Emergency Management (Critical Infrastructure Resilience) Regulations 2025

The Regulations operate by incorporation of external technical standards and guidance into the statutory framework that governs critical infrastructure resilience. Three core concepts structure the instrument.

1. Standard-based compliance. The Regulations do not codify substantive rules about risk management, exercises or audits in the text itself. Instead they require conformity with specified Australian and international standards and an Australian disaster-resilience handbook. Regulation 6 mandates that an emergency risk management plan be prepared "in accordance with" AS ISO 31000 and SA HB 436.1. Regulation 7 requires exercises to be "developed, conducted and evaluated" in accordance with the Managing Exercises handbook. Regulation 8 mandates audits in accordance with AS/NZS ISO 19011. Each provision ties a statutory duty under the Act (sections 74P, 74Q, 74S) to the content and methodology of an external publication.

2. Dynamic incorporation. Each of the three operative regulations pairs the statutory requirement with the phrase "as published from time to time" (regs 6-8). That phrase makes the Regulations' content depend on the current edition of each incorporated document rather than a single, fixed text. The Explanatory Details provide a snapshot of the versions applied on making, stating the whole of AS ISO 31000:2018, SA HB 436.1:2020, Managing Exercises 2023, and AS/NZS ISO 19011:2019 were applied. The combination of dynamic incorporation in the regulations and the explanatory table that lists current versions is a salient feature of the instrument.

3. Implementation lifecycle requirements. The Regulations specify lifecycle responsibilities rather than one-off outputs. For risk management, the requirement is the preparation of an emergency risk management plan in accordance with named standards (reg 6). For exercises, the requirement explicitly covers development, conduct and evaluation, a three-stage lifecycle (reg 7). For audits, the requirement is to conduct an audit in accordance with AS/NZS ISO 19011, a standard framed as "Guidelines for auditing management systems" (reg 8 and Explanatory Details). The Regulations therefore impose duties covering planning, implementation and review activities.

The Regulations are subordinate to and framed for the purposes of Part 7A of the Emergency Management Act 2013. They were made under the authorising provisions in sections 76 and 76A of that Act (regulation 2) and are expressly linked to specified Act provisions by the phrases "For the purposes of section 74P", "For the purposes of section 74Q" and "For the purposes of section 74S" in regulations 6, 7 and 8 respectively. The document also uses terminology such as "responsible entity" without defining that term in the Regulations themselves, signalling that definitional and other substantive matters remain in the parent Act.

The Regulations bind persons and entities who are "responsible entities" under the Emergency Management Act 2013 for the purposes of Part 7A. The Regulations themselves do not define "responsible entity"; each operative clause refers to duties to be carried out by a responsible entity "for the purposes of" particular sections of the Act (regs 6-8). Consequently the Regulations apply only to those organisations that the Act designates as responsible entities in Part 7A, as identified by the Act’s own definitions and allocation of responsibilities.

Practically, the following categories of actors will be directly affected.

• Responsible entities, who must prepare an emergency risk management plan, develop and run exercises and conduct audits in accordance with the incorporated standards (regs 6-8). The obligations are process- and standard-based, and they cover planning, exercise lifecycle and audit methodology.

• Entity management and boards, who are implicated by the inclusion of SA HB 436.1, a companion guideline directed to boards and executives (reg 6 and Explanatory Details). That inclusion signals a governance focus and will affect senior decision-makers in responsible entities when assembling or approving plans.

• Compliance, risk, and internal audit functions inside responsible entities, which will be required to design or oversee systems that produce plans compatible with AS ISO 31000, create exercises following the Managing Exercises handbook and conduct audits per AS/NZS ISO 19011. The audit requirement specifically references a standard framed as "Guidelines for auditing management systems," which places attention on audit process and competence (reg 8 and Explanatory Details).

• Providers of exercises, trainers and external auditors who deliver services to responsible entities. Because the Regulations require conformity with externally published technical documents, commercial suppliers that align their offerings to those documents will be in demand.

• The Department and regulators who administer and monitor compliance under the Emergency Management Act 2013. Enforcement mechanisms and penalties are not set out in these Regulations; the instrument is made under sections 76 and 76A of the Act and therefore operates within the Act’s enforcement architecture (reg 2). The Explanatory Details record that the Regulations were made by the Governor in Council on 17 June 2025 (Endnote 1) and come into operation on 29 June 2025 (reg 3).

Indirectly affected groups include counterparties, service providers and infrastructure users who may experience changes in how a responsible entity allocates resources, schedules outages for exercises, or modifies contracting to allow audits and exercises. The Regulations do not itself allocate costs or compensation for such third-party impacts; they impose process standards that responsible entities must meet.

Key duties flow from the three operative regulations and the instrument’s status as subordinate legislation under the Emergency Management Act 2013.

Duties

• Prepare an emergency risk management plan. Regulation 6 requires that, for the purposes of section 74P of the Act, an emergency risk management plan must be "prepared in accordance with" AS ISO 31000 and SA HB 436.1, as published from time to time. That duty is thus to produce a plan conforming to the processes and content set out by those documents.

• Develop, conduct and evaluate exercises. Regulation 7 requires that, for the purposes of section 74Q of the Act, an exercise be developed, conducted and evaluated in accordance with the Australian Disaster Resilience Handbook Collection,Managing Exercises. The obligation explicitly spans the development, operation and evaluation phases of exercise activity.

• Conduct audits. Regulation 8 requires that, for the purposes of section 74S of the Act, an audit be conducted in accordance with AS/NZS ISO 19011, which the Explanatory Details describe as guidelines for auditing management systems.

• Observe dynamic versions. Each duty is expressed as compliance with the named external instruments "as published from time to time" (regs 6-8). That means the duty includes following subsequent published editions unless and until the Regulations are amended to specify otherwise.

Rights and procedural context

• No penalties are set out in the Regulations themselves. The Regulations do not create offences or specify sanctions. Enforcement and any potential consequences for non-compliance will therefore depend on provisions of the Emergency Management Act 2013 under which these Regulations are made (regulation 2).

• Reliance on externally published guidance affords responsible entities an evidentiary path to show compliance. By following the specified standards and handbooks, entities can produce documentary evidence of having met the statutory tests in sections 74P, 74Q and 74S, subject to how the Act frames compliance, oversight and enforcement.

• The Regulations do not prescribe particular outcomes or set quantitative thresholds. They require adherence to standards and guidance documents that are procedural and methodological in nature. The content of those external documents will determine the substantive expectations.

• The Explanatory Details specify that the whole of each listed document was applied in S.R. No. 50/2025 (Explanatory details table). This provides a snapshot of what an auditor or regulator could reasonably expect to find at the time of making, but the Regulations’ phrasing allows for later published versions to be incorporated.

Operational implications of the duties

• Responsible entities must ensure that documentation, exercise design and audit processes align with the detailed recommendations and requirements set out in the adopted documents. The obligation to "develop, conduct and evaluate" an exercise covers the full exercise lifecycle and therefore requires planning, resourcing and post-exercise evaluation activities.

• Boards and executives will be implicated by the adoption of SA HB 436.1, which is described as a companion guideline for boards and executives and is incorporated by regulation 6.

The Regulations do not themselves set out offences, penalties or a detailed enforcement regime. They are made under sections 76 and 76A of the Emergency Management Act 2013 (regulation 2) and are expressly "for the purposes of" specific sections of that Act, namely sections 74P, 74Q and 74S (regs 6-8). As such, enforcement, penalties, compliance notices and powers to require information or take remedial action must be sought in and derived from the parent Act rather than from the Regulations’ text.

What the Regulations do tell us about enforcement-relevant matters

• No sanctions within the Regulations. There are no monetary penalties, infringement notice schemes or criminal offences created in S.R. No. 50/2025. Any consequences for non-compliance will therefore depend on the powers and penalties that the Emergency Management Act 2013 confers in relation to Part 7A, and on administrative steps the responsible regulator may take under the Act (regulation 2).

• Evidentiary implication. Because the Regulations prescribe particular standards and handbooks as the means of complying with the Act’s Part 7A requirements, adherence to those documents produces a standard of proof or compliance that a regulator or court could evaluate under the Act. The Regulations therefore shape enforcement activity by identifying the benchmarks against which conduct may be assessed (regs 6-8).

• Oversight and review functions likely in the Act. The Regulations make repeated reference to sections of the Act (74P, 74Q, 74S) as the statutory hooks for the delegated requirements. How those Act provisions empower regulators to inspect, require plans, mandate audits, impose directions or levy penalties is not set out here. The Regulations function as technical detail providers and rely on the Act for enforcement mechanics.

Practical enforcement and compliance risks

• The dynamic incorporation of external documents means that enforcement may involve reference to current editions of technical standards. Regulators and entities will need to be able to point to specific versions relied upon when assessing compliance. The Explanatory Details supply a contemporaneous list of versions applied at the time of making, but regulators or courts assessing conduct later may refer to later versions incorporated by the phrase "as published from time to time" (regs 6-8 and Explanatory details table).

• Without statutory penalties in the Regulations, regulators enforcing Part 7A will have to link any remedial or punitive action to the parent Act. That structure places significance on how the Act frames contraventions, notice powers and sanctions.

These Regulations are expressly subordinate legislation made under the Emergency Management Act 2013 and framed to give detail to Part 7A of that Act (regulation 2 and regs 6-8). Several textual cross-references and interpretative notes in the Endnotes also show interactions with other statutory instruments and statutory interpretation machinery.

Relationship with the Emergency Management Act 2013

• Authorising framework. The Regulations were made under sections 76 and 76A of the Emergency Management Act 2013 (regulation 2). Each operative regulation begins with "For the purposes of section 74P/74Q/74S of the Act", which ties the Regulations directly to those sections of the Act and makes the Regulations the prescribed method for satisfying particular duties under Part 7A (regs 6-8).

• Definitions and scope. The Regulations do not redefine key terms used in the Act, including "responsible entity", and therefore rely on the definitions and allocation of duties in the Act to determine who is in scope (regs 6-8).

Incorporation of external instruments and subordinate legislation rules

• Applied matter rules. The Explanatory Details include a Table of Applied, Adopted or Incorporated Matter that lists the documents whose whole content is applied: AS ISO 31000:2018; SA HB 436.1:2020; Managing Exercises 2023; and AS/NZS ISO 19011:2019. The table states that this inclusion was made in accordance with regulation 5 of the Subordinate Legislation Regulations 2024 (Explanatory details table). That procedural cross-reference shows the Regulations’ compliance with rules about incorporated documents.

• Dynamic incorporation. The Regulations say "as published from time to time" (regs 6-8). The effect is to incorporate future published versions of those documents into the regulatory standard, subject to the limits of the Subordinate Legislation Regulations and any interpretative constraints in the Interpretation of Legislation Act 1984.

Interpretation of Legislation Act 1984 (ILA) and other interpretative machinery

• The Endnotes set out statutory interpretation notes from the ILA, including the treatment of headings, examples, punctuation and provision numbers as forming part of a Statutory Rule made after 1 January 2001. Those notes are interpretative aids that apply to this Statutory Rule and determine how courts and administrators treat the Regulations’ structure and non-substantive matter (Endnotes: Interpretation).

Interaction with the Subordinate Legislation Act 1994

• Sunset. The Explanatory Details record that these Regulations will sunset ten years after the day of making, on 17 June 2035, pursuant to section 5 of the Subordinate Legislation Act 1994 (Endnote 1). That interacts with the lifecycle of subordinate legislation and imposes a statutory expiry on the current instrument unless extended or remade.

Absence of conflict clauses

• The Regulations do not include express savings, transitional provisions or conflict-resolution clauses with other statutory instruments. Any conflict between an incorporated standard and other legal obligations would therefore be resolved by general principles of statutory interpretation and by the parent Act’s primacy over subordinate legislation.

Practical cross-compliance implications

• Because the Regulations adopt whole external documents "as published from time to time", responsible entities must comply with both the Act and the current technical standards. Practical compliance therefore demands aligning operational policies with multiple instruments simultaneously: the Emergency Management Act 2013, these Regulations, and the current editions of AS ISO 31000, SA HB 436.1, the Managing Exercises handbook and AS/NZS ISO 19011.

The Regulations record a concise amendment history in the Endnotes.

• New instrument and revocation. These Regulations, S.R. No. 50/2025, were made on 17 June 2025 and came into operation on 29 June 2025 (regulation 3 and Endnote 1). Regulation 4 expressly revokes the Emergency Management (Critical Infrastructure Resilience) Regulations 2015 (regulation 4 and Explanatory details: Reg. 4: S.R. No. 82/2015).

• No subsequent amendments. The Explanatory Details include a Table of Amendments which records that there are no amendments to the Emergency Management (Critical Infrastructure Resilience) Regulations 2025 made by statutory rules, subordinate instruments or Acts (Endnote 2). At the time the version in this Statutory Rule was published, no modifications had been made.

• Applied documents table. The Explanatory Details supply a Table of Applied, Adopted or Incorporated Matter setting out the specific versions applied on making. The table lists AS ISO 31000:2018 (published 30 October 2018), SA HB 436.1:2020 (published 23 October 2020), Managing Exercises 2023, and AS/NZS ISO 19011:2019 (published 22 August 2019) as the "whole" of each applied document (Explanatory details table). This table functions as a contemporaneous record of which versions were in effect when the Statutory Rule was made.

• Sunset and lifecycle. The Explanatory Details also record that the Regulations will sunset ten years after the making date, on 17 June 2035, pursuant to the Subordinate Legislation Act 1994 (Endnote 1). That automatically limits the duration of the instrument unless it is remade, replaced or extended in accordance with the governing subordinate legislation rules.

Points to note when tracking amendments

• Dynamic incorporation versus fixed snapshot. Although the Explanatory Details document the versions applied at making, the operative regulations adopt the approach "as published from time to time", which imports later editions of the incorporated documents unless the Regulations are amended. Any formal amendment to which responsible entities must attend will therefore be either an amendment to the Regulations themselves or a change in practice arising from a later edition of an incorporated external document.

• No transitional arrangements recorded. The instrument does not set out transitional arrangements for entities that had begun compliance under the revoked 2015 Regulations. Practitioners should consult the parent Act and any guidance from the administering authority for transitional expectations.

The Statutory Rule and its Endnotes do not record any litigation. The Explanatory Details contain no references to court decisions, challenges, or judicial interpretation of these Regulations. The Table of Amendments records no changes made by court order or subsequent legislative amendment (Endnote 2).

What this absence means for practitioners

• No reported judicial interpretation. Because there is no recorded litigation in the materials, there are no reported judicial determinations construing the Regulations’ incorporation of external standards, the meaning of "as published from time to time", or the way the Regulations interact with the enforcement provisions of the Emergency Management Act 2013.

• Reliance on regulatory and administrative practice. In the absence of case law, compliance expectations and contested interpretations will initially be shaped by administrative guidance, regulator practice and the text of the incorporated documents themselves. Responsible entities should therefore seek contemporaneous regulatory guidance and document their decisions and processes carefully when following the prescribed standards.

• Potential areas for future litigation. The Regulations create potential questions that could be litigated in future, including disputes over which version of an incorporated standard applies at a given time; whether a particular exercise or audit satisfies the corresponding standard; and how the parent Act’s enforcement provisions should be applied where non-compliance with a standards-based requirement is alleged. None of those issues have been decided as of the making of S.R. No. 50/2025, according to the Endnotes.

Several features of the Regulations give rise to practical pitfalls that responsible entities and their advisers should note.

1. Dynamic incorporation of whole documents. Regulations 6-8 require compliance with external instruments "as published from time to time" (regs 6-8). That means the benchmark for compliance can change when Standards Australia or the Australian Institute for Disaster Resilience publishes a revised edition. The Explanatory Details contain a snapshot of the versions applied on making, but the Regulations’ operative wording leaves room for later versions to apply automatically. Entities should therefore monitor updates to the adopted documents and record which version they relied on for any particular plan, exercise or audit.

2. "The whole" of each document is applied. The Explanatory Details state that the whole of each listed publication is applied (Explanatory details table). That means an entity must consider every part of those publications, including annexes and guidance sections that may be advisory or recommendatory in character. Compliance may therefore require attention to materials that are not regulatory in form but are adopted in full.

3. Access and cost. The Regulations do not reproduce the substantive content of the standards and handbook. Responsible entities will need to obtain the current publications to implement the requirements. The Explanatory Details record publication dates and identifiers for the applied documents, but the Regulations do not provide a free source for the content. Entities should budget for acquisition costs and ensure staff and external providers have access to the relevant editions.

4. Standards are procedural and guidance-focused. The adopted documents are framed as guidelines and handbooks rather than prescriptive statutory clauses. AS ISO 31000 and SA HB 436.1 are risk management guidance; the Managing Exercises handbook covers exercise design and evaluation; AS/NZS ISO 19011 is described as guidelines for auditing management systems. A "guidelines" standard may be less precise on mandatory thresholds than statute, but because the Regulations make adherence to those guidelines the statutory mechanism for compliance, the practical effect is to harden guidance into a compliance benchmark. Practitioners should therefore treat guideline language carefully when documenting conformity.

5. No enforcement text in the Regulations. Because the Regulations do not specify penalties or enforcement mechanisms, practitioners must look to the Emergency Management Act 2013 for enforcement consequences. That creates a disconnect between the technical specification in the Regulations and the enforcement tools, which may complicate compliance planning where the Act’s enforcement approach is unclear or administrative practice has not been published.

6. Revocation of the 2015 Regulations. Regulation 4 revokes the 2015 Regulations. Absent transitional language, entities moving from prior compliance regimes should review whether earlier plans, exercises and audits remain compliant with the newly adopted documents and whether any revisions are required to preserve legal compliance.

7. Governance expectations signalled through SA HB 436.1. The inclusion of a companion guideline for boards and executives implies an expectation of senior governance involvement. Entities whose board governance materials do not align with SA HB 436.1 should consider formal involvement of senior executives in approving plans and receiving post-audit or post-exercise reports.

8. Sunset in ten years. The Explanatory Details record that these Regulations will sunset on 17 June 2035 (Endnote 1). Entities should be aware that the instrument has a statutory expiry and that longer-term strategic investments may be influenced by the limited lifetime of the Regulations.

9. Lack of internal definitions. Key terms used in these Regulations, including "responsible entity", are not defined in the Statutory Rule. Entities must consult the parent Act to determine whether they fall within scope and to understand any Act-level definitions and duties.

10. Documentary proof of compliance. Because compliance is tied to standards and handbooks, a responsible entity will need robust documentary trails showing which edition was used, when the plan/exercise/audit took place, who authorised it and how the content aligns to the adopted documents. Loose or informal record-keeping will be a risk if compliance is later assessed under the Act.

Compliance under these Regulations is document- and process-driven. The following steps set out a practical compliance roadmap grounded in the Regulations’ text and the Explanatory Details.

1. Confirm status as a responsible entity. The Regulations apply to "responsible entities" as contemplated by Part 7A of the Emergency Management Act 2013. Confirm from the Act whether your organisation is designated a responsible entity and identify any Act-specified duties that intersect with regs 6-8.

2. Determine which versions apply. Although the Explanatory Details list specific versions applied on making, the operative language of regs 6-8 requires compliance with the named documents "as published from time to time". Record the edition you will follow for each obligation and maintain version control. As at making, the Explanatory Details identify:

   • AS ISO 31000:2018 Risk management,Guidelines (published 30 October 2018)
   • SA HB 436.1:2020 Risk management guidelines,Companion to AS ISO 31000,Part 1: Boards and executives (published 23 October 2020)
   • Australian Disaster Resilience Handbook Collection,Managing Exercises 2023 (published 2023)
   • AS/NZS ISO 19011:2019 Guidelines for auditing management systems (published 22 August 2019) Use these references as the initial compliance baseline and update records if later versions are relied upon.

3. Obtain the adopted documents. Acquire copies of the current editions of AS ISO 31000, SA HB 436.1, Managing Exercises, and AS/NZS ISO 19011 and distribute them to the teams responsible for risk, exercises and audit. The Regulations require conformity with the content of these publications but do not themselves set out the steps, so the actual guidance will be in those materials.

4. Prepare an emergency risk management plan per AS ISO 31000 and SA HB 436.1 (reg 6). Implement the standard risk management process set out in AS ISO 31000 and apply governance-focused recommendations in SA HB 436.1. Ensure the plan is dated, version-controlled and approved at the appropriate governance level, consistent with SA HB 436.1’s orientation to boards and executives. Keep documentary records showing alignment between plan elements and clauses in the applied standards.

5. Design, conduct and evaluate exercises per the Managing Exercises handbook (reg 7). The regulation requires exercises to be developed, conducted and evaluated. Establish a process that covers exercise objectives, scenario design, roles and responsibilities, participant selection, logistical arrangements, safety and evaluative criteria. After each exercise, produce an evaluation report that maps findings and corrective actions to the Managing Exercises guidance and to the entity’s emergency risk management plan.

6. Conduct audits in accordance with AS/NZS ISO 19011 (reg 8). Implement an audit program that follows the auditing principles, programme management and auditor competence guidance set out in AS/NZS ISO 19011. Retain audit plans, evidence collection records and post-audit reports that demonstrate methodological conformity to the standard.

7. Document governance and approval. Because SA HB 436.1 targets boards and executives, ensure that the board or equivalent governance body receives the emergency risk management plan, exercise reports and audit findings. Record approvals, minutes and any delegated authority.

8. Maintain version and change control. Because the Regulations allow incorporation of future versions "as published from time to time", maintain a register showing which editions of the adopted documents were used for each plan, exercise and audit. If a later edition is adopted internally, record the rationale, effective date and any transitional adjustments.

9. Budget for access and external expertise. The adopted documents are external publications. Budget for procurement of standards, staff training, exercise logistics and any external auditors or exercise convenors required to deliver measures in line with the applied documents.

10. Link compliance to the Act. Because these Regulations do not create penalties, link your compliance program to the parent Act’s requirements, and seek legal or regulatory guidance where the Act’s enforcement mechanisms, reporting obligations or notice procedures intersect with the standards-based duties here.

11. Prepare for review and updates. Monitor Standards Australia and the Australian Institute for Disaster Resilience for updates to the adopted documents. When a new edition is published, reassess and, if necessary, update plans, exercise methodologies and audit processes to maintain compliance with the text "as published from time to time".

12. Retain records. Keep comprehensive records sufficient to demonstrate, if required under the Act, that plans, exercises and audits were performed in accordance with the adopted documents. Records should include version identifiers, dates, participant lists, terms of reference, evaluation reports and evidence of corrective actions.

13. Seek administrative guidance where necessary. In the absence of enforcement text in the Regulations, obtain regulator guidance or seek confirmatory advice, especially if there is ambiguity about how the parent Act applies to the standards-based obligations.

Following these steps aligns practical activity with the statutory language of regulations 6 to 8 and the contemporaneous versions recorded in the Explanatory Details. Documentation, version control and governance approvals are central to evidentiary proof of compliance should oversight or enforcement action be considered under the Emergency Management Act 2013.