.png){kind=small}
Australia's New IoT Security Rules, and What the UK, EU and US Require
For most of the IoT industry's history, security was a matter of conscience. Good engineers used strong authentication, encrypted their traffic and shipped updates. Others didn't, and the market rarely noticed the difference until a botnet made headlines.
That era is over. In 2026, cybersecurity became a legal condition of selling many connected products in Australia, and the same shift is under way in the UK, the European Union and the United States. If you design, manufacture or import smart devices, security is now part of compliance, documentation and lifecycle planning, not just good engineering practice.
The short version:
Australia: since 4 March 2026, consumer smart devices must have no universal default
passwords, a published way to report vulnerabilities, and a declared security support period.
United Kingdom: near-identical rules have applied to consumer connectable products since
29 April 2024 under the PSTI regime.
European Union: the Cyber Resilience Act's vulnerability and incident reporting obligations
began on 11 September 2026; the full set of requirements applies from 11 December 2027.
United States: the voluntary U.S. Cyber Trust Mark labelling program, run by the FCC, is
being rolled out to make product security visible on the shelf.
The mechanisms differ, but the message is the same: the organisation that designs and sells a connected product is responsible for keeping it secure for as long as it is supported.
IoT cybersecurity regulations at a glance
Market | Regulation | Mandatory? | Applies from | Products covered | Core requirements |
Australia | Cyber Security (Security Standards for Smart Devices) Rules 2025 | Yes | 4 March 2026 | Consumer smart devices (excludes PCs, tablets, smartphones, vehicles, therapeutic goods) | No universal default passwords; vulnerability reporting channel; published support period with end date |
United Kingdom | PSTI Act 2022 and 2023 Regulations | Yes | 29 April 2024 | Consumer connectable products | Same three as Australia; statement of compliance |
European Union | Cyber Resilience Act | Yes | Reporting: 11 Sept 2026; full: 11 Dec 2027 | Almost all products with digital elements, consumer and industrial | Secure-by-design, vulnerability handling, 24/72-hour reporting, support period, CE marking |
United States | U.S. Cyber Trust Mark | No (voluntary) | Rolling out in 2026 | Consumer wireless IoT products | Lab testing against FCC criteria; label with QR |
The EU is the outlier in reach: it covers industrial products and software, not just consumer devices. If you sell into Europe, the CRA is likely to be your hardest requirement.
Australia: mandatory smart device security since 4 March 2026
The Cyber Security (Security Standards for Smart Devices) Rules 2025 became mandatory on 4 March 2026, twelve months after they were registered under the Cyber Security Act 2024. They are Australia's first enforceable security standard for consumer IoT.
What's in scope. The Rules cover internet-connectable products manufactured on or after 4 March 2026 that are reasonably expected to be bought by Australian consumers for personal, domestic or household use. Think smart TVs, smart watches, voice assistants, baby monitors, IP cameras, video doorbells, smart locks, smart plugs, connected appliances and internet-connected toys.
What's out of scope. Desktop and laptop computers, tablets, smartphones, therapeutic goods, and road vehicles and their components are excluded (section 8 of the Rules has the full list). Products manufactured before 4 March 2026 don't need to comply.
The Rules closely follow the first three principles of ETSI EN 303 645, the European baseline standard for consumer IoT security, and the UK's PSTI requirements. In practice, that means three obligations.
1. No universal default passwords
Each device needs a unique password or a credential the user sets. Passwords can't follow predictable or publicly known patterns, such as a serial number or admin .
It sounds simple, but it reaches into the factory. A product built at volume needs a reliable way to generate, provision and track unique credentials without slowing the production line or complicating setup for the customer.
2. A published way to report vulnerabilities
Manufacturers must publish free, accessible contact details for reporting security issues, and explain how reports will be acknowledged and how reporters will receive status updates.
The inbox is the easy part. The hard part is having the engineering capability behind it: someone who can work out whether a reported flaw actually affects your firmware, your wireless stack or a third-party library, and what to do about it.
3. A declared security support period
Manufacturers must publish how long the product will receive security updates, including an end date. Once published, that period can't be shortened.
This turns security into a commercial commitment. Promise five years of updates and you are
committing to keep the source code, toolchain, signing keys and engineering knowledge needed to ship patches for five years.
Statements of compliance and enforcement
Manufacturers must prepare a statement of compliance, and suppliers must not supply in-scope products that don't comply. The Cyber Security Act 2024 gives the regulator compliance, stop and recall notices to enforce the Rules.
What comes next in Australia
The three obligations are a floor, not a ceiling, and the government has already said where it is heading.
Horizon 2 (2026–2028). The Horizon 2 Action Plan of the 2023–2030 Australian Cyber Security Strategy commits to extending secure technology standards to more connected technologies used in homes and businesses, including routers, operational technology, consumer energy resources, smart devices and connected vehicles. Home Affairs is also co-designing standards with industry for consumer-grade edge devices used by small businesses.
A national security label. On 2 September 2026, Cyber Security Minister Tony Burke launched the pilot of the Voluntary Security Labelling Scheme for Smart Devices, co-developed by Home Affairs and the Connected Technology Alliance. The certification label is meant to give shoppers independently verified security information at the point of sale, and to give manufacturers a way to stand out.
If your product will be on the market for five or ten years, design it for where the rules are going, not just where they are today.
European Union: the Cyber Resilience Act's reporting clock is already running
If Australia sets a floor, the EU's Cyber Resilience Act (CRA) builds the whole house. It applies to almost every "product with digital elements" sold in the EU, consumer or industrial, hardware or software, and it regulates the full lifecycle: risk assessment, secure design, development, production, vulnerability handling and support.
The CRA entered into force in December 2024 and is phasing in:
11 September 2026: manufacturers must report actively exploited vulnerabilities and severe security incidents. This obligation is already live.
11 December 2027: the rest of the CRA applies, including the essential cybersecurity
requirements, conformity assessment and CE marking.
The reporting duties catch many teams off guard for two reasons. First, they apply to products already on the EU market, not just new designs. Second, the deadlines are measured in hours:
Stage | Actively exploited vulnerability | Severe incident |
Early warning | Within 24 hours of becoming aware | Within 24 hours of becoming aware |
Notification | Within 72 hours | Within 72 hours |
Final report | Within 14 days after a fix or mitigation is available | Within one month of the 72-hour notification |
All reports go through ENISA's Single Reporting Platform, which opened on 11 September 2026 and passes them to the relevant national CSIRT (European Commission).
A 24-hour deadline is impossible to meet by improvisation. You need to know what software is inside each product, who decides whether an issue is reportable, and who can file at 2 a.m. on a Sunday. That means having processes, documentation and engineering capability in place before the first report arrives.
United Kingdom: the PSTI regime, in force since April 2024
The UK got there first. Its consumer connectable product security regime, made under Part 1 of the Product Security and Telecommunications Infrastructure Act 2022 (PSTI), has applied since 29 April 2024.
The three core requirements will look familiar: passwords must be unique per product or set by the user, manufacturers must publish how to report security issues, and the minimum security update period must be disclosed. In-scope products must be accompanied by a statement of compliance, which the UK regulator has confirmed can be provided digitally.
The resemblance to Australia's Rules is deliberate. Both draw on ETSI EN 303 645, so a product designed to meet one is well on the way to meeting the other.
Well on the way is not the same as compliant, though. Scope, exemptions, who counts as the manufacturer, and what the statement of compliance must contain all differ between the two. Treat each market as its own assessment.
United States: the Cyber Trust Mark is back on track
The US has chosen persuasion over mandate. The U.S. Cyber Trust Mark, created by the Federal Communications Commission in March 2024, is a voluntary label for consumer wireless IoT products. Products tested by accredited labs can carry the mark plus a QR code linking to their security details.
The program's road has been bumpy. Its original lead administrator, UL Solutions, withdrew in December 2025 after the FCC began investigating the company's ties to China. In April 2026, the FCC appointed the ioXt Alliance as the new lead administrator, announced label administrators in August, and recognised accreditation bodies on 28 September 2026. The program is still being rolled out, so watch the FCC's page for when certified products start reaching shelves.
Why does a voluntary label matter? Security has always been invisible to buyers, even when a
manufacturer spent heavily on it. Labels in the US, and now Australia, turn that work into something a shopper or procurement team can see and compare. Security is becoming a selling point, not just a compliance cost.
Why compliance is an engineering problem, not a paperwork problem
Every one of these regimes rests on the same principle: security has to be designed in, not bolted on before launch. A typical IoT product combines embedded firmware, wireless links, a mobile app, cloud services, APIs and third-party components. A decision in one layer ripples through the rest.
Secure updates start in the bootloader
Promising a five-year support period is easy. Delivering it means the device can receive, verify and install updates safely, and recover if one fails. That touches the bootloader, flash layout, firmware signing, key management, the update server and the rollback strategy. Retrofitting it after the hardware is frozen ranges from painful to impossible.
Device identity starts on the production line
Unique credentials for every unit need a provisioning step in manufacturing or commissioning. Encrypted communications may need per-device certificates and a plan for rotating keys over the product's life. These are factory and supply chain decisions as much as software ones.
You can't patch what you can't rebuild
Fixing a vulnerability three years after launch depends on things that quietly decay: the source code, the exact toolchain and build environment, the dependency versions, the signing keys and the documentation. A product that can't be reliably rebuilt can't be reliably secured, however strong its original design.
Third-party software is your problem too
Few teams write everything themselves. Real products ship with an RTOS or Linux, a vendor wireless stack, SDKs, cloud libraries and open-source components. When a flaw is disclosed in one of them, regulators expect you to know within hours whether your product is affected.
That is only possible with an accurate software inventory, ideally a Software Bill of Materials (SBOM) listing every component and version. Under the CRA, an SBOM becomes a documentation requirement from December 2027. Under every regime, it is the fastest route from "a CVE was published" to "here is our answer".
A checklist for IoT product teams
Not every product needs the same security architecture. A battery-powered consumer sensor and an industrial controller face very different risks. But every team should be able to answer these eight questions before the design is locked:
Where will it be sold? Target markets decide which rules apply. Pick them early enough to shape the architecture.
How will each device prove its identity? Plan credential provisioning and key management into both the product and the production line.
How will data be protected in transit? Map every interface between device, gateway, app, API and cloud.
How will firmware be updated? Signed updates, safe installation and recovery from failure need hardware support.
What third-party software is inside? Keep an SBOM so you can assess new vulnerabilities in hours, not weeks.
How will vulnerability reports be handled? Decide who receives them, who assesses them and who can file a CRA report within 24 hours.
How long will you support it? The support period you publish is a commitment of engineering time, budget and preserved tooling.
What happens at end of support? Plan how customers will be told and what the product should do when updates stop.
Answering these early is far cheaper than discovering the gaps during certification, or after a
vulnerability report lands.
Frequently asked questions
When did Australia's smart device security rules start?
The Cyber Security (Security Standards for Smart Devices) Rules 2025 became mandatory on 4 March 2026. They apply to in-scope consumer smart devices manufactured on or after that date.
Which devices are excluded from Australia's smart device rules?
Desktop and laptop computers, tablets, smartphones, therapeutic goods, and road vehicles and their components are excluded. Section 8 of the Rules has the full list.
What are the three requirements of Australia's smart device rules?
No universal default passwords, a published way to report security vulnerabilities, and a published security support period that includes an end date.
Are Australia's rules the same as the UK's PSTI requirements?
They are closely aligned, because both are based on the first three principles of ETSI EN 303 645. Scope, exemptions and documentation still differ, so each market needs its own compliance check.
When do the EU Cyber Resilience Act requirements apply?
Reporting of actively exploited vulnerabilities and severe incidents has applied since 11 September 2026. Most other requirements, including CE marking, apply from 11 December 2027.
What are the CRA reporting deadlines?
An early warning within 24 hours of becoming aware, a notification within 72 hours, and a final report within 14 days of a fix (vulnerabilities) or one month (severe incidents). Reports go through ENISA's Single Reporting Platform.
Is the U.S. Cyber Trust Mark mandatory?
No. It is a voluntary FCC labelling program for consumer wireless IoT products, being rolled out in 2026 with the ioXt Alliance as lead administrator.
Does Australia have a cybersecurity label for smart devices?
Yes, in pilot form. The voluntary Security Labelling Scheme for Smart Devices launched its pilot on 2 September 2026.
Do I need an SBOM for an IoT product?
The EU CRA requires one as part of technical documentation from December 2027. In every market, an SBOM is the practical way to check quickly whether a newly disclosed vulnerability affects your product.
Secure at launch is no longer enough
The four approaches differ, but they all move responsibility to the same place: the organisation that designs, makes and maintains the product. Shipping a secure device is now the starting line. The real question is whether you have the architecture, processes and engineering capability to keep it secure for every year you promised.
Connected products often stay in service for five to ten years or more. Over that time the threats will change, and so will the rules. Teams that design for that reality now will spend less, move faster through certification, and have a better story to tell customers.
How Genesys Electronics Design can help
Genesys Electronics Design is an Australian electronics product design house. We build cybersecurity into the full development lifecycle: electronics, embedded firmware, wireless communications, cloud connectivity, verification, compliance and long-term design maintenance.
That means helping you choose target markets early, design secure boot and update architectures, plan credential provisioning for manufacturing, maintain SBOMs, and keep products rebuildable and patchable for their whole supported life.
Developing a connected product? Talk to our engineering team about building in compliance from the first design review.
