Division 1—Preliminary

:::box The rules may provide mandatory security standards for products that can directly or indirectly connect to the internet (called relevant connectable products) that will be acquired in Australia in specified circumstances.

If the rules provide a security standard for a product:

• (a) manufacturers must manufacture the product in compliance with the requirements of the security standard if they are aware, or could reasonably be expected to be aware, that the product will be acquired in Australia in the specified circumstances; and
• (b) those manufacturers must also comply with any other obligations relating to the product in the security standard (for example, obligations to publish information about the product); and
• (c) if the product does not comply it must not be supplied in Australia if the supplier is aware, or could reasonably be expected to be aware, that the products will be acquired in Australia in those specified circumstances; and
• (d) those suppliers must supply the product in Australia accompanied by a statement of compliance.

A compliance notice, a stop notice and a recall notice may be given for non‑compliance with obligations in this Part. Internal review may be sought for a decision to issue a notice.

An independent audit of a product may be undertaken to determine compliance with the requirements of a security standard or requirements for the statement of compliance. The Secretary may request the manufacturer or supplier to provide the product, the statement of compliance or both for the purposes of the audit. :::

• (1) This Part applies to a relevant connectable product that is:
• (a) manufactured on or after the commencement of this Part; or
• (b) supplied (other than as second hand goods) on or after the commencement of this Part.
• (2) A relevant connectable product is a product that:
• (a) is an internet‑connectable product or a network‑connectable product; and
• (b) is not exempted under the rules.
• (3) For the purposes of paragraph (2)(b), the rules may specify that:
• (a) classes of products are exempted; or
• (b) particular products are exempted.
• (4) An internet‑connectable product is a product that is capable of connecting to the internet using a communication protocol that forms part of the internet protocol suite to send and receive data over the internet.
• (5) A network‑connectable product is a product that:
• (a) is capable of both sending and receiving data by means of a transmission involving electrical or electromagnetic energy; and
• (b) is not an internet‑connectable product; and
• (c) meets the condition in subsection (6) or (7).
• (6) A product meets the condition in this subsection if it is capable of connecting directly to an internet‑connectable product by means of a communication protocol that forms part of the internet protocol suite.
• (7) Subject to subsections (8) and (9), a product meets the condition in this subsection if:
• (a) it is capable of connecting directly to 2 or more products at the same time by means of a communication protocol that does not form part of the internet protocol suite; and
• (b) it is capable of connecting directly to an internet‑connectable product by means of such a communication protocol (whether or not at the same time as it connects to any other product).
• (8) A product consisting of a wire or cable that is used merely to connect the product to another product does not meet the condition in subsection (7).
• (9) If:
• (a) two or more products are designed to be used together for the purposes of facilitating the use of a computer (within the ordinary meaning of that expression); and
• (b) at least one of the products (the linking product) is capable of connecting directly to an internet‑connectable product (whether the computer or some other product) by means of a communication protocol that does not form part of the internet protocol suite; and
• (c) each of the products (the input products) that is not a linking product is capable of connecting directly to the linking product, or, if there is more than one linking product, to each linking product:
  • (i) wirelessly; and
  • (ii) by means of a communication protocol that does not form part of the internet protocol suite;

each of the input products meets the condition in subsection (7).

• (10) For the purposes of subsections (4) to (9), a product is not prevented from being regarded as connecting directly to another product merely because the connection involves the use of a wire or cable.