Which of the following are excellent sources of information regarding regulatory requirements?

​​​​​The Department of Agriculture, Water and the Environment controls exports of agricultural products. This assures our trading partners that Australian agricultural products meet import requirements.

Efficient regulation of exports is the cornerstone of Australia’s reputation as a​n excellent source of reliable agricultural exports.

The department’s responsibilities and powers are defined in the Export Control Act 2020, Export Control Rules and associated legislation. We recover the cost of providing export services through export fees and charges.

Understand the steps for exporting goods out of Australia and your responsibilities depending on the product and your role in the export process.

Go to step-by-step guidance

Commodities controlled by the department

Export commodities controlled by the department are listed or ‘prescribed’ in the legislation. Prescribed goods—or goods included in a class of prescribed goods—include:

• milk and milk products
• eggs and egg products
• fish and fish products
• live animals
• meat and meat products
• poultry meat and poultry meat products
• rabbit and ratite meat and rabbit and ratite meat products
• wild game meat and wild game meat products
• organic products
• plants and plant products
• wood and woodchips.

Why some products are prescribed in the legislation and others are not

The objective of the legislation is to enable trade by ensuring that export commodities meet importing country requirements and are fit for purpose. If the commodity is a food, it must be:

• fit for human consumption
• accurately described and labelled
• fully traceable, if necessary.

The legislation sets out the list of requirements that must be met by an exporter before prescribed goods can be exported from Australia. Non-prescribed goods are not required to meet these requirements to be exported. However, where required to meet importing country requirements the department can issue export certification for non-prescribed goods.

The main types of non-prescribed goods are:

• processed foods
• wool
• animal feed and pet food
• animal by-products (such as rendered products, blood products and skins and hides)
• honey

Some animal or plant by-products may be exempt from government control under the legislation, such as:

• fish oil for manufacturing or pharmaceutical purposes
• fish meal for pet food

A separate Export Control Rule exists for each type of prescribed good (for example, the Export Control (Meat and Meat Products) Rules 2021). These specific commodity Rules set out the specifications to be used when determining if a particular product should be deemed as a prescribed good under each commodity type.

See also:​

Preparing to export a prescribed commodity

For prescribed products, the Export Control legislation defines the compliance requirements for export businesses.

For the export of live animals please refer to Exporting Live Animals. 

Requirement for registration

All premises (including fishing vessels) where goods prescribed in the legislation are prepared for export must be registered to undertake those operations by the department under the Export Control Act 2020.

Preparation for export includes:

• slaughter of animals and dressing of carcasses
• capturing or taking fish
• processing, packing or storage of goods
• pre-export quarantine or isolation, treatment and testing of livestock
• treatment of goods
• handling or loading of goods.

The business manager must complete an Export registration form (EX26) and the establishment must be constructed and have appropriate equipment and work practises to comply with export legislation. The establishment will be audited to confirm compliance with export requirements.

Once the department provides a letter and certificate of registration, the establishment can produce a product for export. The registration certificate should be prominently displayed in the establishment.

Some importing countries may require Australian establishments to be listed before export.

Fit and proper person test

People participating in Australia’s export industry are subject to an integrity test called the fit and proper person test when applying for export licences and other regulatory approvals.

Compliance with relevant standards

Your establishment and the operations that you conduct in that establishment must meet minimum standards, including export standards and importing country requirements.

Export standards

Compliance with the standards in the export legislation will enable you to access many international markets.

Importing country requirements

Some trading partners place additional requirements on establishments that want to export to them. See importing country requirements on Micor.

For example, the European Union requires that hormone growth promotants (HGPs) or oestradiol and its ester-like derivatives are never used on cattle intended to produce meat products for European markets. The European Union also requires that these cattle have life time segregation from all other cattle. The department manages the European Union Cattle Accreditation Scheme (EUCAS) to enable establishments to meet this requirement.

An importing country may impose a requirement for listing. This means that the importing country will maintain a list of establishments that are allowed to export to them. In some cases, importing countries will expect the establishment to be successfully audited by their own officials. The department regularly hosts delegations of international officials conducting audits on establishments that want to export to these markets.

Business must have an approved arrangement

When an establishment requests to become export registered, it must have a completed approved arrangement available for assessment by the department. Application for an establishment’s approved arrangement or to vary an approved arrangement must be made on an EX26 application form. 

All export registered establishments, including vessels, involved in the preparation, handling and storage of dairy, egg, fish and meat products destined for human consumption must have an approved arrangement agreed by the department.

An establishment’s approved arrangement is a ‘How to export’ document specifically written for that establishment. The approved arrangement should include the specific processes and procedures that will enable the establishment to successfully export. An approved arrangement covers all the commodities that the establishment wants to export and the requirements of destination markets.

For plants and plant products controlled by the department, an application for registration of an export establishment must be accompanied by plans, specifications and evidence of an operational record-keeping system.

Cost

We charge a fee for this service—see Charging guidelines 2021.

Documentation of export consignments

Exporters of meat, fish, dairy, eggs, grain, horticulture, skins and hides, wool and meat by-products, such as pharmaceuticals, blood and pet food, use electronic certification and may generate their own health certificates and related documents by registering as an Export Documentation System (EXDOC) Electronic Data Interface (EDI) user.

When exporters also register for the Single Electronic Wi​ndow (SEW)​, EXDOC can generate an export declaration number (EDN) necessary for Integrated Cargo System clearance, to streamline the export process.

Specific requirements for certain commodities

Meat export licence

If you export beef, sheep or goat meat, you must obtain a meat export licence.

European Union Cattle Accreditation Scheme (EUCAS)

Beef exported from Australia to the European Union (EU) must be sourced from farm or feedlot properties and saleyards accredited by the department under the European Cattle Accreditation Scheme (EUCAS).

Regulatory compliance is an organization's adherence to laws, regulations, guidelines and specifications relevant to its business processes. Violations of regulatory compliance often result in legal punishment, including federal fines.

Examples of regulatory compliance laws and regulations include the Payment Card Industry Data Security Standard (PCI DSS), Health Insurance Portability and Accountability Act (HIPAA), Federal Information Security Management Act (FISMA), Sarbanes-Oxley Act (SOX), EU's General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).

Why is regulatory compliance important?

As the number of rules has increased since the turn of the century, regulatory compliance management has become more prominent in a variety of organizations. The development has led to the creation of corporate, chief and regulatory compliance officer and compliance manager positions. A primary job function of these roles is to hire employees whose sole focus is to ensure the organization conforms to stringent, complex legal mandates and applicable laws.

Regulatory compliance processes and strategies provide guidance for organizations as they strive to attain their business goals. Audit reports proving compliance help companies market themselves to customers. For example, Service Organization Control 1 reports enable vendors to prove compliance with regulations such as SOX. Being transparent about compliance processes helps clients build trust in business processes, as well as potentially improve the profitability of the company in the process.

Some regulatory compliance rules are designed specifically to ensure data protection. Poor data breach compliance processes can hurt customer retention and negatively impact a company's bottom line. With the frequency of data breaches continuing to increase, consumers are placing more trust in companies that closely follow regulatory compliance mandates designed to protect personal data.

Data privacy-specific regulatory compliance mandates, such as GDPR and CCPA, have become more common as companies' handling of consumers' personal data has come under scrutiny.

What are challenges that come with regulatory compliance?

Companies that do not follow mandatory regulatory compliance practices face numerous possible repercussions, such as being forced to participate in remediation programs that include on-site compliance audits and inspections by the appropriate regulatory agency. Noncompliant organizations usually face monetary fines and penalties. Brand reputation can also be damaged by companies that experience repeated -- or particularly glaring -- compliance breaches.

Following compliance rules can be costly from an infrastructure and personnel standpoint. As companies are required to spend capital in order to comply with compliance laws and regulations, they must also try to appease stakeholders and maintain business processes by turning a profit. These financial challenges surrounding compliance are particularly acute in highly regulated industries, such as finance and healthcare. Other business strategy-associated challenges that come with maintaining regulatory compliance include the following:

• determining how emerging regulations will influence business direction and existing business models;
• incorporating and developing a compliance culture and promoting this culture throughout the organization;
• deciding on and hiring compliance roles and accountabilities, as well as the compliance functions required by legal, compliance, audit and business departments; and
• anticipating compliance trends and integrating regulatory processes that increase efficiency.

Constantly evolving consumer technologies also pose compliance complications for companies. The use of personal mobile devices by employees in the workplace, for example, creates compliance concerns because these devices store sensitive, compliance-relevant company data. The proliferation of the internet of things has led to huge growth in the number of endpoints and interconnected devices, and lacking security for mobile and IoT devices creates compliance vulnerabilities in organizations' networks. For digitized companies to remain compliant, they must stay on top of required updates and immediately patch existing software when vulnerabilities are detected.

How is compliance different across industries, countries?

Some industries are more heavily regulated than others. For example, the financial services industry is subject to regulatory compliance mandates designed to protect the public and investors from nefarious business practices. Energy suppliers are subject to regulations for safety and environmental protection purposes. Government agencies are required to follow compliance regulations that mandate equality and ethical staff behavior.

Healthcare companies are also subject to strict compliance laws because they store large amounts of sensitive and personal patient data. Hospitals and other healthcare providers must demonstrate they have taken steps to comply with patient privacy rules, such as providing adequate server security and encryption. HIPAA outlines data privacy and security mandates designed to secure patients' medical information. The HIPAA Breach Notification Rule, for example, requires compliant organizations and their business associates to notify patients following a data breach. In addition to healthcare providers, cloud service providers (CSPs) and other business associates of healthcare organizations must also comply with HIPAA privacy, security and breach notification rules.

Regulatory compliance mandates vary by country. SOX is U.S. legislation, but similar regulations include Germany's Deutscher Corporate Governance Kodex (DCGK) and Australia's Corporate Law Economic Reform Program Act 2004 (CLERP 9).

Multinational organizations must be cognizant of the regulatory compliance rules of each country they operate within. For example, GDPR went into effect in 2018 and applies to all data produced by EU citizens, whether or not the company collecting the data is located within the EU. GDPR also applies to all people whose data is stored within the EU, regardless of if they are EU citizens.

GDPR expanded the data privacy rights of consumers by including transparency mandates that force businesses to inform customers how their personal data is used. For example, companies operating under GDPR compliance rules are required to notify all affected parties and supervising authorities of a data breach within 72 hours.

Under CCPA, California residents are provided the right to know what data is being collected about them, whether that information is sold and the ability to refuse that data being sold. The act also mandates consumers can access any of their personal information collected by CCPA-compliant companies.

A 2018 Vermont law requires data brokers to disclose to individuals exactly what data is being collected and enables those individuals to opt out of data collection. Several other states in the U.S. are considering their own data privacy regulations to varying degrees, while countries such as Australia, Argentina and Canada have established comprehensive data privacy laws at the federal level.

How do companies ensure regulatory compliance?

Regulatory compliance requires companies to analyze their unique requirements and any mandates specific to their industry and then develop processes to meet these requirements. Typical steps to achieve regulatory compliance include the following:

1. Identify applicable regulations. Determine which laws and compliance regulations apply to the company's industry and operations. These include federal, state and municipal rules.
2. Determine requirements. Identify the requirements in each regulation that are relevant to the organization, and consider plans on how to implement these mandates.
3. Document compliance processes. Clearly document compliance processes, with specific instructions for each role involved in maintaining compliance. This information will be useful during regulatory audits.
4. Monitor changes, and determine whether they apply. Compliance requirements are updated constantly. Changes must be monitored to determine if they are relevant to the company. If they are, implement updated procedures, and train the appropriate staff on these updates.

In-house compliance audits should be conducted regularly to review the organization's adherence to regulatory guidelines. These in-house audit reports should closely evaluate compliance processes and their associated policies, such as user access controls.

In-house audits also help prepare for externally conducted, formal compliance audits carried out by independent third parties. These audits are required under some regulatory compliance mandates and are designed to measure if an organization complies with specific state, federal or corporate regulations.