records. The manufacturer must provide the statement for supply of the product in Australia and retain a copy for the period specified in the Rules. The supplier must supply the product in Australia with the statement and retain a copy for the same period.

The Act and Rules do not prescribe a delivery medium. The explanatory statement says a physical statement is not required at the point of sale and that entities may provide or publish it. Record the channel-specific method used to connect the statement to the supplied product; public availability alone should not be treated as conclusive proof of the supplier's duty without case-specific analysis.

For consumer-grade relevant connectable products covered by the Smart Devices Rules, the statement retention period is five years. Section 10 does not specify the event from which that period is calculated, so record the chosen start and end dates and obtain case-specific advice where the calculation matters. Keep the final statement linked to the approval trail, scope analysis, security-standard evidence, public support-period captures, and supplier handoff confirmation. The five-year statutory period applies to the statement; choose the supporting records' schedule under the organisation's other applicable duties and operational needs.

The Cyber Security Act allows an independent examination to assess whether a product complies with the security standard and whether the statement of compliance complies with section 16. The evidence workflow should therefore keep product, statement, and security-standard records aligned by product and batch.

When product design, firmware, bundled software, authorised representatives, security-update support period, or Australian supply channel changes, reopen the workflow and decide whether a new or updated statement and evidence pack is needed before further Australian supply.