Cyber Security (Security Standards for Smart Devices) Rules 2025

Relevant connectable product. This term is defined in the Cyber Security Act 2024 and captures products that can connect directly or indirectly to the internet. The Rules do not redefine it but rely on the Act’s definition. The instrument applies to a subclass: consumer grade relevant connectable products.

Consumer. Defined by reference to section 3 of the Australian Consumer Law (ACL). This includes a person who acquires goods for personal, domestic, or household use or consumption. It can also extend to small business acquisitions where the goods are of a kind ordinarily acquired for personal use. This definition matters because the Rules only apply to products acquired by a consumer. The manufacturer or supplier must be aware or reasonably expected to be aware that the product will be so acquired.

Consumer grade relevant connectable product. Section 8 prescribes the class: all relevant connectable products intended by the manufacturer to be used, or of a kind likely to be used, for personal, domestic or household use. Six categories are expressly excluded: desktop computers, laptop computers, tablet computers, smartphones, therapeutic goods under the Therapeutic Goods Act 1989, and road vehicles and components under the Road Vehicle Standards Act 2018. The exclusion of tablets and smartphones is notable because many IoT devices share similar chipsets and operating systems. A smart speaker with a screen might not be a tablet if it lacks general-purpose computing functionality.

Defined support period. Under subclause 4(3) of Schedule 1, this is a period expressed with an end date for which security updates will be provided by or on behalf of the manufacturer. The manufacturer must publish this period, must not shorten it after publication, and if extended must publish the new period as soon as practicable.

Security update. Defined in subclause 4(2) as a software update that protects or enhances the security of the product, including one that addresses a security issue discovered by or reported to the manufacturer. The definition covers only software updates; hardware security fixes are not captured.

Good industry practice. Defined in clause 1 of Schedule 1 as the exercise of the degree of skill, diligence, prudence and foresight reasonably and ordinarily expected from a skilled and experienced cryptographer engaged in the same type of activity. This is a high bar, as it sets the standard by reference to a specialist cryptographer, not a general software engineer. It applies to the requirement that passwords not be “guessable in a manner unacceptable as part of good industry practice” and to encryption methods used to derive passwords from product identifiers.

Unique per product. Means unique for each individual product of a given product class or type. This is central to password requirements: default passwords must either be unique per product or defined by the user.

Statement of compliance. A document prepared by or on behalf of the manufacturer containing the product type and batch identifier, manufacturer name and address, authorised representative details, declarations of compliance, the defined support period, and signatory details. The supplier must ensure the product is accompanied by this statement when supplied.

Recall notice. Referred to in Division 4. Under section 19 of the Act, a recall notice may be given to a manufacturer or supplier. The Rules require that if the regulator publishes a notification of failure to comply with a recall notice, it may include details of the notice and recommended consumer actions.

The primary targets are manufacturers and suppliers of consumer grade relevant connectable products. This includes Australian manufacturers, importers, and foreign manufacturers whose products are supplied into Australia. The instrument applies if the manufacturer is aware, or could reasonably be expected to be aware, that the product will be acquired in Australia by a consumer. For an overseas manufacturer selling via ecommerce platforms that ship to Australia, this awareness threshold is likely met. The obligations extend to manufacturers of hardware, pre-installed software, and software that must be installed for the manufacturer’s intended purposes, including software developed by third parties on behalf of the manufacturer. Suppliers include retailers, distributors, and online marketplaces that supply the product. They must not supply a non-complying product and must ensure a statement of compliance accompanies it. The Rules affect a broad range of product categories: smart home appliances (refrigerators, washing machines, air conditioners), smart lighting, smart locks, security cameras, voice assistants, children’s toys that connect to the internet, wearable fitness trackers, smart thermostats, and many other IoT devices. The exclusions for desktop computers, laptops, tablets, and smartphones carve out the largest consumer electronics categories but leave the fast growing IoT segment fully exposed. Therapeutic goods and road vehicles are also excluded, likely because they are already regulated by other Commonwealth bodies. The compliance burden falls disproportionately on small and medium enterprises that design or import a small number of product lines. For a large manufacturer like a global whitegoods brand, the cost of setting up a vulnerability disclosure program and publishing support periods is modest relative to revenue. For a startup selling a niche smart device, the legal fees alone to interpret “good industry practice” and draft a statement of compliance could be significant. The 12 month grandfathering period from registration to commencement runs from March 2025 to March 2026, so any product first supplied after that date must comply. Products already in the supply chain but not supplied to consumers by commencement may also need to comply unless there is a transitional arrangement (the instrument contains no express savings clause). Consumers are indirectly affected. They may benefit from stronger default security (unique passwords per device, a known security update period). But they will pay higher prices as manufacturers pass on compliance costs. They may also face reduced product variety if smaller firms exit the market or decline to ship to Australia. Consumers have no direct cause of action under these Rules but may have rights under the Australian Consumer Law if a product fails to match its statement of compliance or if security defects cause loss.

Manufacturers’ duties. The central duties are found in section 15 of the Cyber Security Act 2024, which the Rules operationalise. Manufacturers must manufacture products in compliance with the security standard in Part 1 of Schedule 1 if they are aware or could reasonably be expected to be aware that the product will be acquired in Australia by a consumer. The specific duties are:

• Password obligations (Schedule 1, clause 2): For hardware, pre-installed software, and software that must be installed for the product’s intended purposes, passwords must be either unique per product or defined by the user. If unique, they must not be based on incremental counters, publicly available information, or product identifiers unless encrypted using good industry practice. They must not be guessable in a manner unacceptable as good industry practice.

• Vulnerability reporting (clause 3): The manufacturer must publish at least one point of contact for reporting security issues, and state when the reporter will receive acknowledgement and status updates. The information must be accessible, clear, transparent, available without prior request, in English, free of charge, and without requiring personal information.

• Support period and security updates (clause 4): The manufacturer must publish the defined support period (with an end date) for security updates. It must not shorten the period after publication. If extended, the new period must be published as soon as practicable. The information must be prominently published on the manufacturer’s website if it offers the product there, and given equal prominence to the main characteristics of the product. It must be understandable to a reader without prior technical knowledge.

Suppliers’ duties. Under section 16 of the Act, a supplier must not supply a product in Australia if it does not comply, and must supply it accompanied by a statement of compliance that meets the requirements in Division 3 of the Rules. The statement must be prepared by the manufacturer or on its behalf, contain declarations of compliance, the defined support period, and signatory details. The supplier must retain the statement for 5 years (section 10). The supplier must also exercise diligence to avoid supplying non-compliant products.

Rights. The Rules do not confer direct rights on consumers. There is no private right of action for breach. However, consumers benefit from the mandatory publication of support periods and vulnerability contacts, which they can use when deciding to purchase. The statement of compliance may also assist in product liability claims under the ACL if the product does not meet the declared standard. The right to access information without providing personal information is notable; it limits the ability of manufacturers to collect marketing data through the vulnerability report portal.

The Rules themselves do not prescribe penalties. Instead, they are made under the Cyber Security Act 2024, which contains civil penalty provisions, infringement notices, and enforcement powers including recall notices. The relevant sections are invoked by the simplified outline in section 5: sections 15 and 16 of the Act require compliance with the security standard and the statement of compliance requirement. Breach of a civil penalty provision in the Act can result in penalties determined by a court, potentially up to the higher of a specified amount and three times the value of the benefit obtained. The instrument does not state the maximum penalty, so the reader must refer to the Act. The Rules also interact with the recall notice power in section 19 of the Act. If a manufacturer or supplier fails to comply with a recall notice, the Secretary may publish a notification of that failure on a website. Division 4 specifies the matters that may be published: details of the recall notice and actions consumers are recommended to consider, such as destroying the product or taking extra precautions when using it. This publication power is a significant enforcement tool because it can damage a company’s reputation and deter consumers from buying the product. There is no right of appeal or review mentioned in the Rules, though judicial review under the Administrative Decisions (Judicial Review) Act 1977 would likely be available for decisions to issue recall notices or publish non-compliance. The regulator (the Department of Home Affairs, or a delegate) has discretion to investigate and enforce. Given the large number of consumer smart devices and limited regulator resources, enforcement will likely be complaint-driven or target the most egregious cases. The 12 month lead time suggests the regulator expects industry to self-enforce through compliance preparations. For companies that ignore the Rules, the exposure is primarily to civil penalties and reputational harm from publication. There is no criminal liability created by the Rules. The absence of a private right of action means that a consumer who suffers loss (e.g., from a hacked device) cannot rely on breach of the Rules directly; they would need to rely on the ACL or state tort law.

The Rules sit within a broader regulatory framework. The primary law is the Cyber Security Act 2024, which provides the overarching scheme. The Rules are a legislative instrument made under that Act, so they must be consistent with its provisions. The Act defines key terms such as “manufacturer”, “supplier”, and “relevant connectable product”. The Rules must be read together with the Act. The Australian Consumer Law (ACL) is directly referenced. The definition of “consumer” in section 6 of the Rules imports section 3 of the ACL. This means that whether a product is covered depends on whether the acquirer would be a consumer under the ACL. The ACL also contains general safety standards and product liability provisions. A product that fails to meet the Rules’ security standards may also be unsafe under the ACL, leading to mandatory recall powers exercised by the ACCC. The interaction means a manufacturer could face action under both the Cyber Security Act and the ACL for the same conduct. The Therapeutic Goods Act 1989 and the Road Vehicle Standards Act 2018 are referenced as exclusions. Products regulated under those Acts are outside the scope of the Rules, even if they otherwise meet the definition of a relevant connectable product. This avoids duplication with the TGA’s regulation of medical devices and the Department of Transport’s regulation of vehicles. However, products on the borderline (e.g., a smart health wearable that is not a therapeutic good) are covered. The Privacy Act 1988 is not mentioned in the instrument but is relevant. The Rules require manufacturers to publish information about reporting security issues without requesting personal information (Schedule 1, clause 3(3)(d)). This limits the manufacturer’s ability to collect data through that channel, but does not restrict collection in other contexts. The Spam Act 2003 and the Competition and Consumer Act 2010 may also be relevant to how manufacturers communicate support periods. For international manufacturers, the Rules may conflict with or complement foreign regimes such as the EU Cyber Resilience Act, the UK Product Security and Telecommunications Infrastructure Act, and California’s IoT security law. Manufacturers selling globally will need to comply with multiple standards; the Australian requirements are broadly similar to the UK’s, which may allow some harmonisation.

This is the original instrument. It was made by the Minister for Home Affairs on 27 February 2025 and registered on 4 March 2025. There are no amending instruments as at the date of the text provided. The commencement table indicates that Part 1 (preliminary) and any provisions not elsewhere covered commenced on registration (4 March 2025). Part 2 and Schedule 1 (the substantive security standards and compliance obligations) commence on 4 March 2026, which is the day after the end of 12 months beginning on registration. This gap gives industry time to prepare, but it also means that the Rules in their current form only define the framework until March 2026. The potential for amendment exists under the Cyber Security Act 2024, which allows the Minister to vary the rules. Any future amendments would be published as separate instruments. Given that this is the first iteration of security standards for smart devices under the Act, it is plausible that the government will update the standards over time as technology evolves or as gaps are identified. For example, the definition of “good industry practice” may be clarified, or new product categories may be added or excluded. The instrument does not contain sunset or review clauses, but the Act may include provisions for periodic review.

There is no litigation history because the Rules have only recently been made and the substantive obligations do not commence until March 2026. No cases have been decided under the Cyber Security Act 2024 that interpret these Rules. Potential areas of future litigation include: challenges to the validity of the instrument (e.g., whether the standards exceed the scope of the Act); disputes over the interpretation of “good industry practice” and whether a manufacturer’s password generation method meets the standard; challenges to recall notices or publication of non-compliance on procedural fairness grounds; and disputes about whether a particular product falls within the exclusions (e.g., whether a device is a tablet computer or a smartphone). Because the Rules do not create private rights of action, most litigation will involve regulator actions subject to judicial review. Manufacturers may seek injunctions to prevent publication of non-compliance if they argue the regulator made an error. The term “consumer grade” and the ACL definition of consumer may also generate interpretive litigation, especially in borderline cases where a product is used both personally and in a business. Small businesses that acquire products for work purposes may or may not be consumers under the ACL definition, and that affects coverage.

The instrument contains several provisions that could trap unwary manufacturers and suppliers.

Good industry practice is defined by reference to cryptographers. Clause 1 of Schedule 1 says “the exercise of that degree of skill, diligence, prudence and foresight which would reasonably and ordinarily be expected from a skilled and experienced cryptographer.” This is a specialist standard, not a general software engineering standard. A manufacturer that uses an encryption method that is acceptable to a cryptographer might still be fine, but one that uses a simple hash without salt could be caught. Manufacturers should have their password derivation methods reviewed by a cryptographer.

Incremental counter prohibition covers subtle patterns. Clause 2(3)(a) prohibits passwords based on incremental counters. The definition gives the example “password1” and “password2”, but the prohibition may extend to any pattern where most characters are the same and only a small portion changes per product. A manufacturer that uses a sequential serial number as part of a password (e.g., serial number plus a static word) could fall foul if the counter is incremental.

User-defined passwords are an alternative to uniqueness. Clause 2(2)(b) allows passwords defined by the user. A manufacturer could ship the product with no default password and require the user to set one during first use. This avoids the cost of generating unique passwords per device. However, if the user skips the step or sets a weak password, the device may be insecure. The manufacturer’s duty is discharged, but the consumer may be worse off.

Defined support period must have an end date. The period cannot be open-ended like “for the lifetime of the product” unless that is expressed with an end date (e.g., “until 1 January 2030”). A manufacturer that tries to avoid binding itself by stating a period that extends indefinitely without an end date would not comply. Also, the period cannot be shortened after publication. If a manufacturer publishes a 5 year period and later decides to reduce it to 3 years, that is prohibited. The only permitted change is extension.

Statement of compliance must be prepared by the manufacturer. For imported products, the Australian supplier must obtain the statement from the overseas manufacturer. If the foreign manufacturer refuses or cannot provide it, the supplier cannot lawfully supply the product. This places responsibility on the importer to contractually require the statement and verify its accuracy.

Retention period of 5 years. Section 10 requires the statement of compliance to be retained for 5 years. This applies to both manufacturers and suppliers presumably (through the Act). Failure to produce the statement upon request could be a breach.

Information must be understandable by a reader without prior technical knowledge. Clause 4(6)(b)(v) applies to the support period publication. A manufacturer cannot simply post a technical document; it must explain the support period in plain language. This could be difficult for complex products where the security update policy has carve-outs.

No grandfathering for existing stock. The instrument does not contain a transitional provision to exempt products manufactured before 4 March 2026 but supplied after that date. A manufacturer that builds inventory before commencement may find that it cannot supply that inventory once the obligations kick in unless it can post-hoc comply (e.g., by updating firmware or preparing statements). This creates a risk of stranded stock.

Smartphones and tablets are excluded, but many IoT devices are increasingly similar. A smart display that runs a customised Android interface and can make video calls might be considered a tablet, but that is not guaranteed. The exclusion depends on how the product is marketed and its intended use. Litigation over what constitutes a “tablet computer” is possible.

Compliance involves several practical steps that manufacturers and suppliers should begin before 4 March 2026.

Step one: classify your product. Determine whether the product is a consumer grade relevant connectable product under section 8. Check if it is excluded (desktop, laptop, tablet, smartphone, therapeutic good, road vehicle or component). If the product is a smart light bulb, a connected thermostat, a smart pet feeder, a wearable fitness tracker, a smart doorbell, or similar, it is likely covered. If the product is also capable of business use, apply the ACL consumer test: is it of a kind ordinarily acquired for personal use?

Step two: redesign password generation. If the product currently ships with a single default password (e.g., “admin” or “1234”), that must change. Options: (a) assign a unique random password at the factory and print it on the device or packaging; (b) require the user to set a password during the initial set-up, and do not allow the device to operate without a password. If choosing option (a), ensure the password generation algorithm does not use incremental counters, is not based on serial numbers (unless encrypted with good industry practice), and is not guessable. Have a cryptographer review the method.

Step three: establish a vulnerability reporting channel. Set up an email address, web form, or other contact point for security researchers and consumers to report vulnerabilities. Publish the contact information prominently on your website. State when the reporter will receive acknowledgement and status updates. The information must be accessible without prior request (i.e., not hidden behind a login) and free of charge, in English, and without requiring the reporter’s personal information. Train your support team to handle reports.

Step four: determine and publish a defined support period. Decide how long you will provide security updates for the product. This period must have an end date. Consider the product’s lifecycle; shorter periods may be legally safer (since you cannot shorten them), but consumers may prefer longer periods. Publish the period on the website, prominently alongside the product’s main characteristics, and ensure it is understandable to a layperson. If you later extend the period, publish the new period as soon as practicable.

Step five: prepare a statement of compliance. For each product type and batch, create a document containing the product type and batch identifier, the manufacturer’s name and address (and authorised representatives), declarations of compliance with the security standard, and the defined support period. The statement must be signed by an authorised signatory. This statement must accompany the product when supplied. Electronic statements attached to the packaging or made available via a QR code may be acceptable, but the instrument requires the statement to be prepared by or on behalf of the manufacturer; it does not require a paper copy. Clarify with the regulator whether a digital link suffices.

Step six: ensure suppliers have the statement. If you are a manufacturer, provide your distributors and retailers with the statement of compliance. If you are a supplier (retailer or importer), obtain the statement from the manufacturer before offering the product for sale. Retain a copy for 5 years.

Step seven: review inventory before March 2026. Check all stock that will be supplied after 4 March 2026. If products were manufactured earlier and do not meet the standards, consider whether they can be updated (e.g., firmware update to fix password issues) or whether they must be disposed of or sold before commencement. If the product is already in the supply chain but not yet supplied to a consumer, it may still be caught.

Step eight: monitor for regulatory guidance. The Department of Home Affairs may issue guidance on interpreting “good industry practice”, “defining support period”, and other terms. Subscribe to updates. Consider engaging legal counsel with expertise in regulatory compliance and product security to review your compliance program.

Step nine: prepare for enforcement. Keep records of compliance decisions, vulnerability reports and responses, and copies of statements of compliance. If a regulator asks for evidence, you must be able to produce it. If a security issue arises that would affect compliance, consider voluntary recall or immediate security update.

The cost of compliance will vary. A small manufacturer may need to spend tens of thousands of dollars on legal advice, cryptographic review, and website changes. A large manufacturer can likely absorb the cost. The alternative is exposure to civil penalties and reputational damage from regulator publication of non-compliance. Compliance should be budgeted as a fixed cost of supplying to the Australian market.