Australia’s Cyber Security Act 2024, together with its subordinate legislation, the Cyber Security (Security Standards for Smart Devices) Rules 2025, will be mandatorily implemented from March 4, 2026.

The subordinate legislation applies to products that can be purchased in Australia and that are directly or indirectly connected to the internet (referred to as relevant connectable products). However, the following products are exempt: (1) desktop computers, laptops, and tablets; (2) smartphones; and (3) medical devices, road vehicles, and their components as defined under relevant legislation.

The legislation imposes three categories of requirements on relevant connectable products: (1) password requirements; (2) security vulnerability reporting requirements; and (3) requirements relating to the product support period and security updates. Manufacturers are also required to publish a statement of compliance declaring that the product meets all applicable requirements. This statement of compliance must be retained by the manufacturer for at least five years.

If a manufacturer fails to comply with the obligations under the legislation, the Australian government may, depending on the manufacturer’s level of cooperation, issue a compliance notice (informing the manufacturer of areas of non-compliance and required remedial actions, as well as the consequences of failing to remedy), a stop notice (requiring the manufacturer to immediately cease the unlawful or non-compliant conduct), and a recall notice (requiring the manufacturer to recall the non-compliant products and cease their sale in Australia). If the manufacturer continues to refuse to cooperate, the Australian government will publicly disclose detailed information, including the identity of the manufacturer, product information, specific non-compliance issues, and the risks associated with using the products.