The Cyber Security Act 2024 has become law in Australia. As part of its implementation, on 4 March 2025 the Australian Department of Home Affairs introduced the Smart Devices Security Standards Rules 2025, which set mandatory cybersecurity requirements for consumer smart devices.

The smart device security rules take effect on 4 March 2026, giving manufacturers and distributors one year to bring products into compliance. Similar to the requirements of EN 303 645, manufacturers and distributors must comply with strict security measures, including:

1. A ban on universal default passwords.

2. Implementation of a vulnerability reporting mechanism.

3. Definition of a support period for security updates.

To sell consumer IoT products in Australia, companies must provide a statement of compliance confirming adherence to these security standards. The document must include the product type and batch identifier, manufacturer and representative details, the statement of compliance, support period information, and place, date and signature.