Australia Cyber Security Act Timeline and Commencement
The Act and its three 2025 rule instruments started on different dates. Track framework and the operative dates for ransomware, , and smart-device obligations separately.
Match each workflow to the relevant Part and instrument; consultation, registration, , and event deadlines are different legal events.
The Cyber Security Act 2024 commenced in stages: Parts 1, 4, 6, and 7 on 30 November 2024, and Part 2 on 29 November 2025. The Federal Register displays 29 May 2025 for Parts 3 and 5, while Home Affairs guidance gives 30 May 2025 for the linked ransomware and regimes. Use 29 May as the conservative readiness date and confirm the legal position for an event on that boundary. The prescribed smart-device standard and statement duties became operative on 4 March 2026. Match each ransomware, smart-device, and Cyber Incident Review Board workflow to its governing Part and Rules.
1
Section 1
Which Cyber Security Act commencement dates matter?
Parts 1, 4, 6, and 7 commenced on 30 November 2024, and Part 2 commenced on 29 November 2025. For Parts 3 and 5, the Federal Register's section 2 table displays 29 May 2025 in column 3, while Home Affairs guidance says the ransomware reporting regime and Rules started on 30 May 2025. Section 2 states that column 3 is not part of the Act; column 2 supplies the proclamation or six-month fallback mechanism. Record the one-day discrepancy rather than treating either summary date as a substitute for that mechanism. Use 29 May for readiness planning, and obtain case-specific confirmation of legal applicability for an event on 29 May.
The subordinate instruments have separate tables. The ransomware and Rules commence with Parts 3 and 5. Part 1 of the Smart Devices Rules commenced on registration on 4 March 2025, but Part 2 and Schedule 1 - including the prescribed class, security standard, statement requirements, and five-year retention rule - commenced on 4 March 2026.
29 November 2024: the Act received Royal Assent.
30 November 2024: Parts 1, 4, 6, and 7 commenced.
3 March 2025: the Ransomware Payment Reporting Rules and Rules were registered. Registration did not by itself activate either instrument because each provision also ties operation to the relevant Part of the Act.
4 March 2025: the Smart Devices Rules were registered and Part 1 commenced. Part 2 and Schedule 1 remained deferred for 12 months.
29 May 2025 in the Federal Register table; 30 May 2025 in Home Affairs guidance: the official sources differ on the start of Parts 3 and 5 and the linked ransomware and Rules. Plan readiness from 29 May and confirm applicability for a boundary-date event.
29 November 2025: Part 2 of the Act commenced, establishing the smart-device statutory framework.
4 March 2026: Part 2 and Schedule 1 of the Smart Devices Rules commenced, making the prescribed consumer-grade product controls and statement requirements operative.
Primary Act source for the commencement mechanism and the Federal Register's dates for Parts 2, 3, 5, and the other provisions. Section 2 states that dates inserted in column 3 are not part of the Act.
Home Affairs states 30 May 2025 for the ransomware and CIRB regimes, while the Federal Register commencement table displays 29 May 2025 for Parts 3 and 5. This source records the official one-day discrepancy; the Act's column 2 mechanism controls legal commencement.
Official Rules source tying commencement to Part 5 of the Act.
at the same time as Part 5
2
Section 2
Which date belongs in each operating workflow?
Ransomware teams should track the payment event or awareness event for each incident. A is either a business carried on in Australia whose previous-financial-year turnover exceeds the prescribed $3 million threshold and that is neither a Commonwealth or State body nor a responsible entity for any critical infrastructure asset, or a responsible entity for a critical infrastructure asset to which SOCI Part 2B applies. The incident, demand, payment, and statutory exclusion conditions must also be met. If the reporting business entity made the payment, the report is due within 72 hours after payment. If another entity paid on its behalf, the report is due within 72 hours after the reporting business entity became aware of the payment.
Product teams need both 29 November 2025 and 4 March 2026. Section 13 brings a into Part 2 if it was manufactured on or after 29 November 2025 or supplied in Australia, other than as second-hand goods, on or after that date. The prescribed consumer-grade security standard and provisions became operative on 4 March 2026. The official explanatory statement gives smart TVs, smart watches, home assistants, baby monitors, and consumer energy resources as examples of the consumer-grade class, but product teams must still apply the binding connectivity, intended-use, acquisition, awareness, date, and exclusion tests to each product.
The date establishes the review framework; it does not create a periodic filing. A published review notification does not itself require an organisation to respond. A written request under section 48 is voluntary, but a later notice under section 49 may require an involved non-government entity to produce relevant documents, with at least 14 days allowed for production.
Incident response: retain payment and awareness timestamps, the reporting-business-entity decision, the 72-hour deadline, and submission proof.
Product release: retain manufacture and supply dates, whether a supply was second hand, product-scope and exclusion decisions, technical control evidence, the issued statement, and its five-year retention owner.
response: distinguish a public review notification, a voluntary section 48 request, and a compulsory section 49 notice; record the notice date, the production deadline of at least 14 days, the legal and disclosure review, the response, and submission proof.
Legal or compliance: monitor rule amendments and the Act's provision permitting a Parliamentary Joint Committee on Intelligence and Security () review, subject to the Committee beginning it as soon as practicable after 1 December 2027.
Current Act sections 27, 48, 49, and 88 support the 72-hour trigger, the distinction between voluntary CIRB requests and compulsory document notices, the minimum 14-day production period, and the statutory-review timing.
Chair may require certain entities to produce documents
Home Affairs states 30 May 2025 for the ransomware and CIRB regimes, while the Federal Register commencement table displays 29 May 2025 for Parts 3 and 5. This source records the official one-day discrepancy; the Act's column 2 mechanism controls legal commencement.
Official explanatory material gives representative examples of the consumer-grade class; the commencement and product-specific scope tests remain those in the Act and Rules.
3
Section 3
Which dates are commonly confused?
Royal Assent, registration, framework , operative rule commencement, and event-triggered deadlines describe different legal events. Registration of the Smart Devices Rules on 4 March 2025 did not activate Part 2 and Schedule 1; they commenced on 4 March 2026.
The five-year statement period is a retention duration, not a common destruction date. The Rules specify a five-year period but do not state its starting event, so the manufacturer and supplier should record the interpretation used and obtain case-specific advice before disposing of a statement.
The 72-hour reporting period starts from the payment or awareness trigger in section 27, not from initial detection of the cyber incident. If no payment or benefit directly related to the extorting demand was provided, Part 3 does not create a ransomware payment report deadline, although other incident-reporting duties may still apply.
Do not label the 2024-2025 Rules consultation window as a compliance deadline; it preceded the final instruments.
Do not use 29 November 2025 alone as the smart-device control date; the prescribed standard and statement provisions sit in Rules provisions that commenced on 4 March 2026.
Do not treat the framework as a substitute for reporting under the Security of Critical Infrastructure Act 2018 (SOCI Act), the Privacy Act 1988, Australian Prudential Regulation Authority (APRA) standards, law-enforcement processes, insurance terms, or contracts.
For stock around , record whether the product was manufactured or supplied on or after Part 2 commenced and whether the supply was second hand.
Home Affairs states 30 May 2025 for the ransomware and CIRB regimes, while the Federal Register commencement table displays 29 May 2025 for Parts 3 and 5. This source records the official one-day discrepancy; the Act's column 2 mechanism controls legal commencement.
30 May 2025
4
Section 4
How should teams maintain the commencement record?
Keep one dated legal-status register that links each Act Part and rule instrument to its provision, affected workflow, owner, and evidence location. Keep event-triggered deadlines in the operational system where the trigger occurs.
Recheck the latest authorised Act and rule versions after an amendment or new instrument. Preserve the version relied on for an earlier decision so the organisation can explain what was in force at that time.
Record Act Part, instrument, provision, event, operative date, source version, and last verification date.
Connect Part 3 to the ransomware payment-reporting workflow and Part 5 to the response owner.
Connect Part 2 and the Smart Devices Rules to product intake, release approval, statement issuance, and retention controls.
Log an unresolved question rather than substituting a consultation date, registration date, or planning target for the legal provision.
Home Affairs states 30 May 2025 for the ransomware and CIRB regimes, while the Federal Register commencement table displays 29 May 2025 for Parts 3 and 5. This source records the official one-day discrepancy; the Act's column 2 mechanism controls legal commencement.
30 May 2025
Recommended next step
Turn commencement dates into assigned work
Assign each commencement milestone and event-driven deadline to an owner, evidence record, and review point.
Primary Act source for the commencement mechanism and the Federal Register's dates for Parts 2, 3, 5, and the other provisions. Section 2 states that dates inserted in column 3 are not part of the Act.
Authoritative Act source for the Cyber Security Act commencement table and the timing of Parts 2, 3, 5, and other operative provisions.
Primary Act source for the commencement mechanism and the Federal Register's dates for Parts 2, 3, 5, and the other provisions.
Home Affairs states 30 May 2025 for the ransomware and CIRB regimes, while the Federal Register commencement table displays 29 May 2025 for Parts 3 and 5. This source records the official one-day discrepancy; the Act's column 2 mechanism controls legal commencement.
Current Act sections 27, 48, 49, and 88 support the 72-hour trigger, the distinction between voluntary CIRB requests and compulsory document notices, the minimum 14-day production period, and the statutory-review timing.
"Chair may require certain entities to produce documents"
Official explanatory material gives representative examples of the consumer-grade class; the commencement and product-specific scope tests remain those in the Act and Rules.