Australia, European Union, United States, Singapore

Cyber security laws for smart devices in Australia, the EU, the US and Singapore

Connected consumer devices now face mandatory security rules: Australia’s smart device standard (since 4 March 2026), the EU’s RED cybersecurity requirements (since 1 August 2025) and Cyber Resilience Act (reporting from September 2026, full rules from December 2027), and US state laws such as California’s SB-327. Singapore’s labelling scheme is expected by retailers.

Last reviewed 27 October 2026 · A planning guide, not legal or certification advice.

Check your exact product

Roadblock lists every step that applies to what you’re launching, for each market, in order.

Try: “A smart door lock with Wi-Fi and a phone app, sold in Australia, the EU, the US and Singapore”

The common baseline

The rules differ in detail but share a baseline that comes from ETSI EN 303 645: no universal default passwords, a public way to report vulnerabilities, and a stated period during which the product gets security updates. Design these in before freeze; adding them after testing usually means retesting.

Australia

Since 4 March 2026, consumer products that connect to the internet or to an app are likely in scope of the smart device security standard. They need unique passwords per device, a vulnerability disclosure channel and a stated support period, and a Statement of Compliance must ship with every unit made since that date.

European Union

Since 1 August 2025, radio equipment that connects to the internet, handles personal data or moves money must meet RED Articles 3.3(d), (e) and (f), usually through EN 18031-1, -2 and -3; some configurations need a notified body. The Cyber Resilience Act adds vulnerability and incident reporting from 11 September 2026 and, from 11 December 2027, secure-by-design requirements, a support period and CE marking under the CRA for products with software and a data connection.

United States and Singapore

California (SB-327) and Oregon require reasonable security features such as unique passwords. The voluntary U.S. Cyber Trust Mark can show buyers you’ve gone further. Singapore’s Cybersecurity Labelling Scheme rates devices from level 1 to 4; it’s voluntary for most devices but expected by retailers, and levels 1 and 2 follow ETSI EN 303 645.

Steps, time and cost

Planning ranges from Roadblock’s register (A$, excluding your own staff time). Which steps apply depends on the product; run an analysis for yours.

Step	Market	Typical time	Typical cost
Smart device cyber security and Statement of Compliance	AU	4–8 wk	A$2,000–20,000
RED cybersecurity requirements	EU	4–10 wk	A$5,000–25,000
Cyber Resilience Act	EU	6–16 wk	A$5,000–40,000
State IoT security laws	US	2–6 wk	A$2,000–20,000
Cybersecurity Labelling Scheme	SG	2–8 wk	A$3,000–20,000

Questions

Does my smart device need to comply with Australia’s cyber security rules?

Likely yes if it’s a consumer product that connects to the internet or an app. Since 4 March 2026 it needs unique passwords, a vulnerability reporting channel, a stated support period and a Statement of Compliance.

What is EN 18031?

The harmonised standard series most manufacturers use to meet the EU Radio Equipment Directive cybersecurity requirements: part 1 for internet-connected equipment, part 2 for personal data and part 3 for equipment that moves money.

When does the Cyber Resilience Act apply?

Reporting of actively exploited vulnerabilities starts 11 September 2026. The full requirements, including CE marking under the CRA, apply from 11 December 2027.