Aviation Transport Security (Incident Reporting) Instrument 2026

The instrument relies heavily on terms defined in the Aviation Transport Security Act 2004. “Industry participant” is shorthand for “aviation industry participant”, a defined class that includes airport operators, aircraft operators, screening authorities, cargo agents, and other entities prescribed by the Act or regulations. The instrument does not expand or narrow that class. “Security incident” (meaning “aviation security incident”) and “cyber security incident” are both defined in the Act. The instrument creates a subclass: “relevant cyber security incident” (a cyber security incident that has a “relevant impact” as defined in the Act) and “significant cyber security incident” (one that has a “significant impact”). Those terms from the Act involve thresholds that the instrument does not modify. The instrument also defines “unlawful interference” by reference to “unlawful interference with aviation” in the Act.

A “security incident report” is a report required under Part 6 of the Act in relation to a security incident; a “cyber security incident report” is a report required under Part 6 for a cyber security incident. The instrument cross references those duties rather than creating standalone reporting obligations. The key conceptual distinction is between the two types of reports: they have different information requirements, different reporting channels, and different timeframes. Security incidents must be reported to the Secretary (Department of Home Affairs) directly, with an option for oral initial notification. Cyber security incidents must go through the Australian Cyber Security Centre portal, with a possible secondary submission to the Secretary if consent is not given.

The instrument also introduces the concept of “awareness” as the trigger for the reporting clock. An industry participant must report “once [it] becomes aware that a security incident has occurred, or is occurring.” The instrument does not define “awareness”. It does not specify whether it means actual knowledge of a specific person or imputed knowledge through an organisation’s systems. That creates uncertainty, particularly for large operators with multiple layers of management and distributed workforces. The same trigger applies for cyber security incidents, with the additional gradation of significance.

The instrument also uses the phrase “as soon as possible, but no later than” a set number of hours. This imposes both a best efforts obligation and an outer limit. An industry participant that could have reported earlier than the deadline but waited until nearing the deadline may be non compliant if it could have reported sooner.

The instrument directly imposes obligations on “industry participants” - that is, aviation industry participants as defined in the Act. This is a broad category that includes airport operators (major and regional), airlines (domestic and international), cargo operators, ground handling companies, catering and cleaning firms that operate in security controlled areas, and any other entity that holds a Transport Security Program under the Act. It also likely covers entities that provide security services at airports, such as screening contractors.

Indirectly, the instrument affects any employee, contractor, or agent of an industry participant who is responsible for identifying, reporting, or managing security incidents. The reporting requirements ask for the name, contact details, title, and employer of the person making the report, but the duty to report rests on the industry participant as an entity, not on the individual employee. However, the individual’s failure to escalate internally could cause the entity to miss the deadline.

The instrument also affects third parties who bring incidents to an industry participant’s attention. Section 6(8) requires the reporter to state that the report is from a third party and provide the third party’s name and employer. That means an industry participant that receives a tip from a member of the public, a contractor, or a government agency must disclose the source of information. This could have privacy implications and may deter some third parties from reporting.

Smaller aviation industry participants face a disproportionate compliance burden. A large airline with dedicated security teams may find the 24 hour and 12 hour timeframes manageable. A small regional airport operator or a cargo handler with limited staff may struggle to have someone available to prepare and submit a detailed report within those windows, particularly outside business hours or on weekends. The instrument requires reporting “as soon as possible” as a floor, which may be interpreted strictly by the Department.

The instrument also affects industry participants indirectly by expanding the administrative record of incidents. The Department receives structured data on each incident, including steps taken to prevent recurrence. That information could be used in audits, compliance actions, or to inform future regulatory changes. Industry participants that underreport or report late face exposure under the Act’s penalty provisions.

There is no carve out for small business or for incidents that are minor or self contained. Every security incident, regardless of apparent severity, must be reported within 24 hours. That includes incidents that might not meet the “significant” or “relevant” thresholds that are only used for cyber security incidents. The only distinction is in the additional information required; the duty to report is universal.

The central duty is the obligation of an industry participant to make a report to the Secretary within the prescribed timeframe and containing the prescribed information. For security incidents, the duty arises “once an industry participant becomes aware that a security incident has occurred, or is occurring.” The report must be made as soon as possible, but not later than 24 hours after awareness. If the report is made orally by phone, the industry participant must also submit the required information in writing (via the online form or email) within 24 hours of the oral report. If information is missing at the time of the initial report, the industry participant must provide that information within 24 hours of obtaining it.

For cyber security incidents, the duty is to make a report via the ACSC portal. If the industry participant does not consent to the ACSC sharing the report with the Secretary, a separate report must be made to the Secretary using the Department’s online form. The timeframe for that secondary report is 12 hours for a significant cyber security incident and 72 hours for a relevant cyber security incident. If information is initially missing, it must be provided via the portal within 24 hours, and if consent is withheld, also to the Secretary within 24 hours.

The instrument also imposes a duty to include a detailed description of the incident and, for security incidents, “the steps the industry participant has taken, or is in the process of taking, to ensure the security incident does not occur again” (s 6(2)(l)). This is a forward looking remedial duty that may require the reporting entity to conduct an internal investigation and implement corrective measures before the report is due. In practice, that may be impossible within 24 hours for a complex incident. The duty is to report steps taken or in process; the industry participant can note that steps are still under development.

The instrument does not confer any new rights on industry participants. There is no right to delay reporting for operational reasons, no right to withhold information on grounds of commercial sensitivity or legal professional privilege (unless the Act provides such protections, which the instrument does not address), and no right to be notified of the outcome of the Department’s review of the report. The Secretary receives the reports but the instrument does not prescribe any feedback loop.

The only implicit right is the ability to choose the reporting channel within the options given. For security incidents, the reporter may choose phone, online form, or email, but if phone is chosen, a written follow up is required. For cyber security incidents, the portal is mandatory; the Secretary is an optional additional recipient if consent is not given.

The instrument itself does not create penalty provisions. Penalties for non compliance arise under the Aviation Transport Security Act 2004. Section 107 of the Act provides that the Secretary may, by legislative instrument, specify information that must be included in reports and the way reports are to be made. Failure to comply with a requirement of the instrument is a breach of the Act. The Act contains civil penalty provisions and criminal offences for contraventions of the reporting obligations.

Civil penalties under the Act can be substantial. For a body corporate, the maximum civil penalty may be 10,000 penalty units (currently $313,000 per unit, so over $3 billion, but that would be subject to the specific provision; typical civil penalties under the Act are in the hundreds of thousands of dollars). Criminal penalties may also apply for knowing or reckless failure to report. The instrument’s detailed specifications (e.g. the exact fields, the 24 hour deadline, the requirement to report steps taken to prevent recurrence) mean that any deviation - a missing field, a late report, an incomplete description - could technically amount to a contravention of the Act. The Department may exercise discretion, but the legal exposure is broad.

Enforcement is likely to be conducted by the Department of Home Affairs, possibly through audits of Transport Security Programs or through investigation of particular incidents. The Department may issue infringement notices (penalty notices) without court proceedings for less serious breaches. For more serious or systemic non compliance, the Department may seek civil penalty orders in the Federal Court or refer matters for criminal prosecution.

The instrument’s reporting requirements also create an evidentiary record. If an incident leads to litigation or a coronial inquiry, the reports submitted under this instrument will be discoverable. Any inconsistency between the report and later statements could be used against the industry participant. The duty to report steps taken to prevent recurrence may also be used in civil proceedings as an admission that the steps were necessary, potentially undermining a defence that the incident was unforeseeable.

The instrument does not provide a defence for reporting in good faith or for reporting based on incomplete information. While the instrument allows for missing information to be provided later, the initial report must still be made within the deadline and must include the information that is available at the time. If an industry participant deliberately withholds information that it has, that is a breach. If it inadvertently omits information and later provides it, the initial report is still technically incomplete, though the Department may treat the follow up as curing the defect.

The instrument operates as a subordinate legislative instrument under the Aviation Transport Security Act 2004. It does not override the Act; it fills in details that the Act leaves to regulation. The Act itself imposes the primary duty to report security incidents and cyber security incidents (Part 6). The instrument specifies what must be in the report and how it must be made. Any failure to comply with the instrument is a failure to comply with the Act.

The instrument exists alongside other Commonwealth and state laws that may impose separate reporting obligations. For example, the Security of Critical Infrastructure Act 2018 (Cth) imposes mandatory cyber incident reporting obligations on critical infrastructure entities, which may include some aviation industry participants. That Act has its own definitions, timeframes, and reporting channels (to the Cyber Coordinator or the Australian Signals Directorate). An industry participant that is also a critical infrastructure entity may need to report the same cyber incident under both regimes. The instrument does not provide for dual reporting or harmonisation; it requires reporting via the ACSC portal, which may satisfy the SOCI reporting requirement if the ACSC is the same channel, but the participant must ensure it also complies with this instrument’s specific requirements, including the secondary report to the Secretary if consent is not given.

State and territory police reporting obligations also remain. The instrument does not replace any obligation to report a threat or act of unlawful interference to the police. Section 6(7) requires the industry participant to disclose if the incident has been reported to police and to provide the case number or identifier. This implies that the Department expects parallel reporting.

The instrument may also interact with privacy laws. The Privacy Act 1988 (Cth) applies to industry participants that collect personal information in the course of reporting. The instrument requires the reporter’s name, contact details, and employer, as well as the name and employer of third parties who brought the incident to light. Those are personal information. The Privacy Act’s disclosure requirements and the Notifiable Data Breaches scheme may apply if the report contains personal information that is lost or accessed without authorisation. The instrument does not address privacy protections or limit the Department’s use of that information.

The transitional provision in Part 3 means that the instrument applies to reports made on or after commencement. But for reports made before commencement, if additional information is provided after commencement, the new rules apply to that additional information. That could create a hybrid situation where an initial report under the 2018 instrument is supplemented under the 2026 instrument. Industry participants should review any open or unresolved incidents from before the commencement date to ensure that any follow up reports comply with the new requirements.

This instrument is new. It repeals and replaces the Aviation Transport Security (Incident Reporting) Instrument 2018. The 2018 instrument was the previous specification for incident reporting content and process. The 2026 instrument makes several substantive changes: it introduces separate and more detailed cyber security incident reporting requirements (including the 12 hour and 72 hour deadlines), it replaces the old single reporting channel for cyber incidents with the ACSC portal, and it adds new information fields (e.g. the requirement to state whether the report is from a routine security inspection, the requirement to identify the industry participant to whom the incident relates, and the requirement to report steps taken to prevent recurrence). The 2018 instrument did not contain provisions for reporting steps taken to prevent recurrence, nor did it distinguish between types of incidents with different timeframes for cyber incidents.

The instrument is made by a delegate of the Secretary of the Department of Home Affairs. It commences on the later of the day after registration and immediately after the commencement of Part 1 of Schedule 1 to the Transport Security Amendment (Security of Australia’s Transport Sector) Act 2025. That amendment Act is not provided, but it appears to introduce or amend the cyber security incident reporting provisions in the principal Act. The instrument is timed to align with the commencement of those amendments. Industry participants must be aware that the underlying Act may have changed concurrently, and the instrument should be read together with the amended Act.

The instrument has no other amendment history because it has only just been made. It may be amended in the future, particularly if the Department receives feedback on the feasibility of the 12 hour cyber deadline or the dual reporting requirement. For now, it is the operative instrument.

The instrument itself is too new to have been the subject of litigious testing. There is no reference to any court case in the instrument. However, the predecessor instrument (the 2018 Instrument) may have been considered in litigation concerning reporting obligations under the Act. Because no cases are named in the source, we cannot speculate. It is plausible that compliance with reporting requirements has been an issue in enforcement proceedings brought by the Department, but that remains unverified.

The instrument creates potential grounds for litigation in several respects. First, an industry participant may challenge the validity of the instrument on the basis that it exceeds the power in subsection 107(1) of the Act. For example, if the requirement to report steps taken to prevent recurrence is argued to be beyond the scope of “information that a report must include” because it requires a forward looking evaluation rather than a factual description. Second, the definition of “awareness” may be litigated. An industry participant could argue that it became aware at a different time than the Department claims, affecting whether the report was late. Third, the distinction between “significant” and “relevant” cyber security incidents is based on Act definitions that may themselves be ambiguous. An industry participant could argue that a cyber incident did not meet the threshold for a 12 hour report and that the 72 hour deadline applied, but the Department could disagree.

The instrument does not create a private right of action. However, it could be relevant in civil litigation between private parties. For example, if an industry participant fails to report an incident and that leads to harm to a third party, the victim could point to the breach of the reporting obligation as evidence of negligence or breach of statutory duty. The instrument sets out what a reasonable industry participant should do; a departure from those requirements may be used against the participant in court.

The Administrative Appeals Tribunal (or its successor, the Administrative Review Tribunal) may hear appeals from decisions of the Secretary that are based on reports made under this instrument, such as decisions to suspend or revoke a Transport Security Program. In that context, the Tribunal would examine whether the industry participant complied with the instrument’s requirements.

The instrument contains several traps for the unwary. The first is the “awareness” trigger. The instrument does not define when an industry participant is considered aware. In a large organisation, an incident might be known to a frontline employee but not escalate to the security manager for several hours. The Department may take the view that awareness arises when any employee with a duty to report becomes aware, not when a senior officer or the legal department learns of it. Industry participants should treat the clock as starting as soon as any employee in the security or operations chain knows of the incident.

Second, the requirement to report “steps taken or in the process of being taken to ensure the security incident does not occur again” (s 6(2)(l)) can force premature disclosure of corrective actions. If an industry participant has not yet fully investigated the root cause, it must still report whatever steps it has taken or is taking. That could include provisional steps that later prove ineffective or unnecessary. Reporting those steps may create a record that could be used against the participant in later proceedings. Moreover, the requirement may discourage thorough investigation because the report is due within 24 hours. The industry participant may be incentivised to report minimal or generic steps to meet the deadline, then later implement more robust measures without updating the report (though the instrument requires updates only for missing information, not for changes to steps taken).

Third, the dual reporting requirement for cyber security incidents is easily overlooked. If an industry participant makes a report to the ACSC portal but does not consent to sharing with the Secretary, the participant must also submit the same information to the Department’s online form. That is a separate obligation with its own deadlines (12 or 72 hours from awareness, not from the portal report). A participant that consents to sharing avoids the secondary report. The consent decision is binary and must be made at the time of the portal report. If the participant chooses not to consent (perhaps due to concerns about the Department’s use of data), it incurs a significant additional compliance burden. If it consents, it must trust that the ACSC will share promptly enough for the Department to receive the information within the statutory timeframe, but the instrument does not make that a condition.

Fourth, the 12 hour deadline for significant cyber security incidents is extremely tight. For incidents that are discovered late on a Friday or before a public holiday, the responsible staff must be available to prepare and submit a report within half a day. This may require 24/7 on call arrangements. For smaller participants, the cost of such arrangements may be disproportionate to the risk.

Fifth, the instrument does not allow for an extension of time in any circumstances. There is no provision for force majeure, technical failure, or unavailability of key personnel. The obligation is absolute: the report must be made as soon as possible and in any event within the deadline. If the Department’s website or the ACSC portal is down, the participant may need to use an alternative method, but the only alternative for security incidents is phone then follow up; for cyber incidents, the portal is the only initial channel. If the portal is inaccessible, the participant may breach the deadline through no fault of its own.

Sixth, the transitional provision at section 10(b) catches additional information on reports made before commencement. If an industry participant has an open incident from before the new instrument commences and later obtains further information, that further information must be reported under the new rules, not the old. That means the participant must comply with the new fields and channels for that follow up, even though the original report was governed by the 2018 instrument.

Seventh, the instrument does not specify a retention period for records of reports. Industry participants should keep copies of all reports and any supporting information for at least the period required by the Act or by general recordkeeping obligations (e.g., under the Archives Act 1983). In the event of an audit or investigation, the Department may request those records.

Compliance with the instrument requires a systematic approach. First, industry participants should map their current incident reporting procedures against the new requirements. The previous 2018 instrument is repealed, so any existing forms, templates, and workflows must be updated. This includes updating incident response plans, checklists for reportable information, and staff training materials.

Second, identify who within the organisation has the duty to become aware of incidents and escalate them. “Awareness” should be imputed as soon as any employee with a reporting obligation (e.g., security guards, operations staff, IT personnel) learns of an incident. The organisation should implement a mandatory internal reporting obligation on all relevant employees, with a clear chain of escalation. The internal deadline for notifying the designated reporting officer should be much shorter than the external deadline (e.g., within 2 hours for a significant cyber incident, given the 12 hour external deadline).

Third, ensure that the designated reporting officers have access to the reporting channels. For security incidents, they need the phone number 1300 791 581, the URL for the online form, and the email address transport.security@homeaffairs.gov.au. For cyber incidents, they need the ACSC portal URL (Report | Cyber.gov.au) and the Department’s form URL. They should test access to these channels regularly to confirm they are operational. Have offline backup procedures in case the online systems are unavailable.

Fourth, prepare a checklist of required information for each type of incident. The checklist should include all fields in sections 6 and 8. For security incidents, the list includes 11 mandatory items plus up to 5 additional subsections depending on the incident type. Have a template document or internal form that prompts for each field. Make sure staff know that if information is missing, they must still submit the report by the deadline and provide the missing information within 24 hours of obtaining it.

Fifth, for cyber incidents, make a decision at the organisational level about whether to consent to the ACSC sharing reports with the Secretary. If the organisation consents, it avoids the secondary report, which reduces compliance burden. If it does not consent, it must build a separate process to submit the same information to the Department’s form within the 12 hour or 72 hour deadline. Consider legal advice on the implications of consent, particularly regarding data use and potential enforcement.

Sixth, establish a system for tracking incidents from awareness through reporting and follow up. Use a log or incident management software that records the time of awareness, the time of report, and any updates. This log will be critical evidence if the Department questions compliance.

Seventh, train staff on the distinction between security incidents and cyber security incidents, and on the different timeframes and channels. A common error could be reporting a cyber incident through the security incident phone line, which would miss the required use of the ACSC portal and potentially miss the tighter deadline.

Eighth, review the transitional provision. Identify any incidents that were reported before the commencement date but for which additional information may still be provided. Ensure that any such additional information is reported under the new instrument’s requirements.

Ninth, consider the cost of compliance, particularly for the 12 hour cyber deadline. This may require 24/7 availability of a reporter with authority to submit the report and knowledge of the required fields. For small operators, it may be cheaper to outsource this function to a security service provider that can handle reporting on the operator’s behalf. However, the operator remains legally responsible for compliance.

Tenth, periodically audit compliance by reviewing a sample of past incidents to confirm that reports were made on time and contained all required information. Correct any deficiencies in procedures. The Department may audit an industry participant’s compliance history during a Transport Security Program review.