New Australian Cybersecurity Rules for Smart Devices Take Effect
The Australian Government has officially released the Cybersecurity (Smart Device Security Standard) Rules 2025, a core implementing regulation under the Cybersecurity Act 2024, designed to address cybersecurity challenges posed by smart devices.
The Smart Device Security Rules will take effect on March 4, 2026, providing manufacturers and distributors with a one-year transition period to ensure compliance. Similar to the requirements of EN 303 645, relevant companies must implement strict security measures, including:
- Prohibiting the use of universal default passwords;
- Implementing vulnerability reporting mechanisms;
- Defining the support period for security updates.
Which Devices Are Covered by the New Cybersecurity Rules?
The regulation applies to “consumer-grade connectable products” that are acquired by consumers in Australia and can connect to the internet, either directly or indirectly.
1. Typical Products Covered Include:
- Network cameras/IP cameras, smart door locks, alarm systems
- Smart home assistants, smart home appliances
- Wearable devices
- Smart lighting fixtures, smart controllers, IoT base stations, etc.
2. Exempted Devices:
- Desktop computers or laptops;
- Tablet computers;
- Smartphones;
- Therapeutic goods as defined by the Therapeutic Goods Act 1989;
- Road vehicles as defined by the Road Vehicle Standards Act 2018;
- Road vehicle components as defined by the Road Vehicle Standards Act 2018.
Regulatory Enforcement Measures:
1. Pre-Certification Phase (Q1-Q3 2025): Companies submit security architecture plans for review.
2. Market Random Inspection Phase (From Q1 2026): Quarterly random testing of 10% of devices in circulation.
3. Penalties for Non-Compliance: Fines up to 4% of product sales revenue, or being blacklisted from government procurement.
Post time: Feb-28-2026
