Council of theEuropean Union
Brussels, 13 March 2024
(OR. en)7462/24
Interinstitutional File:2022/0155(COD)

LIMITE
JAI 413
ENFOPOL 116
CRIMORG 43
IXIM 84
DATAPROTECT 128
CYBER 78
COPEN 126
FREMP 137
TELECOM 108
COMPET 279
MI 266CONSOM 96
DIGIT 72
CODEC 704

NOTE
From:
To:

Presidency
Law Enforcement Working Party (Police)

No. prev. doc.:

6850/24

Subject:

Proposal for a Regulation of the European Parliament and of the Council
laying down rules to prevent and combat child sexual abuse‒

New approach suggested by the Presidency

With a view to the Law Enforcement Working Party (Police) meeting on 19 March 2024,
delegations will find an explanatory note on the refined approach by the Presidency, Annex I withcorresponding text proposals on Articles 1, 5, 5a, 7 and 10 of the above proposal, and Annex II withthe risk categorisation table.

7462/24
JAI.1

GR/ml

1

LIMITEEN

Explanatory note
During the LEWP meeting of 1 March 2024, the Presidency presented its new approach for the
proposed Regulation laying down rules to prevent and combat child sexual abuse outlined in
document 6850/24 and delegations discussed the specific questions included in that document. At
the end of the meeting, the Presidency concluded that there was sufficient support to proceed withthe further development of this new approach. In response to the request by some delegations forfurther explanations on certain parts of the new approach and taking into account the comments ofthe delegations (either expressed during the LEWP meeting or in writing), the Presidency further
clarifies and develops its proposed approach in this explanatory note.
As set out in document 6850/24 and presented during the LEWP meeting of 1 March 2024, theproposed new approach is a combination of two interlinked building blocks: (1) more targeted
detection orders, through enhanced risk assessment and risk categorisation and (2) protecting cybersecurity and encrypted data, while keeping services using end-to-end encryption within the scope ofdetection orders.
This note provides further details as well as adaptations to respond to the comments of somedelegations on the first building block, divided into three main elements: (1) risk categorisation, (2)mitigation measures and (3) detection orders as possible consequences of that risk categorisation.
The Presidency has included concrete text proposals (see Annex I to this note) that reflect its
proposed new approach as set out in document 6850/24 and further refined in this note. This
explanatory note illustrates and explains these text proposals.

7462/24
JAI.1

GR/ml

2

LIMITEEN

1) Risk categorisation
The Presidency suggests developing a methodology for determining the risk of specific services orparts or components thereof. The idea would be to establish three categories in which (parts orcomponents of) services could be classified as high-risk, medium-risk, low-risk. This classification
would be objectively defined following a specific procedure and based on a set of objective
parameters (for example related to the type of service, the core architecture of the service, theprovider’s policies and safety by design functionalities and user tendencies). This process offers
guidance to service providers how to self-assess the risks related to CSA on their services andprovides a methodology and criteria to the Coordinating Authority to assess what kind of measures
are needed to address these remaining risks. Depending on the category, the results will bedifferent: A higher risk means a higher level of safeguards and a higher number of obligations forthe providers.
The proposed procedure fits into the current procedure included in Articles 3-7 of the proposed
regulation:
1.

Risk assessment and “self-categorisation” by the service provider: This first step obliges theservice providers to analyse their services in terms of risks related to CSA in line with Article
3, to take the necessary mitigation measures in line with Article 4 and to facilitate the risk
categorisation by the Coordinating Authority using a template that would be part of theregulation as ANNEX I1.

2.

Reporting by the service provider: The service provider must report the result of the risk
assessment, the mitigation measures, and the self-assessment to the Coordinating Authority.
The Coordinating Authority is responsible for verifying the categorisation to ensure that theprocess has been followed and that no errors have been made. The Coordinating Authority
can ask for additional information, explanations, or data to carry out its verification. The
Coordinating Authority then validates the category proposed by the service provider or
categorises the service in another category.

1

In that regard, the presidency shared a working document (WK 3036/2024) and is still
waiting for delegations’ contributions.

7462/24
JAI.1

GR/ml

3

LIMITEEN

At this stage, providers may indicate whether they have identified a risk in their service or apart or component thereof that might flag the possible need to receive a detection order (seemore details below). This indication would not systematically trigger the issuance of adetection order. The decision to ask a judicial or independent administrative authority for theissuance of a detection order stays with the Coordinating Authority only.
The EU Centre would provide support to the Coordinating Authority as well as to the service
providers. The involvement of the EU Centre throughout the risk assessment and mitigation
procedure is already included in the text of the proposed regulation, and a specific reference
to supporting the risk categorisation is added to Article 5. For example, the EU Centre could
provide information or recommendations on the mitigation measures that could be
implemented or offer to carry out sampling in order to draw certain trends from the data
included in this service and match certain categorisation criteria.
3.

Categorisation decision/ validation: The Coordinating Authority decides about theclassification of the (part or component of the) service in one of the four categories.
Depending on the category, different measures have to be taken by the provider (see below).
The Coordinating Authority will inform as soon as possible the provider about its
categorisation decision and the measures to be taken.

4.

Recategorisation: Depending on the category allocated, the (part or component of the) service
will need to be subjected to recategorisation, at least, after a certain period of time (See Annex
II to this note). The regulation could provide a maximum term for each of the three categories
in the current Article 3(4). For example:-

High risk: up to 12 months-

Medium risk: up to 24 months-

Low risk: up to 36 months

As these terms are maximum terms, the Coordinating Authorities would have the flexibility todetermine the precise duration within the maximum time set. The Coordinating Authority
could already inform the service provider of that term when issuing its categorisation
decision. The Coordinating Authority can launch the recategorisation procedure at any time(for example when it learns about CSA on a service through flagging).

7462/24
JAI.1

GR/ml

4

LIMITEEN

2) Additional mitigation measures
While all providers are obliged to carry out the mitigation measures outlined in Article 4, dependingon the category the service is classified in, different types of tailored (depending on the specifics ofthe service) additional mitigation measures apply in accordance with the amended Article 5a,
including consequences in case of non-compliance:-

High-risk and medium-risk services: obligatory additional mitigation measures. Whenissuing the categorization decision to the provider, the Coordinating Authority will justify thereasons why it requested the provider to apply additional mitigation measures. Noncompliance will result in penalties based on Article 35 of the regulation. The penalties
imposed for high-risk services would be stricter and more severe than for medium-risk
services;-

Low risk services: recommended additional mitigation measures to help the provider identify
possible improvements for its service. No penalties for non-compliance. However, theCoordinating Authority can, at any time, ask the provider to launch a recategorisation
procedure possibly resulting in the imposition of obligatory mitigation measures if theservice would be recategorized as a high-risk or medium-risk service.

3) Detection Orders
Taking into account the comments from delegations, the Presidency proposes to subject only highrisk services (or parts or components thereof) to detection orders as a measure of last resort if theadditional mitigation measures do not address the high risk identified in an effective way. The
Coordinating Authority will have the discretion to tailor the detection order to the specific risks
identified during the risk assessment/categorisation. The Coordinating Authority must, however,always aim for the least intrusive type of detection. Criteria that could be used for such tailoring andwould be verified by the competent authorities issuing the detection order upon the request of a
Coordinating Authority include:7462/24
JAI.1

GR/ml

5

LIMITEEN-

the period of application of the detection order;-

the technologies used;-

the impact on the protection of inter-personal communication;-

the possibility to limit the scope to parts or components of a service;-other safeguards provided for in accordance with Art. 7(8)(a) “Users of interest” based reporting
The risk categorisation allows for more targeted, and therefore non-indiscriminate, detection as only
(parts or components of) services identified as high risk will be subjected to tailored detection
orders. A further possible way to target the reporting is to only allow the report based on detection
to be limited to certain users of interest.
A user of interest could be defined as a user who has already been flagged as potential sender orrecipient of child sexual abuse material or grooming attempts. This would be automatically detected
but not known to anyone (including the provider), until a certain number of hits in the users’
accounts is reached on the sharing of possible CSAM or attempted grooming. This can be broken
down into two phases:
Phase 1: determination of the user of interest
The provider having received a detection order for known CSAM, new CSAM and/or grooming
would put in place the necessary mechanisms to detect the ‘interest’, i.e. hits with possible known
CSAM/new CSAM and/or grooming, with the following conditions:o The possible hit would be detected automatically, and it would not be reported.
o Therefore, no one, including the provider, would be aware of that hit.
o The only information extracted from that data processing would be whether a possible
hit linked to that user has taken place. This information would be automaticallyrecorded on the user’s account, e.g. via a flag, and it would not be available to anyone,
not even the provider.
o This would mitigate the concern of intrusion of privacy by the provider or anybody
else on users that are not linked to any child sexual abuse activity.

7462/24
JAI.1

GR/ml

6

LIMITEEN

In the case of adult users, a ‘user of interest’ would be a user for which hits have been automatically
identified (and without anyone being aware) for a number of times depending on the type of CSA
online, taking into account the different accuracy rates: for known CSAM: 1 time and for new
CSAM and grooming: 2 times.
In the case of child users:o When a possible hit of known, new material or grooming is detected, the child would
be automatically and immediately warned of the possible known, new material orgrooming, without the provider knowing. The child would be given the opportunity toreport to the provider, which only then would know about the possible known, new
CSAM or grooming.
Phase 2: reporting to the EU Centre only of users of interest.
The provider would only become aware of the possible CSA once the user is identified as a user ofinterest, taking into account the above (or if the child decides to report, in the case of childaccounts). Only users of interest would be reported to the EU Centre. The error rate for new CSAM
and grooming would be significantly reduced by applying this additional step 2.
(b)Flagging of possible need to receive a detection order

Considering the feedback from delegations, the Presidency proposes granting high-risk service
providers the ability to notify the Coordinating Authority about a risk identified by them related totheir service or a part or component thereof that might require the issuing of a detection order. This
notification could be included in the report submitted to the Coordinating Authority. Only high-risk
services would be allowed to make this notification. This provision could be explicitly outlined in
Article 5 of the text.

2

E.g. for an error rate of 99.9%, i.e. 1 in 1000 files flagged as possible CSAM are not CSAM,
the probability that a hit reported to the EU Centre is not CSAM would be 1/1000 x 1/1000
x 1/1000 = 1/1 000 000 000, i.e. 1 in a billion.

7462/24
JAI.1

GR/ml

7

LIMITEEN

To clarify the intention behind this provision, a recital could be drafted to specify that the act of
notifying the Coordinating Authority does not automatically lead to the request of issuance (andtherefore much less to the automatic issuance) of a detection order. The decision to request adetection order from a judicial or an independent administrative authority remains solely with the
Coordinating Authority.
It needs to be underlined that this notification mechanism would not lead to circumventing any
mitigation measures. The intention behind allowing providers to flag their services for potential
detection orders is to enhance transparency and collaboration within the regulatory framework,
ensuring that appropriate measures are taken in accordance with the risk level of each service.
(c) Cybersecurity safeguards
Taking into account the comments from delegations received so far, the Presidency proposes areinforcement of the safeguards related to cybersecurity concerning the execution of the detection
orders. These new provisions could be added to Article 10(3) and (4) as part of the requirementsthat the technologies must fulfil when deployed to execute the detection orders. These requirements
would include in particular a dedicated assessment by the provider of the cybersecurity risks and thecybersecurity risk mitigation measures taken. The EU Centre would be required to provide an
opinion on such security risk assessment and mitigation measures.
In addition to the new provisions in Article 10(3) and (4) concerning the deployment of thetechnologies to execute the detection orders, the providers would be required to use certified
technologies for the execution of the detection orders.
Just as it is necessary to add cybersecurity aspects, it is also important to be able to remaintechnologically neutral and future proof, while still giving clear indications to service providers on
how to protect their technologies but at the same time allow them to achieve the objectives
underlying this regulation.

7462/24
JAI.1

GR/ml

8

LIMITEEN

With this in mind, it seems appropriate to adopt an approach focused on the risks and dangers that asolution may cause, by considering the corresponding technologies with which we are alreadyfamiliar, and addressing the fears and dangers associated with them.
To carry out this exercise, the presidency expects to receive technical information from delegations
on any concerns they may have regarding the relevant detection technologies. By listing theseconcerns, it will be possible to include additional safeguards on technical aspects into a recital or
the operative part.
Similarly, we would also need consider the exact role of the EU-Centre and how it should intervene,
considering the technology verification, analysis, and validation process. We also need to take into
account the responsibilities and tasks of other EU agencies with cybersecurity responsibilities, andthe potential cooperation of the EU-Centre with these EU agencies.

7462/24
JAI.1

GR/ml

9

LIMITEEN

ANNEX I
Proposal for a Regulation laying down rules to prevent and combat child sexual abuse:
Text proposals for examination by LEWP on 19 March 2024 1
Article 1
Subject matter and scope
1.

This Regulation lays down uniform rules to prevent and combat address in a targeted,carefully balanced and proportionate manner the misuse of relevant information society
services for online child sexual abuse in the internal market.
It establishes, in particular:(a)obligations on providers of relevant information society services to minimise the riskthat their services are misused for online child sexual abuse;(b)

obligations on providers of hosting services and providers of interpersonalcommunications services to detect and report online child sexual abuse;(c)obligations on providers of hosting services to remove or disable access to childsexual abuse material on their services;(d)obligations on providers of internet access services to prevent users from accessing
access child sexual abuse material;(da) obligations on providers of online search engines to delist websites indicating
specific items of child sexual abuse;(e)rules on the implementation and enforcement of this Regulation, including as regards
the designation and functioning of the competent authorities of the Member States,
the EU Centre on Child Sexual Abuse established in Article 40 (‘EU Centre’) andcooperation and transparency.

2.

This Regulation shall apply to providers of relevant information society services offeringsuch services in the Union, irrespective of their place of main establishment.

2a.

This Regulation shall not apply to services or parts of the services used by the Statefor national security purposes, maintaining law and order or military purposes.

2b.

The Regulation shall not apply to classified information and information andcommunication systems processing such information.

1

Changes to the Commission proposal are marked in bold and strikethrough. New changes to
the Commission proposal in comparison to document 12611/23 are marked in bold
underline and strikethrough underline.

7462/24
ANNEX I

JAI.1

GR/ml

10

LIMITEEN

3.

This Regulation shall not affect the rules laid down by the following legal acts:(a)Directive 2011/93/EU on combating the sexual abuse and sexual exploitation ofchildren and child pornography, and replacing Council Framework Decision
2004/68/JHA;(b)

Directive 2000/31/EC and Regulation (EU) 2022/2065 …/… of the European
Parliament and of the Council2 [on a Single Market For Digital Services (Digital
Services Act) and amending Directive 2000/31/EC];(ba) Regulation (EU) 2022/… of … on contestable and fair markets in the digital
sector and amending Directives (EU) 2019/1937 and (EU) 2020/1828 (DigitalMarkets Act);(c)

Directive 2010/13/EU;(d)Regulation (EU) 2016/679, Directive 2016/680, Regulation (EU) 2018/1725, and,subject to paragraph 4 of this Article, Directive 2002/58/EC;(e)Regulation (EU) 2021/784 of the European Parliament and of the Council of
29 April 2021 on addressing the dissemination of terrorist content online.

3a.

This Regulation shall not have the effect of modifying the obligation to respect therights, freedoms and principles referred to in Article 6 TEU and shall apply without
prejudice to fundamental principles relating to the right for respect to private life andfamily life and to freedom of expression and information. 3

4.

This Regulation limits the exercise of the rights and obligations provided for in 5(1) and(3) and Article 6(1) of Directive 2002/58/EC to the extent strictly insofar as necessary forthe execution of the detection orders issued in accordance with Section 2 of Chapter 1 II ofthis Regulation.

4a.

This Regulation shall not lead to any general obligation to monitor the information
which providers of hosting services transmit or store, nor to actively seek facts orcircumstances indicating illegal activity.

5.

This Regulation shall not prohibit, make impossible, weaken, circumvent orotherwise undermine cybersecurity measures, in particular encryption, including
end-to-end encryption, implemented by the relevant information society services orby the users. This Regulation shall not create any obligation to decrypt data.

2

3

Regulation (EU) …/… 2022/2065 of the European Parliament and of the Council on aSingle Market For Digital Services (Digital Services Act) and amending Directive
2000/31/EC (OJ L ….).
Wording copied from Art. 1(4) of TCO Regulation with an additional reference to the rightto private life.

7462/24
ANNEX I

JAI.1

GR/ml

11

LIMITEEN

5.

This Regulation shall not require a provider of hosting services or a provider ofinterpersonal communications services or a user to introduce systemic cybersecurity
risks for which it is not possible to take any effective measures to mitigate such risks.
This Regulation shall not create any obligation that would require a provider ofhosting services or a provider of interpersonal communications services to create
access to end-to-end encrypted data.
Article 5
Risk reporting and categorisation

1.

Providers of hosting services and providers of interpersonal communications services shalltransmit, by three months from the date referred to in Article 3(4), to the Coordinating
Authority of establishment a report specifying including the following:(a)the premise for the risk assessment pursuant to Article 3(2), the process and theresults of the risk assessment conducted or updated pursuant to Article 3, including
the assessment of any potential remaining risk referred to in Article 3(5);(b)

any mitigation measures taken pursuant to Article 4 and, where applicable, Article
5a, Aand the results thereof including the effectiveness of these measures andhow they comply with the requirements of Article 4(2), and in case of age
assessment and verification measures, how they comply with the requirementsof Article 4 (3);(ba) any other mitigation measures implemented before carrying out the risk
assessment and, when available, complementary informations about theeffectiveness of these measures;(bb) the effectiveness of these measures and how they comply with the requirementsof Article 4 (2);(c)

where potential remaining risk as referred to in Article 3(5) is identified, anyavailable information relevant for identifying as precisely as possible the parts
or components of the service, or the specific users or groups or types of users, inrespect of which the potential remaining risk arises and the planned further
measures to mitigate this risk.

(ca) a self-assessment against the criteria established for the categorisation of risksof the service or the parts or components of the service, following the templatelaid down in ANNEX XIV;(cb) whether a high risk concerning the service or the parts or components of theservice is identified that might require the issuing of a detection order inaccordance with Article 7(4);7462/24
ANNEX I

JAI.1

GR/ml

12

LIMITEEN(d)whether the provider intends to requests to the Coordinating Authority of
establishment the authorisation to display the sign of compliance reduced risk
as referred to in accordance with in Article 5b.

(d)any other relevant measures taken to mitigate the risk and the results thereof.

When made available, tThis report should shall include available statisticalinformation to support and illustrate the development and effectiveness of mitigation
measures.
2.

Within three months after receiving the report, the Coordinating Authority of establishment
shall assess it and determine, on that basis and taking into account any other relevant
information available to it, whether the risk assessment has been properly diligently
carried out or updated and the mitigation measures have been taken in accordance with therequirements of Articles 3 and 4 and evaluate the level of the remaining risk.
Based on the evaluation of the level of the remaining risk and taking into account the
self-assessment carried out by the providers of hosting services and providers ofinterpersonal communications against the criteria established for the categorisationof risks, the Coordinating Authority of establishment shall determine the risk
category allocated to the service or the parts or components of the service, following
the methodology and criteria outlined in ANNEX XV.
The service or the parts or components of the service shall be classified into thefollowing categories:
(a)
(b)
(c)

High risk;
Medium risk
Low risk

The decision of the Coordinating Authority of establishment determining the risk
category shall be communicated to the providers concerned, including the date bywhen the provider is required to update the risk assessment.
The Coordinating Authority of establishment may request the EU Centre to assist in
evaluating the mitigation measures taken by the provider, as well as evaluating thelevel of the remaining risk and in determining the risk category allocated to theservice or the parts or components of the service.
If the provider has submitted the request referred to in point (d) of paragraph 1, theCoordinating Authority shall decide on the issuance of the authorisation to display
the sign of compliance reduced risk in accordance to Article 5b.
The Commission shall be empowered to adopt delegated acts in accordance with
Article to amend Annex XIV in order to revise and update the criteria laid down
therein, and to amend ANNEX XV in order to revise the methodology and criteria
laid down therein, if required in particular due to technological developments.

7462/24
ANNEX I

JAI.1

GR/ml

13

LIMITEEN

3.

Where necessary for that assessment, that Coordinating Authority may require further
information from the provider, within a reasonable time period set by that Coordinating
Authority. That time period shall not be longer than two weeks.
The time period referred to in the first subparagraph paragraph 2 of this Article shall besuspended until that additional information is provided.

4.

Without prejudice to Articles 7 and 27 to 29, where the requirements of Articles 3 and 4
have not been met, that Coordinating Authority shall require the provider to re-conduct or
update the risk assessment or to introduce, implement, review, discontinue or expand, asapplicable, the mitigation measures, within a reasonable time period set by that
Coordinating Authority. That time period shall not be longer than one month. The
provisions of this Article shall also apply to risk assessments re-conducted or updated
pursuant to this paragraph.

4a.

If the Coordination Authority of establishement, after carrying out the assessments
referred to in paragraphs 1 to 4, determines that the risk assessment has beensatisfactorily carried out and that no further mitigation measures can be introduced,
implemented, reviewed, discontinued or expanded, that Coordinating Authority shallauthorise within one week the providers to display a distinctive and universal signattesting to the optimised safety aspects of the assessed service, in accordance toarticle 6a.

4 5.

Providers shall, when transmitting the report to the Coordinating Authority of
establishment in accordance with paragraph 1, transmit the report also to the EU Centre.

5.6.

Providers shall, upon request, transmit the report to the providers of software application
stores, insofar as necessary for the assessment referred to in Article 6(2). Where necessary,
they may remove confidential information from the reports.
Article 5a
Adjusted or additional risk assessment or risk mitigation measures

1.

Without prejudice to Articles 27 to 29, where on the basis of its assessment referred toin Article 5(2), the Coordinating Authority of establishment determines that aprovider offering a service or parts or components of a service classified as high risk
or medium risk has not met the requirements of Articles 3 and or 4 have not beenmet, it shall require the provider of hosting services or the provider of interpersonalcommunications services to carry out one or several of the following actions, as
appropriate:7462/24
ANNEX I

JAI.1

GR/ml

14

LIMITEEN(a)to re-conduct or update the risk assessment in accordance with Article 3,
including where appropriate by modifying the methodology used to conduct therisk assessment, and report thereon in accordance with Article 5;(b)

to implement, review, modify, discontinue or expand some or all of the risk
mitigation measures taken in accordance with Article 4;(c)to introduce additional risk mitigation measures in accordance with Article 4.

The Coordinating Authority of establishment may request the EU Centre for an
opinion on technical aspects of the possible actions that it intends to require pursuant
to the first subparagraph.
2.

The A provider that is required to perform the actions specified in points (b) or (c) of
paragraph 1 shall re-conduct or update the risk assessment in accordance with
Article 3 so as to take account of those actions, and report thereon in accordance with
Article 5. In the report on the re-conducted or updated risk assessment the provider
shall also specify and explain inform the Coordinating Authority of the actions
performed steps taken to ensure compliance with the measures required pursuant toparagraph 1, within a time period set by the Coordinating Authority. That time
period shall be reasonable, taking into account the complexity of the required actions
measures.

3.

The Coordinating Authority of establishment shall, by deviation from the time
periods specified in Articles 3(4) and 5(1), set a reasonable time period for the
performance of the actions pursuant to paragraph 1 and for the reporting pursuant
to paragraph 2. That time period shall be reasonable, taking into account thecomplexity of the required actions.

4.

The Coordinating Authority of establishment may recommend to a provider offeringa service or parts or components of a service classified as low risk to carry out one orseveral of the actions listed in paragraph 1, as appropriate.
Section 2
Detection obligations
Article 7
Issuance of detection orders

1.

The Coordinating Authority of establishment shall have the power to request the competentjudicial authority of the Member State that designated it or another independentadministrative authority of that Member State to issue a detection order requiring aprovider of hosting services or a provider of interpersonal communications services under
the jurisdiction of that Member State to take the measures specified in Article 10 for thesole purpose of to detecting the dissemination of online child sexual abuse on a specificservice or parts or components of the service, classified as high risk in accordancewith Article 5(2), for a limited period of time as specified in paragraph 9.

7462/24
ANNEX I

JAI.1

GR/ml

15

LIMITEEN2.

The Coordinating Authority of establishment shall, before requesting the issuance of adetection order, carry out the investigations and assessments necessary to determine
whether the conditions of paragraph 4 have been met.
To that end, it may, where appropriate, require the provider to submit the necessary
information, additional to the report and the further information referred to in Article 5(1)and (3), and Article 5a(2), respectively, within a reasonable time period set by that
Coordinating Authority, or request the EU Centre, another public authority or relevant
experts or entities to provide the necessary additional information. It may also request theassistance of the EU Centre to conduct tests in accordance with Article 47a on theservice in question to verify whether there are objective indications, as referred to inpoint (a) of paragraphs 5, 6 or 7, as applicable.

3.

Where the Coordinating Authority of establishment takes the preliminary view that theconditions of paragraph 4 have been met, it shall:(a)establish a draft request for the issuance of a detection order, specifying the mainelements of the content of the detection order it intends to request and the reasons
including the necessity for requesting it;(b)submit the draft request to the provider and the EU Centre;(c)afford the provider an opportunity to comment on the draft request, within areasonable time period set by that Coordinating Authority;(d)invite the EU Centre to provide its opinion on the draft request, within a time periodof four weeks from the date of receiving the draft request.

Where, having regard to the comments of the provider and the opinion of the EU Centre,that Coordinating Authority continues to be of the view that the conditions of paragraph 4
have met, it shall re-submit the draft request, adjusted where appropriate, to the provider.
In that case, the provider shall do all of the following, within a reasonable time period set
by that Coordinating Authority:(a)draft an implementation plan setting out the measures it envisages taking to executethe intended detection order, including detailed information regarding the envisaged
technologies and safeguards;(b)

where the draft implementation plan concerns an intended detection order concerning
the solicitation of children other than the renewal of a previously issued detection
order without any substantive changes, conduct a data protection impact assessment
and a prior consultation procedure as referred to in Articles 35 and 36 of Regulation(EU) 2016/679, respectively, in relation to the measures set out in theimplementation plan;

7462/24
ANNEX I

JAI.1

GR/ml

16

LIMITEEN(c)where point (b) applies, or where the conditions of Articles 35 and 36 of Regulation(EU) 2016/679 are met, adjust the draft implementation plan, where necessary inview of the outcome of the data protection impact assessment and in order to take
into account the opinion of the data protection authority provided in response to theprior consultation;(d)submit to that Coordinating Authority the implementation plan, where applicableattaching the opinion of the competent data protection authority and specifying how
the implementation plan has been adjusted in view of the outcome of the dataprotection impact assessment and of that opinion.

Where, having regard to the implementation plan of the provider and the received opinionsof the data protection authority and the EU Centre, where applicable, that Coordinating
Authority continues to be of the view that the conditions of paragraph 4 have met, it shallsubmit the request for the issuance of the detection order, adjusted where appropriate, tothe competent judicial authority or independent administrative authority. It shall attach theimplementation plan of the provider and the opinions of the EU Centre and the dataprotection authority to that request and, when appropriate, the reasons for diverging
from the opinions received.
4.

The Coordinating Authority of establishment shall request the issuance of the detection
order, and the competent judicial authority or independent administrative authority may
shall issue the detection order where it considers that the following conditions are met:(a)there is evidence of a significant and present or foreseeable risk of the high risk
service or parts or components of the service being used for the purpose of online
child sexual abuse, within the meaning of paragraphs 5, 6 and 7, as applicable;(b)the reasons for issuing the detection order outweigh negative consequences for therights and legitimate interests of all parties affected, having regard in particular to theneed to ensure a fair balance between the fundamental rights of those parties.

When assessing whether the conditions of the first subparagraph have been met, accountshall be taken of all relevant facts and circumstances of the case at hand, in particular:(a)the risk assessment conducted or updated and any mitigation measures taken by theprovider pursuant to Articles 3 and 4, including any mitigation measures introduced,
reviewed, discontinued or expanded pursuant to Article 5a 5(4) where applicable;(b)

any additional information obtained pursuant to paragraph 2 or any other relevant
information available to it, in particular regarding the use, design and operation of
the service, regarding the provider’s financial and technological capabilities and size
and regarding the potential consequences of the measures to be taken to execute thedetection order for all other parties affected;

7462/24
ANNEX I

JAI.1

GR/ml

17

LIMITEEN(c)the views and the implementation plan of the provider submitted in accordance withparagraph 3;(ca) the necessity and proportionality in terms of the period of application, thetechnologies used, and the impact on the protection of inter-personalcommunication, the possibility to limit the scope to parts or components of aservice and other safeguards provided for in accordance with paragraph 8;(d)the opinions of the EU Centre and of the data protection authority submitted inaccordance with paragraph 3.

As regards the second subparagraph, point (d), where that Coordinating Authority
substantially deviates from the opinions received of the EU Centre, it shall inform the EU
Centre and the Commission thereof, specifying the points at which it deviated and the main
reasons for the deviation.
5.

6.

As regards detection orders concerning the dissemination of known child sexual abusematerial, the significant risk referred to in paragraph 4, first subparagraph, point (a), shallbe deemed to exist where the following conditions are met:(a)

it is likely, there are objective indications that, despite any mitigation measuresthat the provider may have taken or will take, that there is a genuine and present
or foreseeable risk, that the service or parts or components of the service is or
will be used, to an appreciable extent for the dissemination of known child sexual
abuse material;(b)

there is evidence of the service, or of a comparable service if the service has not yet
been offered in the Union at the date of the request for the issuance of the detection
order, having been used in the past 12 months and to an appreciable extent for the
dissemination of known child sexual abuse material.

As regards detection orders concerning the dissemination of new child sexual abusematerial, the significant risk referred to in paragraph 4, first subparagraph, point (a), shallbe deemed to exist where the following conditions are met:(a)

it is likely, there are objective indications that, despite any mitigation measuresthat the provider may have has taken or will take, that there is a genuine andpresent or foreseeable risk that the service or parts or components of the service
is or will be used, to an appreciable extent for the dissemination of new child sexual
abuse material;(b)

there is evidence of the service, or of a comparable service if the service has not yet
been offered in the Union at the date of the request for the issuance of the detection
order, having been used in the past 12 months and to an appreciable extent, for the
dissemination of new child sexual abuse material;

7462/24
ANNEX I

JAI.1

GR/ml

18

LIMITE

EN

(c)

7.

for services other than those enabling the live transmission of pornographic
performances as defined in Article 2, point (e), of Directive 2011/93/EU:(1)

a detection order concerning the dissemination of known child sexual abusematerial has been issued in respect of the service;(2)

the provider submitted a significant number of reports concerning known childsexual abuse material, detected through the measures taken to execute thedetection order referred to in point (1), pursuant to Article 12.

As regards detection orders concerning the solicitation of children, the significant riskreferred to in paragraph 4, first subparagraph, point (a), shall be deemed to exist where thefollowing conditions are met:(a)the provider qualifies as a provider of interpersonal communications services
excluding such services consisting of real-time audio communications;(b)

it is likely, there are objective indications that, despite any mitigation measuresthat the provider may have has taken or will take, that there is a genuine andpresent or foreseeable risk that the service or parts or components of the service
is or will be used, to an appreciable extent for the solicitation of children;(c)there is evidence of the service, or of a comparable service if the service has not yet
been offered in the Union at the date of the request for the issuance of the detection
order, having been used in the past 12 months and to an appreciable extent, for thesolicitation of children.

The detection orders concerning the solicitation of children shall apply only tointerpersonal communications where one of the users is a child user and shall not apply tocalls.
8.

The Coordinating Authority of establishment when requesting the issuance of detection
orders, and the competent judicial or independent administrative authority when issuing thedetection order, shall target and specify it in such a manner that the negative consequencesreferred to in paragraph 4, first subparagraph, point (b), remain limited to what is strictly
necessary to effectively address the significant risk referred to in point (a) thereof.
To that aim, they shall take into account all relevant parameters, including the availabilityof sufficiently reliable detection technologies in that they limit to the maximum extent
possible the rate of errors regarding the detection and their suitability and effectiveness forachieving the objectives of this Regulation, as well as the impact of the measures on therights of the users affected, and require the taking of the least intrusive measures, inaccordance with Article 10, from among several equally effective measures.

7462/24
ANNEX I

JAI.1

GR/ml

19

LIMITEEN

In particular, they shall ensure that:

9.

(a)

where that risk is limited to an identifiable part or component of a service, therequired measures are only applied in respect of that part or component;(b)where necessary, in particular to limit such negative consequences, effective andproportionate safeguards additional to those listed in Article 10(4), (5) and (6) areprovided for;(c)subject to paragraph 9, the period of application remains limited to what is strictly
necessary.

The competent judicial authority or independent administrative authority shall specify inthe detection order the period during which it applies, indicating the start date and the end
date.
The start date shall be set taking into account the time reasonably required for the provider
to take the necessary measures to prepare the execution of the detection order. It shall not
be earlier than three months from the date at which the provider received the detection
order and not be later than 12 months from that date.
The period of application of detection orders concerning the dissemination of known or
new child sexual abuse material shall not exceed 24 months and that of detection orders
concerning the solicitation of children shall not exceed 12 months.

10.

A detection order shall not create any obligation that would require a provider ofhosting services or a provider of interpersonal communications services to create
access to end-to-end encrypted data.

11.

Providers of hosting services and providers of interpersonal communications services
shall carry out the detection orders in a way that only users of interest detected
repeatedly on the sharing of potential child sexual abuse material or attempts tosolicate children are reported in accordance with Articles 12 and 13.
The detection of potential child sexual abuse material or attempts to solicitatechildren shall result in a hit to be flagged in the users’ accounts of the affected service
without the provider being notified. A child using the service shall be automaticallyand immediately warned of detected potential child sexual abuse material or attempts
to solicate children, without the provider being notified. The child shall be enabled to
notify the provider thereof through tools that are easily accessible and ageappropriate.
Users on whose accounts hits related to known child sexual abuse material have been
flagged once, and users on whose accounts hits related to potential new child sexual
abuse material or attempts to solication of children have been flagged twice, shall beconsidered as users of interest.

7462/24
ANNEX I

JAI.1

GR/ml

20

LIMITEEN

Article 10
Technologies and safeguards
1.

Providers of hosting services and providers of interpersonal communications services thathave received a detection order shall execute it by installing and operating technologies todetect the dissemination of known or new child sexual abuse material or the solicitation ofchildren, as applicable, using the corresponding indicators provided by the EU Centre inaccordance with Article 46.

2.

The provider shall be entitled to acquire, install and operate, free of charge, technologies
made available by the EU Centre in accordance with Article 50(1), for the sole purpose of
executing the detection order.
The provider shall not be required to use any specific technology, including those madeavailable by the EU Centre, as long as the requirements set out in this Article are met. The
use of the technologies referred to in paragraph 1 made available approved by the EU
Centre shall not affect the responsibility of the provider to comply with those therequirements set out in this Article and for any decisions it may take in connection to or
as a result of the use of the technologies.

3.

The technologies shall be:(a)be effective and suitable and not easily circumvented in detecting thedissemination of known or new child sexual abuse material or the solicitation ofchildren, as applicable;(aa) not introduce systemic cybersecurity risks for which it is not possible to takeany effective measures to mitigate such risk;(b)

not be able to deduce the substance of the content of the communications nor to
extract any other information from the relevant communications than the information
strictly necessary to detect, using the indicators referred to in paragraph 1, patterns
pointing to the dissemination of known or new child sexual abuse material or thesolicitation of children, as applicable;(c)be in accordance with the state of the art in the industry and the least intrusive interms of the impact on the users’ rights to private and family life, including theconfidentiality of communication, and to protection of personal data;(d)be sufficiently reliable and accurate, in that they limit to the maximum extent
possible the rate of errors regarding the detection and, where such errors occur, do
not prevent facilitate the rectification of the consequences without undue delay.

7462/24
ANNEX I

JAI.1

GR/ml

21

LIMITEEN4.

The provider shall:(a)take all the necessary measures to ensure that the technologies and indicators, as wellas the processing of personal data and other data in connection thereto, are used forthe sole purpose of detecting the dissemination of known or new child sexual abusematerial or the solicitation of children, as applicable, insofar as strictly necessary to
execute the detection orders addressed to them. In particular, the provider shall:(i)diligently identify, analyse and assess any systemic cybersecurity risks that
could be introduced by the technologies used for the execution of thedetection orders;(ii)take all reasonable mitigation measures, tailored to the possible systemic
cyberscurity risk identified, to minimise that risk;(b)establish effective internal procedures to prevent and, where necessary, detect andremedy any misuse, including misuses caused by breaching cybersecurity
measures, of the technologies, indicators and personal data and other data referred toin point (a), and unauthorized access to, and unauthorised transfers of, such personal
data and other data;(c)ensure regular human oversight as necessary to ensure that the technologies operate
in a sufficiently reliable manner and, where necessary, in particular whenpotential errors and potential solicitation of children are detected, humanintervention;(d)establish and operate an accessible, age-appropriate and user-friendly mechanismthat allows users to submit to it, within a reasonable timeframe, complaints about
alleged infringements of its obligations under this Section, as well as any decisions
that the provider may have taken in relation to the use of the technologies, including
the removal or disabling of access to material provided by users, blocking the users’
accounts or suspending or terminating the provision of the service to the users, andprocess such complaints in an objective, effective and timely manner;(e)

inform the Coordinating Authority, at the latest one month before the start datespecified in the detection order, on the implementation of the envisaged measures set
out in the implementation plan referred to in Article 7(3);(f)

regularly review the functioning of the measures referred to in points (a), (b), (c) and(d) of this paragraph and adjust them where necessary to ensure that the requirements
set out therein are met, as well as document the review process and the outcomes
thereof and include that information in the report referred to in Article 9(3).

7462/24
ANNEX I

JAI.1

GR/ml

22

LIMITEEN5.

The provider shall inform users in a clear, prominent and comprehensible way of thefollowing:(a)the fact that it operates automated technologies (automated profiling) to detect
online child sexual abuse, to execute the detection order, the ways in which it
operates those technologies, meaningful information about the logic involved, andthe impact on the confidentiality of users’ communications;(b)the fact that it is required to report potential online child sexual abuse to the EU
Centre in accordance with Article 12;(c)the users’ right of judicial redress referred to in Article 9(1) and their rights to submit
complaints to the provider through the mechanism referred to in paragraph 4, point(d) and to the Coordinating Authority in accordance with Article 34.

(d)the users’ rights as data subjects under Regulation (EU) 2016/679.

The provider shall not provide information to users that may reduce the effectiveness of themeasures to execute the detection order.
6.

Where a provider detects potential online child sexual abuse through the measures taken to
execute the detection order, it shall inform the users concerned without undue delay, after
Europol or the national law enforcement authority of a Member State that received thereport pursuant to Article 48 has confirmed that the information to the users would notinterfere with activities for the prevention, detection, investigation and prosecution of childsexual abuse offences.

7462/24
ANNEX I

JAI.1

GR/ml

23

LIMITEEN

ANNEX II
Risk categorisation table
RISK
LEVEL OFCATEGORISATION DETECTION
ORDER (DO)Risk + +High

MITIGATIONMEASURE(S)(MM)

PROVIDER
FREQUENCY OF
FLAGGING NEED (RE)CATEGORISATIONFOR DETECTION
ORDER

Obligatory additional
Flagging, byMM
the provider, ofSanction(s) ++possible need to be
subject to a detectionorder

Up to 12 months

None

Obligatory additional
MM
Sanction(s) +None

Up to 24 months

None

Recommended
additional
MM

None

Up to 36 months

DO- Including
servicesusing E2EE
- “Users ofinterest” based
reporting

Risk +
MediumRisk Low

7462/24
ANNEX II

JAI.1

GR/ml

24

LIMITE

EN