Meta description: What changed in Australian RCM compliance in 2026? We cover the AS/NZS 62368.1:2026 switch, the two-part EESS fee structure, risk levels and their two clocks, the smart-device cybersecurity rules, and the phone and tablet exemption.
When an Australian project lands on the desk, the first job is working out which body is in charge. EMC and radio fall to ACMA under the Radiocommunications Act, while electrical equipment safety sits with EESS. A product with a wireless module has to clear both.
The standards come in several sets as well. EMC follows harmonised standards such as AS/NZS CISPR 32; safety for audio-visual and IT equipment follows the AS/NZS 62368.1 series; household appliances go to 60335.
The responsible supplier named on the RCM mark must hold an ABN in Australia. An overseas factory cannot sign on its own behalf, so most manufacturers appoint an Australian importer or put a local subsidiary in place. European authorised-representative arrangements do not transfer: what Australia wants is a local legal entity carrying joint liability, and an agent stamping paperwork achieves nothing. Keep supplier agreements in their original form, because customs and buyers may ask to see them.
Reports to the old standards are no longer accepted for new projects. AS/NZS 60950.1 and 60065 have been retired in favour of the 62368.1 series. On 6 May 2026, Standards Australia published AS/NZS 62368.1:2026, aligned with IEC 62368-1:2023, fourth edition. It took effect on publication, runs alongside the 2022 edition, and carries a transition period to 6 March 2029. Existing machines holding a Certificate of Conformity under the previous edition stay valid until that certificate expires, while new projects are tested to the current edition rather than drawn to the old one.
Since 1 July 2025 the fee structure has split in two. One part is a responsible supplier annual fee, shared across every product under a single ABN and not multiplied by product count. The other is the product registration fee, paid once for whichever term is chosen - one, two or five years. Rates are adjusted each 1 July in line with inflation, so budgets should not hard-code an Australian dollar figure; work from the current rates published by EESS.
Products are classified into Level 1, Level 2 and Level 3. Level 1, the low-risk band, works on self-declaration of conformity with registration optional, though the supplier entity still has to register. Level 2 is mandatory registration supported by a test report and a declaration of conformity. Level 3, the high-risk band, needs a Certificate of Conformity first and registration afterwards.
The two clocks matter here. A Certificate of Conformity runs five years, registration is chosen in one, two or five year terms, and the registration period cannot outlast the remaining validity of the certificate. Two time limits, two expiry dates.
The Cyber Security (Security Standards for Smart Devices) Rules 2025 worked through a twelve-month transition and took effect on 4 March 2026. Three baselines apply. Universal factory default passwords are banned - passwords must be unique per device or set by the user. A security issue reporting channel must be published, with the timescales for acknowledgement and response stated. And the security update support period must be published with an end date, which cannot be shortened once it is out.
Compliance runs on self-assessment plus a declaration of conformity, with declarations and records held for five years. Third-party testing is not required.
Schedule 8 of the rules lists desktops, laptops, tablets and smartphones, along with therapeutic goods and road vehicles. These categories skip the cybersecurity design requirements in the previous section, and they are usually not filed as high risk on the safety side either. A bundled power adapter is counted separately, though, and often lands in the high-risk catalogue. EMC and radio testing still apply as normal, so the exemption should not be read as a pass on the whole certification.
A standard cited by number alone, with no year, is returned by the EESS system. EMC harmonised standards roll with new versions, so it is worth checking the current edition before submitting anything.
The same applies on the safety side after the 62368.1 change. A report drawn against a superseded edition is not accepted for a new project, even where the test data behind it would still pass. Confirming the edition takes ten minutes on the standards body's site; rebuilding a report that has already been issued takes weeks and a fresh sample round.
BlueAsia has handled these rejections at the counter often enough to know the cost: the resubmission reshuffles the whole schedule.
Use what is left of the old certificate window, but know where change stops. A change of appearance or a non-critical part can go through a variation assessment and save schedule against a full repeat. Touching the safety standard, or altering the power supply, antenna, main control or RF circuit, means fresh reports.
Build separate ledgers for the two fees. The supplier annual fee and the product registration fee fall due on different dates. Let the annual fee lapse and the registration status of every product under that ABN shows up abnormal, which a buyer audit will find quickly.
Assemble the cybersecurity evidence early. Password policy, reporting channel and support-period statement are not verbal commitments: the design documents and the published product page have to agree with each other.
Contact: King
Email: king.guo@cblueasia.com
Address: Building C, Hongjingda Industrial Park, No. 107 Beihuan Road, Shiyan Street, Bao'an District, Shenzhen, China BlueAsia delivers more than service!
Related News
