{"id":"F2026L00385","name":"Aviation Transport Security (Incident Reporting) Instrument 2026","slug":"aviation-transport-security-incident-reporting-instrument-2026","collection":"legislative_instrument","jurisdiction":"commonwealth","status":"in_force","isInForce":true,"actNumber":null,"makingDate":null,"administeringDepartment":null,"currentVersion":{"id":443229,"registerId":"F2026L00385-fast-fetch-1775958120192","compilationNumber":null,"startDate":"2026-04-12","status":"InForce","reasons":null,"registeredAt":null},"sections":[{"sectionNumber":"1","sectionType":"section","heading":"Aviation Transport Security (Incident Reporting) Instrument 2026","content":"---\nmeta-content-style-type: text/css\nmeta-content-type: application/xhtml+xml; charset=utf-8\n---\n\n![Commonwealth Coat of Arms of Australia](image.001.jpeg)\n\n \n\nLIN 26/031\n\n \n\nAviation Transport Security (Incident Reporting) Instrument 2026\n\nI, Matthew Pedler, Delegate of Secretary of the Department of Home Affairs, make the following instrument.\n\nDated 26 March 2026\n\nMatthew Pedler\n\nActing First Assistant Secretary  Critical Infrastructure Partnerships and Policy Division  Critical Infrastructure and Protective Security Group  National Security Group\n\nDepartment of Home Affairs\n\n \n\n \n\n \n\nContents\n\nPart 1—Preliminary\n\n1  Name\n\n2  Commencement\n\n3  Authority\n\n4  Definitions\n\n5  Schedules\n\nPart 2—Reporting requirements\n\n6  Information that must be included in a security incident report\n\n7  Way in which a security incident report is to be made\n\n8  Information that must be included in a cyber security incident report\n\n9  Way in which a cyber security incident report is made\n\nPart 3—Transitional and application provisions\n\n10  Reporting requirements—application\n\nSchedule 1—Repeals\n\nAviation Transport Security (Incident Reporting) Instrument 2018\n\n \n\nPart 1—Preliminary\n\n1  Name\n\n  This instrument is the Aviation Transport Security (Incident Reporting) Instrument 2026.\n\n2  Commencement\n\n  This instrument commences on the later of:\n\n (a) the day after the instrument is registered; and\n\n (b) immediately after the commencement of Part 1 of Schedule 1 to the Transport Security Amendment (Security of Australia’s Transport Sector) Act 2025.\n\n3  Authority\n\n  This instrument is made under subsection 107(1) of the Aviation Transport Security Act 2004.\n\n4  Definitions\n\nNote: A number of expressions used in this instrument are defined in the Act, including the following:\n\n(a) aircraft;\n\n(b) aviation industry participant;\n\n(c) aviation security incident;\n\n(d) cyber security incident;\n\n(e) in flight;\n\n(f) relevant impact;\n\n(g) significant impact;\n\n(h) unlawful interference with aviation.\n\n  In this instrument:\n\nAct means the Aviation Transport Security Act 2004.\n\ncyber security incident report means a report required to be made to the Secretary under Part 6 of the Act for a cyber security incident.\n\nDepartment means the Department of Home Affairs.\n\nindustry participant means an aviation industry participant.\n\nrelevant cyber security incident means a cyber security incident that has a relevant impact.\n\nsecurity incident means an aviation security incident.\n\nsecurity incident report means a report required to be made to the Secretary under Part 6 of the Act in relation to a security incident.\n\nsignificant cyber security incident means a cyber security incident that has a significant impact.\n\nunlawful interference means unlawful interference with aviation.\n\n5  Schedules\n\n  Each instrument that is specified in a Schedule to this instrument is amended or repealed as set out in the applicable items in the Schedule concerned, and any other item in a Schedule to this instrument has effect according to its terms.\n\nPart 2—Reporting requirements\n\n6  Information that must be included in a security incident report\n\n (1) For the purposes of paragraph 107(1)(a) of the Act, this section specifies information that a security incident report must include.\n\nGeneral reporting requirements\n\n (2) The following information must be included in a security incident report:\n\n (a) the name, contact number, and email address of the person making the report;\n\n (b) the title or position held by the person making the report;\n\n (c) the name of the employer of the person making the report (where applicable);\n\n (d) the date of the report;\n\n (e) the date and time the security incident commenced;\n\n (f) the date and time the security incident ceased;\n\n (g) the location of the security incident (including, where applicable, the name and address of the location where the security incident occurred);\n\n (h) the industry participant or participants to whom the security incident relates;\n\n (i) the industry participant or participants who are affected as a result of the security incident;\n\n (j) whether the report is a result of a routine security inspection; and\n\n (k) a detailed description of the security incident, including an indication as to whether the incident was or is:\n\n (i) a threat of unlawful interference; or\n\n (ii) an unlawful interference;\n\n (l) the steps the industry participant has taken, or is in the process of taking, to ensure the security incident does not occur again; and\n\n (m) where subsection (3), (4), (5), (6), (7) or (8) applies – information that is specified in that subsection.\n\nNote: If, at the time of reporting, any of the required information under subsection 6(2) is not able to be provided, subsection 7(2) sets out requirements in relation to providing further information.\n\nIncident involving a threat of unlawful interference\n\n (3) If the security incident was or is a threat of unlawful interference, the following information must also be included in the report:\n\n (a) the name and contact details of the person who received the threat;\n\n (b) the details of the threat;\n\n (c) whether the threat is assessed as genuine or as a hoax and how that assessment has been made; and\n\n (d) whether the person who made the threat attempted, is in the process of committing, or completed the act of unlawful interference.\n\nIncident involving an aircraft\n\n (4) If the security incident involved, or involves, an aircraft, the following information must also be included in the report:\n\n (a) the aircraft type;\n\n (b) the flight number;\n\n (c) whether or not the aircraft was in flight at the time of the security incident; and\n\n (d) the type of cargo on board (if applicable).\n\nIncident involving a building or other infrastructure\n\n (5) If the security incident involved, or involves, a building or other infrastructure, information that is sufficient to identify the building or other infrastructure must also be included in the report.\n\nIncidents previously reported to the Secretary\n\n (6) If the person making the report is aware that the security incident has previously been reported to the Secretary, the following information must also be included in the report:\n\n (a) the approximate time and date on which the security incident was reported; and\n\n (b) the name or position of the person to whom, or the name of the area in the Department to which, the incident was reported.\n\nIncidents previously reported to the police, an industry participant, or any other body\n\n (7) If the security incident has been reported to the police, an industry participant, or any other body, the following information must also be included in the report:\n\n (a) the approximate time and date on which the security incident was reported; and\n\n (b) the name and contact information of the person to whom the incident was reported, or a relevant engagement identifier such as a case number, incident report number or other relevant identifier.\n\nIncident brought to the attention of an industry participant by a third party\n\n (8) If the report is a result of a security incident that has been brought to the attention of the person making the report by a third party, the following information must also be included in the report:\n\n (a) a statement that the report is a result of notification from a third party; and\n\n (b) the name, and where applicable, name of the employer, of the third party.\n\n7  Way in which a security incident report is to be made\n\n (1) Once an industry participant becomes aware that a security incident has occurred, or is occurring, the industry participant must make the security incident report to the Secretary as soon as possible, but no later than 24 hours after they first become aware of the incident.\n\n (2) If at the time of making the security incident report, the industry participant does not have any or part of the information that is required under section 6, but subsequently obtains that information, the industry participant must provide that information to the Secretary in a report by one of the ways specified in (3) as soon as possible, but not later than 24 hours after obtaining the information.\n\n (3) A security incident report must be made in one of the following ways:\n\n (a) orally via phone on 1300 791 581;\n\n (b) online via the Department’s website using the form:  https://www.homeaffairs.gov.au/about/transport-security/security-incident-reporting/aviation-security-incident-report-form; or\n\n (c) by email to transport.security@homeaffairs.gov.au.\n\n (4) If a security incident report is first made in the way specified in paragraph (3)(a), the industry participant must, within 24 hours of making that report, also provide the information required under section 6 in a way specified in either paragraph (3)(b) or (c).\n\n8  Information that must be included in a cyber security incident report\n\n (1) For the purposes of paragraph 107(1)(a) of the Act, this section specifies information that a cyber security incident report must include.\n\n (2) The following information must be included in a cyber security incident report:\n\n (a) the name, contact number, and email address of the person making the report;\n\n (b) the name of the employer of the person making the report (if applicable);\n\n (c) the state or territory and postcode of the employer of the person making the report;\n\n (d) the date and time the incident was identified;\n\n (e) whether the incident is ongoing at the time the report is made;\n\n (f) the nature or type of cyber security incident that is occurring or has occurred; and\n\n (g) a detailed description of the cyber security incident that is occurring or has occurred.\n\nNote:  If, at the time of reporting, any of the required information specified in subsection 8(2) is not able to be provided, subsection 9(4) sets out requirements in relation to providing further information in the specified way.\n\n9  Way in which a cyber security incident report is made\n\n (1) A cyber security incident report must be made online via the Australian Cyber Security Centre’s reporting portal.\n\nNote: The Australian Cyber Security Centre’s reporting portal can be accessed via Report | Cyber.gov.au as on the commencement day of this instrument.\n\n (2) If a cyber security incident report is made in accordance with subsection (1) and the industry participant has not given consent to share the cyber security incident report with the Secretary, the information must also be submitted to the Secretary online via the Department’s form:\n\n  https://www.homeaffairs.gov.au/about/transport-security/security-incident-reporting/aviation-security-incident-report-form.\n\n (3) If a report is made to the Secretary in the way specified in subsection (2), this is to be done as soon as possible after the incident is identified, and in any event within:\n\n (a) 12 hours of the industry participant becoming aware of the incident, if it is a significant cyber security incident; or\n\n (b) 72 hours of an industry participant becoming aware of the incident, if it is a relevant cyber security incident.\n\n (4) If at the time of making a cyber security incident report, the industry participant does not have any, or part, of the information required under section 8, but subsequently obtains that information, the industry participant must provide that information in a report by the way specified in subsection (1) as soon as possible, but not later than 24 hours after obtaining the information.\n\n (5) If information is provided in accordance with subsection (4), and consent is not given to share the information with the Secretary, the information must be provided to the Secretary in the way specified in subsection (2) as soon as possible, but not later than 24 hours after the industry participant obtains the information.  \n\n\nPart 3—Transitional and application provisions\n\n10  Reporting requirements—application\n\n  This instrument applies in relation to:\n\n (a) a report made in accordance with Division 4 of Part 6 of the Act (a Division 4 report) on or after the day this instrument commences; and\n\n (b) if additional information is to be provided to the Secretary in connection with a Division 4 report made before this instrument commences—that additional information.  \n\n\nSchedule 1—Repeals\n\nAviation Transport Security (Incident Reporting) Instrument 2018\n\n1  The whole of the instrument\n\nRepeal the instrument.\n","sortOrder":0}],"analysis":{"flash_summary_failed":{"failed":true,"reason":"Unauthenticated. Configure AI_GATEWAY_API_KEY or use a provider module. Learn more: https://ai-sdk.dev/unauthenticated-ai-gateway","source":"analysis-cron"},"kimi_summary":{"content_quality":"ok","complexity_score":4,"scope_assessment":{"changed":false,"description":"The instrument maintains the same scope as its predecessor. It continues to prescribe reporting requirements for aviation security incidents under Part 6 of the Aviation Transport Security Act 2004. While it adds specific cyber security reporting mechanics aligned with the Transport Security Amendment (Security of Australia's Transport Sector) Act 2025, this represents an update to existing cyber reporting obligations rather than an expansion beyond the Act's original intent regarding transport security incident reporting."},"complexity_factors":["Multiple reporting pathways with conditional logic (e.g., if reported by phone, must follow up in writing within 24 hours)","Dual-track reporting system for cyber incidents (ACSC portal + conditional secondary reporting to Secretary if consent not given)","Nested conditional requirements in sections 6 and 8 (different information required depending on incident type: threats vs. aircraft vs. infrastructure vs. third-party reports)","Cross-references to parent Act (Aviation Transport Security Act 2004) for defined terms","Transitional provisions applying to both new reports and supplementary information for old reports","Time-bound obligations with varying deadlines (12 hours for significant cyber incidents, 24 hours for security incidents, 72 hours for relevant cyber incidents)"],"plain_english_summary":"This instrument updates Australia’s aviation security reporting rules for 2026, requiring aviation businesses to rapidly notify authorities of security incidents and cyber attacks. It links cyber reporting into the Australian Cyber Security Centre’s portal while ensuring the Department of Home Affairs still receives transport-security information. It affects airlines, airport operators, cargo handlers and other participants under the Aviation Transport Security Act, improving government visibility and response to threats."},"flash_summary":{"complexity_score":5,"scope_assessment":{"changed":true,"description":"The instrument expressly repeals the Aviation Transport Security (Incident Reporting) Instrument 2018 (Schedule 1) and replaces it with a new set of mandatory reporting content, channels and deadlines (see Parts 2 and Schedule 1). The text therefore changes which instrument governs reporting. The instrument itself does not include a side‑by‑side comparison to the 2018 text, so whether particular obligations are narrower or broader than previously requires comparing the two instruments; what is clear from this instrument is that it standardises specific fields to be reported, specifies ACSC portal use and consent rules (s 9), and sets precise time limits for initial and supplementary reports (ss 7 and 9)."},"complexity_factors":["Multiple, conditional reporting deadlines (general security: s 7(1); cyber: s 9(3)(a)–(b); updates: s 7(2), s 9(4)–(5))","Several permitted submission channels with conditional follow‑ups (phone, Department online form, email: s 7(3)–(4); ACSC portal plus Department form where consent withheld: s 9(1)–(2))","Detailed, itemised information requirements with conditional items for different incident types (general security: s 6(2)–(8); cyber: s 8(2))","Cross‑references to defined terms in the Aviation Transport Security Act 2004—requiring cross‑checking statutory definitions to interpret scope (s 4)","Transitional and repeal mechanics removing the 2018 instrument (Schedule 1) which may require stakeholders to map old to new obligations","Consent and information‑sharing condition between ACSC and the Department creates an extra compliance decision for reporters (s 9(2))","Administrative burden from requirements to provide later obtained information within strict timeframes (s 7(2), s 9(4)–(5))"],"plain_english_summary":"This instrument replaces the 2018 incident‑reporting instrument and prescribes exactly what information aviation industry participants must include in security and cyber‑security incident reports, how to submit them, and firm time limits for reporting.\n\nIt applies to aviation industry participants and requires reporting within 24 hours for general security incidents and within 12 or 72 hours for significant or relevant cyber incidents respectively, via phone, the Department’s form, email, or the ACSC portal so the Secretary receives timely information for response and oversight."}},"importantCases":[],"_links":{"self":"/api/acts/aviation-transport-security-incident-reporting-instrument-2026","history":"/api/acts/aviation-transport-security-incident-reporting-instrument-2026/history","analysis":"/api/acts/aviation-transport-security-incident-reporting-instrument-2026/analysis","conflicts":"/api/acts/aviation-transport-security-incident-reporting-instrument-2026/conflicts","importantCases":"/api/acts/aviation-transport-security-incident-reporting-instrument-2026/important-cases","documents":"/api/acts/aviation-transport-security-incident-reporting-instrument-2026/documents"}}