Cyber Security Act 2024

This Part applies to a relevant connectable product that is:

manufactured on or after the commencement of this Part; or

supplied (other than as second hand goods) on or after the commencement of this Part.

A relevant connectable product is a product that:

is an internet‑connectable product or a network‑connectable product; and

is not exempted under the rules.

For the purposes of paragraph (2)(b), the rules may specify that:

classes of products are exempted; or

particular products are exempted.

An internet‑connectable product is a product that is capable of connecting to the internet using a communication protocol that forms part of the internet protocol suite to send and receive data over the internet.

A network‑connectable product is a product that:

is capable of both sending and receiving data by means of a transmission involving electrical or electromagnetic energy; and

is not an internet‑connectable product; and

meets the condition in subsection (6) or (7).

A product meets the condition in this subsection if it is capable of connecting directly to an internet‑connectable product by means of a communication protocol that forms part of the internet protocol suite.

Subject to subsections (8) and (9), a product meets the condition in this subsection if:

it is capable of connecting directly to 2 or more products at the same time by means of a communication protocol that does not form part of the internet protocol suite; and

it is capable of connecting directly to an internet‑connectable product by means of such a communication protocol (whether or not at the same time as it connects to any other product).

A product consisting of a wire or cable that is used merely to connect the product to another product does not meet the condition in subsection (7).

If:

two or more products are designed to be used together for the purposes of facilitating the use of a computer (within the ordinary meaning of that expression); and

at least one of the products (the linking product) is capable of connecting directly to an internet‑connectable product (whether the computer or some other product) by means of a communication protocol that does not form part of the internet protocol suite; and

each of the products (the input products) that is not a linking product is capable of connecting directly to the linking product, or, if there is more than one linking product, to each linking product:

wirelessly; and

by means of a communication protocol that does not form part of the internet protocol suite;

For the purposes of subsections (4) to (9), a product is not prevented from being regarded as connecting directly to another product merely because the connection involves the use of a wire or cable.