##### 30AG  Responsible entity must submit annual report ###### Scope - \(1\) This section applies if, during a period \(the relevant period\) that consists of the whole or a part of a financial year: - \(a\) an entity was the responsible entity for one or more critical infrastructure assets; and - \(b\) the entity had a critical infrastructure risk management program that applied to the entity\. ###### Annual report - \(2\) The entity must, within 90 days after the end of the financial year, give: - \(a\) if there is a relevant Commonwealth regulator that has functions relating to the security of those assets—the relevant Commonwealth regulator; or - \(b\) in any other case—the Secretary; a report that: - \(c\) if the entity had the program at the end of the financial year—includes whichever of the following statements is applicable: - \(i\) if the program was up to date at the end of the financial year—a statement to that effect; - \(ii\) if the program was not up to date at the end of the financial year—a statement to that effect; and - \(d\) if a hazard had a significant relevant impact on one or more of those assets during the relevant period—includes a statement that: - \(i\) identifies the hazard; and - \(ii\) evaluates the effectiveness of the program in mitigating the significant relevant impact of the hazard on the assets concerned; and - \(iii\) if the program was varied during the financial year as a result of the occurrence of the hazard—outlines the variation; and - \(da\) if one or more of those assets are critical telecommunications assets: - \(i\) includes a summary of the changes \(if any\) the entity notified during the relevant period under subsection 30EC\(2\); and - \(ii\) describes the risks \(if any\) advised to the entity during the relevant period under paragraph 30ED\(3\)\(c\); and - \(iii\) describes the measures \(if any\) the entity adopted during the relevant period to eliminate or reduce risks advised to the entity during the relevant period or any previous period; and - \(iv\) includes a statement that evaluates the effectiveness of those measures to eliminate or reduce risks advised to the entity during the relevant period or any previous period; and - \(db\) if the entity was given a direction under section 30AI during the relevant period—includes a statement that: - \(i\) sets out the content of the direction; and - \(ii\) sets out how the program was varied in response to the direction; and - \(e\) is in the approved form; and - \(f\) if the entity has a board, council or other governing body—is approved by the board, council or other governing body, as the case requires\. Civil penalty: 150 penalty units\. - \(3\) A report given by an entity under subsection \(2\) is not admissible in evidence against the entity in civil proceedings relating to a contravention of a civil penalty provision of this Act\. --- ## Source and attribution Saved copy: C2018A00029 / C2026C00213 / f578e546a17068939a3a5a928474713f844dfae8 Scope: navPoint\_73 Compiled 2026\-06\-04\. This does not establish legal commencement\. Official source: https://www\.legislation\.gov\.au/C2018A00029/2026\-06\-04/2026\-06\-04/text/1/epub/OEBPS/document\_1/document\_1\.html Licence: https://creativecommons\.org/licenses/by/4\.0/ Based on content from the Federal Register of Legislation at 1 October 2026\. For the latest information on Australian Government legislation please go to https://www\.legislation\.gov\.au\. Converted XHTML into Tiptap JSON; recovered lists from paragraph classes; kept literal labels and text\. Print layout is changed\. The Commonwealth Coat of Arms is not covered by the CC BY licence\.