{"id":"sr:emergency-management-critical-infrastructure-resilience-regulations-2025","name":"Emergency Management (Critical Infrastructure Resilience) Regulations 2025","slug":"emergency-management-critical-infrastructure-resilience-regulations-2025","collection":"regulation","jurisdiction":"vic","status":"in_force","isInForce":true,"actNumber":null,"makingDate":null,"administeringDepartment":null,"currentVersion":{"id":183456,"registerId":"vic-sr:emergency-management-critical-infrastructure-resilience-regulations-2025-current","compilationNumber":null,"startDate":"2026-04-05","status":"InForce","reasons":null,"registeredAt":null},"sections":[{"sectionNumber":"1","sectionType":"section","heading":"Emergency Management (Critical Infrastructure Resilience) Regulations 2025","content":"Version No. 001\n\n**Emergency Management (Critical Infrastructure Resilience) Regulations 2025**\n\n**S.R. No. 50/2025**\n\nVersion as at  \n29 June 2025\n\n**TABLE OF PROVISIONS**\n\n*Regulation Page*\n\n1 Objective 1\n\n2 Authorising provisions 1\n\n3 Commencement 1\n\n4 Revocation 1\n\n5 Definition 2\n\n6 Emergency risk management plan and documentation 2\n\n7 Exercise by responsible entity 2\n\n8 Responsible entity to conduct audit 2\n\n═════════════\n\nEndnotes 3\n\n1 General information 3\n\n2 Table of Amendments 5\n\n3 Explanatory details 6\n\n**Version No.** **001**\n\n**Emergency Management (Critical Infrastructure Resilience) Regulations 2025**\n\n**S.R. No. 50/2025**\n\nVersion as at  \n29 June 2025\n\n\t1 Objective\n\nThe objective of these Regulations is to make provision for the purposes of Part 7A of the **Emergency Management Act 2013** for—\n\n(a) the preparation of an emergency risk management plan; and\n\n(b) the development, conduct and evaluation of an exercise; and\n\n(c) the conduct of an audit; and\n\n(d) any other matter necessary to be provided for in respect of that Part.\n\n\t2 Authorising provisions\n\nThese Regulations are made under sections 76 and 76A of the **Emergency Management Act 2013**.\n\n\t3 Commencement\n\nThese Regulations come into operation on 29 June 2025.\n\n\t4 Revocation\n\nThe Emergency Management (Critical Infrastructure Resilience) Regulations 2015[[1]](#endnote-1) are **revoked**.\n\n\t5 Definition\n\nIn these Regulations, ***the Act*** means the **Emergency Management Act 2013**.\n\n\t6 Emergency risk management plan and documentation\n\nFor the purposes of section 74P of the Act, an emergency risk management plan must be prepared in accordance with the following, as published from time to time—\n\n(a) AS ISO 31000: Risk management—Guidelines;\n\n(b) SA HB 436.1: Risk management guidelines—Companion to AS ISO 31000—Part 1: Boards and executives.\n\n\t7 Exercise by responsible entity\n\nFor the purposes of section 74Q of the Act, an exercise must be developed, conducted and evaluated in accordance with the Australian Disaster Resilience Handbook Collection—Managing Exercises, as published by the Australian Institute for Disaster Resilience from time to time.\n\n\t8 Responsible entity to conduct audit\n\nFor the purposes of section 74S of the Act, an audit must be conducted in accordance with AS/NZS ISO 19011: Guidelines for auditing management systems, as published from time to time.\n\n═════════════\n\nEndnotes\n\n1 General information\n\nSee [www.legislation.vic.gov.au](http://www.legislation.vic.gov.au) for Victorian Bills, Acts and current Versions of legislation and up-to-date legislative information.\n\nThe Emergency Management (Critical Infrastructure Resilience) Regulations 2025, S.R. No. 50/2025 were made on 17 June 2025 by the Governor in Council under sections 76 and 76A of the **Emergency Management Act 2013**, No. 73/2013 and came into operation on 29 June 2025: regulation 3.\n\nThe Emergency Management (Critical Infrastructure Resilience) Regulations 2025 will sunset 10 years after the day of making on 17 June 2035 (see section 5 of the **Subordinate Legislation Act 1994**).\n\nINTERPRETATION OF LEGISLATION ACT 1984 (ILA)\n\nStyle changes\n\nSection 54A of the ILA authorises the making of the style changes set out in Schedule 1 to that Act.\n\nReferences to ILA s. 39B\n\nSidenotes which cite ILA s. 39B refer to section 39B of the ILA which provides that where an undivided regulation, rule or clause of a Schedule is amended by the insertion of one or more subregulations, subrules or subclauses the original regulation, rule or clause becomes subregulation, subrule or subclause (1) and is amended by the insertion of the expression \"(1)\" at the beginning of the original regulation, rule or clause.\n\nInterpretation\n\nAs from 1 January 2001, amendments to section 36 of the ILA have the following effects:\n\n• Headings\n\nAll headings included in a Statutory Rule which is made on or after  \n1 January 2001 form part of that Statutory Rule. Any heading inserted in a Statutory Rule which was made before 1 January 2001, by a Statutory Rule made on or after 1 January 2001, forms part of that Statutory Rule.  \nThis includes headings to Parts, Divisions or Subdivisions in a Schedule; Orders; Parts into which an Order is divided; clauses; regulations; rules; items; tables; columns; examples; diagrams; notes or forms.  \nSee section 36(1A)(2A)(2B).\n\n• Examples, diagrams or notes\n\nAll examples, diagrams or notes included in a Statutory Rule which is made on or after 1 January 2001 form part of that Statutory Rule. Any examples, diagrams or notes inserted in a Statutory Rule which was made before 1 January 2001, by a Statutory Rule made on or after 1 January 2001, form part of that Statutory Rule. See section 36(3A).\n\n• Punctuation\n\nAll punctuation included in a Statutory Rule which is made on or after  \n1 January 2001 forms part of that Statutory Rule. Any punctuation inserted in a Statutory Rule which was made before 1 January 2001, by a Statutory Rule made on or after 1 January 2001, forms part of that Statutory Rule.  \nSee section 36(3B).\n\n• Provision numbers\n\nAll provision numbers included in a Statutory Rule form part of that Statutory Rule, whether inserted in the Statutory Rule before, on or after  \n1 January 2001. Provision numbers include regulation numbers, rule numbers, subregulation numbers, subrule numbers, paragraphs and subparagraphs. See section 36(3C).\n\n• Location of \"legislative items\"\n\nA \"legislative item\" is a penalty, an example or a note. As from 13 October 2004, a legislative item relating to a provision of a Statutory Rule is taken to be at the foot of that provision even if it is preceded or followed by another legislative item that relates to that provision. For example, if a penalty at the foot of a provision is followed by a note, both of these legislative items will be regarded as being at the foot of that provision. See section 36B.\n\n• Other material\n\nAny explanatory memorandum, table of provisions, endnotes, index and other material printed after the Endnotes does not form part of a Statutory Rule. See section 36(3)(3D)(3E).\n\n2 Table of Amendments\n\nThere are no amendments made to the Emergency Management (Critical Infrastructure Resilience) Regulations 2025 by statutory rules, subordinate instruments and Acts.\n\n3 Explanatory details\n\n1. Reg. 4: S.R. No. 82/2015.\n\n  ——\n\n  **Table of Applied, Adopted or Incorporated Matter**\n\n  The following table of applied, adopted or incorporated matter was included in S.R. No. 50/2025 in accordance with the requirements of regulation 5 of the Subordinate Legislation Regulations 2024.\n\n    | **Statutory rule provision** | **Title of applied, adopted or incorporated document** | **Matter in applied, adopted or incorporated document** |\n    | --- | --- | --- |\n    | Regulation 6(a) | Australian Standard AS ISO 31000:2018 Risk management—Guidelines, published by Standards Australia on 30 October 2018 | The whole |\n    | Regulation 6(b) | SA HB 436.1:2020 Risk management guidelines—Companion to AS ISO 31000: 2018—Part 1: Boards and executives, published by Standards Australia on 23 October 2020 | The whole |\n    | Regulation 7 | Australian Disaster Resilience Handbook Collection—Managing Exercises 2023, published by the Australian Institute for Disaster Resilience in 2023 | The whole |\n    | Regulation 8 | Australian/New Zealand Standard AS/NZS ISO 19011:2019 Guidelines for auditing management systems, published by Standards Australia on 22 August 2019 | The whole |\n\n   [↑](#endnote-ref-1)","sortOrder":0}],"analysis":{"flash_summary_failed":{"failed":true,"reason":"A positive credit balance is required for all requests, including BYOK, so fallback providers remain available. Add credits at https://vercel.com/d?to=%2F%5Bteam%5D%2F%7E%2Fai%3Fmodal%3Dtop-up to continue.","source":"analysis-cron"},"flash_summary":{"complexity_score":4,"scope_assessment":{"changed":true,"description":"These Regulations replace the Emergency Management (Critical Infrastructure Resilience) Regulations 2015 (regulation 4) and update the technical specifications for plans, exercises and audits by naming current external standards (regulations 6–8). They do not expand the statutory subjects covered by Part 7A of the Act but change the prescribed methods and materials that responsible entities must use; this shifts compliance obligations toward the newly listed standards and requires entities to adapt processes and resources accordingly."},"complexity_factors":["Incorporation by reference of multiple external, technical standards published by third parties (ISO 31000 family, SA HB 436.1, AIDR handbook, AS/NZS ISO 19011) which require specialised interpretation and update tracking","Dependence on cross-references to Part 7A of the Emergency Management Act 2013 (sections 74P, 74Q, 74S) for who is covered and enforcement, creating interpretive dependency on the Act","Technical requirements (risk management frameworks, exercise design, audit methodologies) that typically require professional expertise to implement and verify","Revocation of the 2015 Regulations introduces transition and compliance-timing considerations for affected entities","Sunset provision (10-year expiry noted in endnotes) affects long-term planning and regulatory certainty","No substantive procedural detail on enforcement, penalties or transitional arrangements in the Regulations themselves, requiring reliance on the Act or other instruments"],"plain_english_summary":"These Regulations require responsible entities under Part 7A of the Emergency Management Act 2013 to prepare emergency risk management plans, run exercises, and conduct audits using specified standards. They revoke the 2015 rules and prescribe exact external standards and handbooks (AS ISO 31000; SA HB 436.1; AIDR Managing Exercises; AS/NZS ISO 19011) as the required methods.\n\nAffected entities—owners or operators of designated critical infrastructure—must resource and pay for compliant planning, exercises and audits; the Act provides the legal mandate and these Regulations set the technical method."},"issue_detection":{"absurdities":[],"contradictions":[]},"summary":{"complexity_score":3,"scope_assessment":{"changed":false,"description":"Unable to assess whether scope changed from original intent — the document provided contains only version history and formatting metadata, with no substantive regulatory provisions, explanatory memorandum, or statement of purpose to compare against."},"complexity_factors":["Insufficient legislative text provided — only metadata and version history are present, preventing assessment of actual complexity","Regulations of this type typically involve multi-layered compliance frameworks referencing a parent Act, which adds inherent complexity","Critical infrastructure law often intersects with multiple regulatory regimes (cybersecurity, emergency management, sector-specific rules), which would increase complexity if the full text were available","The score of 3 reflects the limited content available rather than the likely complexity of the substantive instrument"],"plain_english_summary":"These regulations set out rules to strengthen the resilience of “critical infrastructure” (power, water, health, telecoms, transport, etc.) in emergencies. They affect owners and operators of those services, and government agencies involved in emergency planning, by imposing compliance duties likely including risk assessment, reporting and resilience planning. \n\nNote: the provided file contains little substantive text; this summary is based on the title and regulatory purpose, not on full draft provisions."},"kimi_summary":{"content_quality":"ok","complexity_score":2,"scope_assessment":{"changed":false,"description":"The regulations remain tightly focused on their original purpose: operationalising Part 7A of the Emergency Management Act 2013. They cover exactly what the authorising provisions allow (sections 76 and 76A) — namely, prescribing requirements for risk management plans, exercises, and audits. The 2025 version is a direct replacement of the 2015 regulations with updated standard references, not an expansion of scope."},"complexity_factors":["Only 8 regulations total, with minimal text","Single defined term ('the Act')","No conditional logic, exceptions, or nested provisions","No cross-references between regulations (each stands alone)","Heavy reliance on 'incorporation by reference' to external standards (4 external documents), which shifts complexity to those standards rather than the regulations themselves","Straightforward structure: objective, commencement, definition, then three substantive requirements"],"plain_english_summary":"**What this does:**\nThese regulations set the rules for how critical infrastructure operators in Victoria must prepare for emergencies. They require three main things:\n\n- **Risk management plans**: Operators must prepare formal plans following recognised Australian standards for risk management (AS ISO 31000 and a companion handbook for boards and executives).\n- **Emergency exercises**: Operators must run practice drills and simulations to test their emergency readiness, following guidelines from the Australian Institute for Disaster Resilience.\n- **Audits**: Operators must have their emergency preparedness checked against the international standard for auditing management systems (AS/NZS ISO 19011).\n\n**Who it affects:**\n\"Responsible entities\" under Part 7A of the Emergency Management Act 2013 — essentially, operators of critical infrastructure (things like power stations, water supplies, transport networks, hospitals, and telecommunications) that are vital to community safety and the economy.\n\n**Why it matters:**\nThis ensures critical infrastructure can keep running (or recover quickly) during disasters like bushfires, floods, or cyber-attacks. By mandating specific professional standards, the government creates consistency across sectors and gives regulators a clear benchmark to check compliance. The regulations replace the 2015 version, updating the technical standards to current versions.\n\n**Key point:** Rather than writing detailed technical rules itself, the law \"incorporates by reference\" existing professional standards — meaning the legally binding requirements are actually found in separate documents published by Standards Australia and the Australian Institute for Disaster Resilience."}},"importantCases":[],"_links":{"self":"/api/acts/emergency-management-critical-infrastructure-resilience-regulations-2025","history":"/api/acts/emergency-management-critical-infrastructure-resilience-regulations-2025/history","analysis":"/api/acts/emergency-management-critical-infrastructure-resilience-regulations-2025/analysis","conflicts":"/api/acts/emergency-management-critical-infrastructure-resilience-regulations-2025/conflicts","importantCases":"/api/acts/emergency-management-critical-infrastructure-resilience-regulations-2025/important-cases","documents":"/api/acts/emergency-management-critical-infrastructure-resilience-regulations-2025/documents"}}