### (1) information society services have become very important for communication , expression , gathering of information and many other aspects of present-day life , including for children but also for perpetrators of child sexual abuse offences. such offences , which are subject to minimum rules set at union level , are very serious criminal offences that need to be prevented and combated effectively in order to protect children’s rights and well-being , as is required under the charter of fundamental rights of the european union (‘charter’) , and to protect society at large. users of such services offered in the union should be able to trust that the services concerned can be used safely , especially by children. ### (1) information society services have become very important for communication , expression , gathering of information and many other aspects of present-day life , including for children but also for perpetrators of child sexual abuse offences. digital services have become an irreplaceable tool for today’s children , as information , elements of formal education , social contact and entertainment are increasingly online; whereas digital services can also expose children to risks such as unsuitable content , grooming , and child sexual abuse. such offences , which are subject to minimum rules set at union level , are very serious criminal offences that need to be prevented and combated effectively in order to protect children’s rights and well-being , as is required under the charter of fundamental rights of the european union (‘charter’) , and to protect society at large. users of such services offered in the union should be able to trust that the services concerned can be used safely , especially by children. in order to ensure a safer online experience for children and prevent the above-mentioned offences , digital literacy should be recognized as a mandatory skill by member states and should be included in the school curriculum across the eu.


### (2) given the central importance of relevant information society services , those aims can only be achieved by ensuring that providers offering such services in the union behave responsibly and take reasonable measures to minimise the risk of their services being misused for the purpose of child sexual abuse , those providers often being the only ones in a position to prevent and combat such abuse. the measures taken should be targeted , carefully balanced and proportionate , so as to avoid any undue negative consequences for those who use the services for lawful purposes , in particular for the exercise of their fundamental rights protected under union law , that is , those enshrined in the charter and recognised as general principles of union law , and so as to avoid imposing any excessive burdens on the providers of the services. ### (2) given the central importance of relevant information society services for the digital single market , those aims can only be achieved by ensuring that providers offering such services in the union behave responsibly and take reasonable measures to minimise the risk of their services being misused for the purpose of child sexual abuse , those providers often being the only ones in a position to prevent and combat such abuse. the measures taken should be targeted , effective , carefully balanced and proportionate , so as to avoid any negative consequences for those who use the services for lawful purposes , in particular for the exercise of their fundamental rights protected under union law , that is , those enshrined in the charter and recognised as general principles of union law , and so as to avoid imposing any excessive burdens on the providers of the services.


### (2) given the central importance of relevant information society services , those aims can only be achieved by ensuring that providers offering such services in the union behave responsibly and take reasonable measures to minimise the risk of their services being misused for the purpose of child sexual abuse , those providers often being the only ones in a position to prevent and combat such abuse. the measures taken should be targeted , carefully balanced and proportionate , so as to avoid any undue negative consequences for those who use the services for lawful purposes , in particular for the exercise of their fundamental rights protected under union law , that is , those enshrined in the charter and recognised as general principles of union law , and so as to avoid imposing any excessive burdens on the providers of the services. ### (2) given the central importance of relevant information society services , those aims can only be achieved by appropriate prevention techniques , improving digital literacy , and ensuring that providers offering such services in the union behave responsibly and take reasonable measures to minimise the risk of their services being misused for the purpose of child sexual abuse , those providers often being the only ones in a position to combat such abuse. in order to alleviate the burden on providers , the measures should also aim to raise awareness amongst parents and children and further develop their digital skills , so that they can detect suspicious behaviours online. once a child sexual abuse material (csam) is reported , the measures taken should be targeted , carefully balanced and proportionate , so as to avoid any undue negative consequences for those who use the services for lawful purposes , in particular for the exercise of their fundamental rights protected under union law , that is , those enshrined in the charter and recognised as general principles of union law , and so as to avoid imposing any excessive burdens on the providers of the services.


### (2) given the central importance of relevant information society services , those aims can only be achieved by ensuring that providers offering such services in the union behave responsibly and take reasonable measures to minimise the risk of their services being misused for the purpose of child sexual abuse , those providers often being the only ones in a position to prevent and combat such abuse. the measures taken should be targeted , carefully balanced and proportionate , so as to avoid any undue negative consequences for those who use the services for lawful purposes , in particular for the exercise of their fundamental rights protected under union law , that is , those enshrined in the charter and recognised as general principles of union law , and so as to avoid imposing any excessive burdens on the providers of the services. ### (2) given the central importance of relevant information society services , those aims can only be achieved by ensuring that providers offering such services in the union behave responsibly and take reasonable measures to minimise the risk of their services being misused for the purpose of child sexual abuse , those providers often being the only ones in a position to prevent and combat such abuse. the measures taken should be targeted , carefully balanced and proportionate , so as to avoid any undue negative consequences for those who use the services for lawful purposes , in particular for the exercise of their fundamental rights protected under union law , that is , those enshrined in the charter and recognised as general principles of union law , and so as to avoid imposing any excessive burdens on the providers of the services. to this end , fundamental importance should be attached to ensuring the necessary funding to european programmes and projects which aim to improve digital skills and awareness of risk linked to the digital world , such as “media literacy for all”.


### (3) member states are increasingly introducing , or are considering introducing , national laws to prevent and combat online child sexual abuse , in particular by imposing requirements on providers of relevant information society services. in the light of the inherently cross-border nature of the internet and the service provision concerned , those national laws , which diverge , have a direct negative effect on the internal market. to increase legal certainty , eliminate the resulting obstacles to the provision of the services and ensure a level playing field in the internal market , the necessary harmonised requirements should be laid down at union level. ### (3) on the one hand it is very positive that member states are aware of the existing problem and therefore increasingly introducing , or are considering introducing , national laws to prevent and combat online child sexual abuse , in particular by imposing requirements on providers of relevant information society services. on the other hand the internet and the service provision concerned have an inherently cross-border nature and therefore diverging national laws , have a negative effect on the internal market. to increase legal certainty , eliminate the resulting obstacles to the provision of the services and ensure a level playing field in the internal market , the necessary harmonised requirements should be laid down at union level.


### (3) member states are increasingly introducing , or are considering introducing , national laws to prevent and combat online child sexual abuse , in particular by imposing requirements on providers of relevant information society services. in the light of the inherently cross-border nature of the internet and the service provision concerned , those national laws , which diverge , have a direct negative effect on the internal market. to increase legal certainty , eliminate the resulting obstacles to the provision of the services and ensure a level playing field in the internal market , the necessary harmonised requirements should be laid down at union level. ### (3) member states are increasingly introducing , or are considering introducing , national laws to prevent and combat online child sexual abuse , in particular by imposing requirements on providers of relevant information society services. in the light of the inherently cross-border nature of the internet and the service provision concerned , those national laws , which diverge , have a direct negative effect on the internal market. to increase legal certainty , eliminate the resulting obstacles to the provision of the services and ensure a level playing field in the internal market , the necessary harmonised requirements and appropriate prevention techniques should be laid down at union level.


### (4) therefore , this regulation should contribute to the proper functioning of the internal market by setting out clear , uniform and balanced rules to prevent and combat child sexual abuse in a manner that is effective and that respects the fundamental rights of all parties concerned. in view of the fast-changing nature of the services concerned and the technologies used to provide them , those rules should be laid down in technology-neutral and future-proof manner , so as not to hamper innovation. ### (4) therefore , this regulation should contribute to the proper functioning of the internal market by setting out clear , uniform , carefully balanced and proportionate rules to prevent and combat child sexual abuse in a manner that is effective and that respects the fundamental rights of all parties concerned. in view of the fast-changing nature of the services concerned and the technologies used to provide them , those rules should be laid down in technology-neutral and future-proof manner , so as not to hamper innovation.


### (5) in order to achieve the objectives of this regulation , it should cover providers of services that have the potential to be misused for the purpose of online child sexual abuse. as they are increasingly misused for that purpose , those services should include publicly available interpersonal communications services , such as messaging services and web-based e-mail services , in so far as those service as publicly available. as services which enable direct interpersonal and interactive exchange of information merely as a minor ancillary feature that is intrinsically linked to another service , such as chat and similar functions as part of gaming , image-sharing and video-hosting are equally at risk of misuse , they should also be covered by this regulation. however , given the inherent differences between the various relevant information society services covered by this regulation and the related varying risks that those services are misused for the purpose of online child sexual abuse and varying ability of the providers concerned to prevent and combat such abuse , the obligations imposed on the providers of those services should be differentiated in an appropriate manner. ### (5) in order to achieve the objectives of this regulation , it should cover providers of services that have the potential to be misused for the purpose of online child sexual abuse. as they are increasingly misused for that purpose , those services should include publicly available interpersonal communications services , such as messaging services and web-based e-mail services , in so far as those service as publicly available. as services which enable direct interpersonal and interactive exchange of information merely as a minor ancillary feature that is intrinsically linked to another service , such as chat and similar functions as part of gaming , image-sharing and video-hosting are equally at risk of misuse , they should also be covered by this regulation , in so far as they allow for the dissemination and exchange of images and videos uploaded by their users. given the inherent differences between the various relevant information society services covered by this regulation and the related varying risks that those services are misused for the purpose of online child sexual abuse and varying ability of the providers concerned to prevent and combat such abuse , the obligations imposed on the providers of those services should be differentiated in an appropriate manner.


### (6) online child sexual abuse frequently involves the misuse of information society services offered in the union by providers established in third countries. in order to ensure the effectiveness of the rules laid down in this regulation and a level playing field within the internal market , those rules should apply to all providers , irrespective of their place of establishment or residence , that offer services in the union , as evidenced by a substantial connection to the union. ### (6) online child sexual abuse frequently involves the misuse of information society services offered in the union by providers established in third countries. considering the seriousness of the offences committed , considering that the protection of children is a priority for the eu , considering that service providers established in third countries often do not cooperate with member state authorities , in order to ensure the effectiveness of the rules laid down in this regulation and a level playing field within the internal market , those rules should apply to all providers , irrespective of their place of establishment or residence , that offer services in the union , as evidenced by a substantial connection to the union.


### (7) this regulation should be without prejudice to the rules resulting from other union acts , in particular directive 2011/93 of the european parliament and of the council38 , directive 2000/31/ec of the european parliament and of the council39and regulation (eu) …/…of the european parliament and of the council40[on a single market for digital services (digital services act) and amending directive 2000/31/ec] , directive 2010/13/eu of the european parliament and of the council41 , regulation (eu) 2016/679 of the european parliament and of the council42 , and directive 2002/58/ec of the european parliament and of the council43. ### (7) this regulation should be without prejudice to the rules resulting from other union acts , in particular directive 2011/93 of the european parliament and of the council38 , directive 2000/31/ec of the european parliament and of the council39and regulation (eu) 2022/ 2065of the european parliament and of the council40 , directive 2010/13/eu of the european parliament and of the council41 , regulation (eu) 2016/679 of the european parliament and of the council42 , and directive 2002/58/ec of the european parliament and of the council43.


### (8) this regulation should be considered lex specialis in relation to the generally applicable framework set out in regulation (eu) …/… [on a single market for digital services (digital services act) and amending directive 2000/31/ec] laying down harmonised rules on the provision of certain information society services in the internal market. the rules set out in regulation (eu) …/… [on a single market for digital services (digital services act) and amending directive 2000/31/ec] apply in respect of issues that are not or not fully addressed by this regulation. ### (8) this regulation should be considered lex specialis in relation to the generally applicable framework set out in regulation (eu) 2022/2065 laying down harmonised rules on the provision of certain information society services in the internal market. the rules set out in regulation (eu) 2022/2065 apply in respect of issues that are not or not fully addressed by this regulation.


### (10) in the interest of clarity and consistency , the definitions provided for in this regulation should , where possible and appropriate , be based on and aligned with the relevant definitions contained in other acts of union law , such as regulation (eu) …/… [on a single market for digital services (digital services act) and amending directive 2000/31/ec]. ### (10) in the interest of clarity and consistency , the definitions provided for in this regulation should , where possible and appropriate , be based on and aligned with the relevant definitions contained in other acts of union law , such as regulation (eu) 2022/2065.


### (11) a substantial connection to the union should be considered to exist where the relevant information society services has an establishment in the union or , in its absence , on the basis of the existence of a significant number of users in one or more member states , or the targeting of activities towards one or more member states. the targeting of activities towards one or more member states should be determined on the basis of all relevant circumstances , including factors such as the use of a language or a currency generally used in that member state , or the possibility of ordering products or services , or using a national top level domain. the targeting of activities towards a member state could also be derived from the availability of a software application in the relevant national software application store , from the provision of local advertising or advertising in the language used in that member state , or from the handling of customer relations such as by providing customer service in the language generally used in that member state. a substantial connection should also be assumed where a service provider directs its activities to one or more member state as set out in article 17(1) , point (c) , of regulation (eu) 1215/2012 of the european parliament and of the council44 . mere technical accessibility of a website from the union should not , alone , be considered as establishing a substantial connection to the union. ### (11) a substantial connection to the union should be considered to exist where the relevant information society services has an establishment in the union or , in its absence , on the basis of the existence of a significant number of users in one or more member states , or the targeting of activities towards one or more member states. the targeting of activities towards one or more member states should be determined on the basis of all relevant circumstances , including factors such as the use of a language or a currency generally used in that member state , or the possibility of ordering products or services , or using a national top level domain. the targeting of activities towards a member state could also be derived from the availability of a software application in the relevant national software application store , from the provision of local advertising or advertising in the language used in that member state , or from the handling of customer relations such as by providing customer service in the language generally used in that member state. a substantial connection should also be assumed where a service provider directs its activities to one or more member state as set out in article 17(1) , point (c) , of regulation (eu) 1215/2012 of the european parliament and of the council44 .


### (13) the term ‘online child sexual abuse’ should cover not only the dissemination of material previously detected and confirmed as constituting child sexual abuse material (‘known’ material) , but also of material not previously detected that is likely to constitute child sexual abuse material but that has not yet been confirmed as such (‘new’ material) , as well as activities constituting the solicitation of children (‘grooming’). that is needed in order to address not only past abuse , the re-victimisation and violation of the victims’ rights it entails , such as those to privacy and protection of personal data , but to also address recent , ongoing and imminent abuse , so as to prevent it as much as possible , to effectively protect children and to increase the likelihood of rescuing victims and stopping perpetrators. ### (13) in order to allow a future proof approach the term ‘online child sexual abuse’ should cover not only the dissemination of material previously detected and confirmed as constituting child sexual abuse material (‘known’ material) , but also of material not previously detected that is likely to constitute child sexual abuse material but that has not yet been confirmed as such (‘new’ material) , including live-streaming and live transmission of child sexual abuse material as well as activities constituting the solicitation of children (‘grooming’). that is urgently needed in order to address not only past abuse , the re-victimisation and violation of the victims’ rights it entails , such as those to privacy and protection of personal data , but to also prevent it as soon as possible and address recent , ongoing and imminent abuse , to effectively protect children and to increase the likelihood of rescuing victims and stopping perpetrators as quick as possible .


### (15) some of those providers of relevant information society services in scope of this regulation may also be subject to an obligation to conduct a risk assessment under regulation (eu) …/… [on a single market for digital services (digital services act) and amending directive 2000/31/ec] with respect to information that they store and disseminate to the public. for the purposes of the present regulation , those providers may draw on such a risk assessment and complement it with a more specific assessment of the risks of use of their services for the purpose of online child sexual abuse , as required by this regulation. ### (15) some of those providers of relevant information society services in scope of this regulation , including online search engines , may also be subject to an obligation to conduct a risk assessment under regulation (eu) 2022/2065 with respect to information that they store and disseminate to the public. for the purposes of the present regulation , those providers may use such a risk assessment as a basis and complement it with a more specific assessment of the risks of use of their services for the purpose of online child sexual abuse , as required by this regulation.


### (16) in order to prevent and combat online child sexual abuse effectively , providers of hosting services and providers of publicly available interpersonal communications services should take reasonable measures to mitigate the risk of their services being misused for such abuse , as identified through the risk assessment. providers subject to an obligation to adopt mitigation measures pursuant to regulation (eu) …/… [on a single market for digital services (digital services act) and amending directive 2000/31/ec] may consider to which extent mitigation measures adopted to comply with that obligation , which may include targeted measures to protect the rights of the child , including age verification and parental control tools , may also serve to address the risk identified in the specific risk assessment pursuant to this regulation , and to which extent further targeted mitigation measures may be required to comply with this regulation. ### (16) in order to prevent and combat online child sexual abuse effectively , providers of hosting services and providers of publicly available interpersonal communications services should take reasonable measures to mitigate the risk of their services being misused for such abuse , as identified through the risk assessment. providers subject to an obligation to adopt mitigation measures pursuant to regulation (eu) 2022/2065 may consider to which extent mitigation measures adopted to comply with that obligation , which may include targeted measures to protect the rights of the child , including age assessment measures and age appropriate parental control tools , may also serve to address the risk identified in the specific risk assessment pursuant to this regulation , and to which extent further targeted mitigation measures may be required to comply with this regulation.


### (17) to allow for innovation and ensure proportionality and technological neutrality , no exhaustive list of the compulsory mitigation measures should be established. instead , providers should be left a degree of flexibility to design and implement measures tailored to the risk identified and the characteristics of the services they provide and the manners in which those services are used. in particular , providers are free to design and implement , in accordance with union law , measures based on their existing practices to detect online child sexual abuse in their services and indicate as part of the risk reporting their willingness and preparedness to eventually being issued a detection order under this regulation , if deemed necessary by the competent national authority. ### (17) to allow for innovation and ensure proportionality and technological neutrality , no exhaustive list of the compulsory mitigation measures should be established. instead , providers should be left a degree of flexibility to design and implement also voluntary measures tailored to the risk identified and the characteristics of the services they provide and the manners in which those services are used. in particular , providers should be able to voluntary process metadata and are encouraged to design and implement , in accordance with union law , measures based on their existing practices to detect online child sexual abuse in their services and indicate as part of the risk reporting their willingness and preparedness to eventually being issued a detection order under this regulation.


### (18) in order to ensure that the objectives of this regulation are achieved , that flexibility should be subject to the need to comply with union law and , in particular , the requirements of this regulation on mitigation measures. therefore , providers of hosting services and providers of publicly available interpersonal communications services should , when designing and implementing the mitigation measures , give importance not only to ensuring their effectiveness , but also to avoiding any undue negative consequences for other affected parties , notably for the exercise of users’ fundamental rights. in order to ensure proportionality , when determining which mitigation measures should reasonably be taken in a given situation , account should also be taken of the financial and technological capabilities and the size of the provider concerned. when selecting appropriate mitigation measures , providers should at least duly consider the possible measures listed in this regulation , as well as , where appropriate , other measures such as those based on industry best practices , including as established through self-regulatory cooperation , and those contained in guidelines from the commission. when no risk has been detected after a diligently conducted or updated risk assessment , providers should not be required to take any mitigation measures. ### (18) in order to ensure that the objectives of this regulation are achieved , that flexibility should be subject to the need to comply with union law and , in particular , the requirements of this regulation on mitigation measures. therefore , providers of hosting services and providers of publicly available interpersonal communications services should , when designing and implementing the mitigation measures , give importance to ensuring their effectiveness and to avoiding any undue negative consequences for other affected parties , notably for the exercise of users’ fundamental rights. in order to ensure proportionality , when determining which mitigation measures should reasonably be taken in a given situation , account should also be taken of the financial and technological capabilities and the size of the provider concerned. when selecting appropriate mitigation measures , providers should at least duly consider the possible measures listed in this regulation , as well as , where appropriate , other measures such as those based on industry best practices , including as established through self-regulatory cooperation , and those contained in guidelines from the commission. providers should be able to indicate to the coordinating authority their assessment of the need for a detection order , after putting in place the risk mitigation measures. when no risk has been detected after a diligently conducted or updated risk assessment , providers should not be required to take any mitigation measures.


### (19) in the light of their role as intermediaries facilitating access to software applications that may be misused for online child sexual abuse , providers of software application stores should be made subject to obligations to take certain reasonable measures to assess and mitigate that risk. the providers should make that assessment in a diligent manner , making efforts that are reasonable under the given circumstances , having regard inter alia to the nature and extent of that risk as well as their financial and technological capabilities and size , and cooperating with the providers of the services offered through the software application where possible. ### (19) in the light of their role as intermediaries facilitating access to software applications that may be misused for online child sexual abuse , providers of software application stores should be made subject to obligations to take reasonable and effective measures to assess and mitigate that risk. the providers should make that assessment in a diligent manner , making efforts that are reasonable and effective under the given circumstances , having regard inter alia to the nature and extent of that risk as well as their financial and technological capabilities and size , and cooperating with the providers of the services offered through the software application where possible.


### (20) with a view to ensuring effective prevention and fight against online child sexual abuse , when mitigating measures are deemed insufficient to limit the risk of misuse of a certain service for the purpose of online child sexual abuse , the coordinating authorities designated by member states under this regulation should be empowered to request the issuance of detection orders. in order to avoid any undue interference with fundamental rights and to ensure proportionality , that power should be subject to a carefully balanced set of limits and safeguards. for instance , considering that child sexual abuse material tends to be disseminated through hosting services and publicly available interpersonal communications services , and that solicitation of children mostly takes place in publicly available interpersonal communications services , it should only be possible to address detection orders to providers of such services. ### (20) with a view to ensuring effective prevention and fight against online child sexual abuse , when mitigating measures are deemed insufficient to limit the risk of misuse of a certain service for the purpose of online child sexual abuse , the coordinating authorities designated by member states under this regulation should be empowered to request the issuance of detection orders. in order to avoid any undue interference with fundamental rights and to ensure proportionality , that power should be a last resort measure and subject to a carefully balanced set of limits and safeguards. for instance , considering that child sexual abuse material tends to be disseminated through hosting services and publicly available interpersonal communications services , and that in particular solicitation of children mostly takes place in publicly available interpersonal communications services , it should only be possible to address detection orders to providers of such services.


### (21) furthermore , as parts of those limits and safeguards , detection orders should only be issued after a diligent and objective assessment leading to the finding of a significant risk of the specific service concerned being misused for a given type of online child sexual abuse covered by this regulation. one of the elements to be taken into account in this regard is the likelihood that the service is used to an appreciable extent , that is , beyond isolated and relatively rare instances , for such abuse. the criteria should vary so as to account of the different characteristics of the various types of online child sexual abuse at stake and of the different characteristics of the services used to engage in such abuse , as well as the related different degree of intrusiveness of the measures to be taken to execute the detection order. ### (21) furthermore , as parts of those limits and safeguards , detection orders should only be issued after a diligent and objective assessment leading to the finding of a significant risk of the specific service concerned being misused for a given type of online child sexual abuse covered by this regulation. such assessments may include the voluntary use of detection technologies and the evidence they provide with regard to the risks of a service being misused. one of the elements to be taken into account in this regard is the likelihood that the service is used to an appreciable extent , that is , beyond isolated and relatively rare instances , for such abuse. the criteria should vary so as to account of the different characteristics of the various types of online child sexual abuse at stake and of the different characteristics of the services used to engage in such abuse , as well as the related different degree of intrusiveness of the measures to be taken to execute the detection order.


### (22) however , the finding of such a significant risk should in itself be insufficient to justify the issuance of a detection order , given that in such a case the order might lead to disproportionate negative consequences for the rights and legitimate interests of other affected parties , in particular for the exercise of users’ fundamental rights. therefore , it should be ensured that detection orders can be issued only after the coordinating authorities and the competent judicial authority or independent administrative authority having objectively and diligently assessed , identified and weighted , on a case-by-case basis , not only the likelihood and seriousness of the potential consequences of the service being misused for the type of online child sexual abuse at issue , but also the likelihood and seriousness of any potential negative consequences for other parties affected. with a view to avoiding the imposition of excessive burdens , the assessment should also take account of the financial and technological capabilities and size of the provider concerned. ### (22) however , the finding of such a significant risk should in itself be insufficient to justify the issuance of a detection order , given that in such a case the order might lead to disproportionate negative consequences for the rights and legitimate interests of other affected parties , in particular for the exercise of users’ fundamental rights. therefore , it should be ensured that detection orders can be issued only after the coordinating authorities and the competent judicial authority having objectively and diligently assessed , identified and weighted , on a case-by-case basis , not only the likelihood and seriousness of the potential consequences of the service being misused for the type of online child sexual abuse at issue , but also the likelihood and seriousness of any potential negative consequences for other parties affected. with a view to avoiding the imposition of excessive burdens , the assessment should also take account of the financial and technological capabilities and size of the provider concerned.


### (23) in addition , to avoid undue interference with fundamental rights and ensure proportionality , when it is established that those requirements have been met and a detection order is to be issued , it should still be ensured that the detection order is targeted and specified so as to ensure that any such negative consequences for affected parties do not go beyond what is strictly necessary to effectively address the significant risk identified. this should concern , in particular , a limitation to an identifiable part or component of the service where possible without prejudice to the effectiveness of the measure , such as specific types of channels of a publicly available interpersonal communications service , or to specific users or specific groups of users , to the extent that they can be taken in isolation for the purpose of detection , as well as the specification of the safeguards additional to the ones already expressly specified in this regulation , such as independent auditing , the provision of additional information or access to data , or reinforced human oversight and review , and the further limitation of the duration of application of the detection order that the coordinating authority deems necessary. to avoid unreasonable or disproportionate outcomes , such requirements should be set after an objective and diligent assessment conducted on a case-by-case basis. ### (23) in addition , to avoid undue interference with fundamental rights and ensure proportionality , when it is established that those requirements have been met and a detection order is to be issued , it should still be ensured that the detection order is targeted , justified , proportionate , limited in time and specified so as to ensure that any such negative consequences for affected parties do not go beyond what is strictly necessary to effectively address the significant risk identified. this should concern , in particular , a limitation to an identifiable part or component of the service where possible without prejudice to the effectiveness of the measure , such as specific types of channels of a publicly available interpersonal communications service , or to specific users or specific groups of users , to the extent that they can be taken in isolation for the purpose of detection , as well as the specification of the safeguards additional to the ones already expressly specified in this regulation , such as independent auditing , the provision of additional information or access to data , or reinforced human oversight and review , and the further limitation of the duration of application of the detection order that the coordinating authority deems necessary. to avoid unreasonable or disproportionate outcomes , such requirements should be set after an objective and diligent assessment conducted on a case-by-case basis.


### (24) the competent judicial authority or the competent independent administrative authority , as applicable in accordance with the detailed procedural rules set by the relevant member state , should be in a position to take a well-informed decision on requests for the issuance of detections orders. that is of particular importance to ensure the necessary fair balance of the fundamental rights at stake and a consistent approach , especially in connection to detection orders concerning the solicitation of children. therefore , a procedure should be provided for that allows the providers concerned , the eu centre on child sexual abuse established by this regulation (‘eu centre’) and , where so provided in this regulation , the competent data protection authority designated under regulation (eu) 2016/679 to provide their views on the measures in question. they should do so as soon as possible , having regard to the important public policy objective at stake and the need to act without undue delay to protect children. in particular , data protections authorities should do their utmost to avoid extending the time period set out in regulation (eu) 2016/679 for providing their opinions in response to a prior consultation. furthermore , they should normally be able to provide their opinion well within that time period in situations where the european data protection board has already issued guidelines regarding the technologies that a provider envisages deploying and operating to execute a detection order addressed to it under this regulation. ### (24) the competent judicial authority should be in a position to take a well-informed decision on requests for the issuance of detections orders. that is of great importance to ensure the necessary fair balance of the fundamental rights at stake and a consistent approach , this is in particular significant in connection to detection orders concerning the solicitation of children. therefore , a procedure should be provided for that allows the providers concerned , the eu centre on child sexual abuse established by this regulation (‘eu centre’) and , where so provided in this regulation , the competent data protection authority designated under regulation (eu) 2016/679 to provide their views on the measures in question. they should do so as soon as possible , having regard to the important public policy objective at stake and the need to act without undue delay to protect children. in particular , data protections authorities should do their utmost to avoid extending the time period set out in regulation (eu) 2016/679 for providing their opinions in response to a prior consultation. furthermore , they should normally be able to provide their opinion well within that time period in situations where the european data protection board has already issued guidelines regarding the technologies that a provider envisages deploying and operating to execute a detection order addressed to it under this regulation.


### (24) the competent judicial authority or the competent independent administrative authority , as applicable in accordance with the detailed procedural rules set by the relevant member state , should be in a position to take a well-informed decision on requests for the issuance of detections orders. that is of particular importance to ensure the necessary fair balance of the fundamental rights at stake and a consistent approach , especially in connection to detection orders concerning the solicitation of children. therefore , a procedure should be provided for that allows the providers concerned , the eu centre on child sexual abuse established by this regulation (‘eu centre’) and , where so provided in this regulation , the competent data protection authority designated under regulation (eu) 2016/679 to provide their views on the measures in question. they should do so as soon as possible , having regard to the important public policy objective at stake and the need to act without undue delay to protect children. in particular , data protections authorities should do their utmost to avoid extending the time period set out in regulation (eu) 2016/679 for providing their opinions in response to a prior consultation. furthermore , they should normally be able to provide their opinion well within that time period in situations where the european data protection board has already issued guidelines regarding the technologies that a provider envisages deploying and operating to execute a detection order addressed to it under this regulation. ### (24) the competent judicial authority or the competent independent administrative authority , as applicable in accordance with the detailed procedural rules set by the relevant member state , should be in a position to take a well-informed decision on requests for the issuance of detections orders. that is of particular importance to ensure the necessary fair balance of the fundamental rights at stake and a consistent approach , especially in connection to detection orders concerning the solicitation of children. therefore , a procedure should be provided for that allows the providers concerned , the eu centre on child sexual abuse established by this regulation (‘eu centre’) and , where so provided in this regulation , the competent data protection authority designated under regulation (eu) 2016/679 to provide their views on the measures in question. they should do so as soon as possible , having regard to the important public policy objective at stake and the need to act without undue delay to protect children , in view of the seriousness of the impact that such offences have on the physical and mental health of minors and in view of the difficulty of curbing the dissemination of material online. in particular , data protections authorities should do their utmost to avoid extending the time period set out in regulation (eu) 2016/679 for providing their opinions in response to a prior consultation. furthermore , they should normally be able to provide their opinion well within that time period in situations where the european data protection board has already issued guidelines regarding the technologies that a provider envisages deploying and operating to execute a detection order addressed to it under this regulation.


### (26) the measures taken by providers of hosting services and providers of publicly available interpersonal communications services to execute detection orders addressed to them should remain strictly limited to what is specified in this regulation and in the detection orders issued in accordance with this regulation. in order to ensure the effectiveness of those measures , allow for tailored solutions , remain technologically neutral , and avoid circumvention of the detection obligations , those measures should be taken regardless of the technologies used by the providers concerned in connection to the provision of their services. therefore , this regulation leaves to the provider concerned the choice of the technologies to be operated to comply effectively with detection orders and should not be understood as incentivising or disincentivising the use of any given technology , provided that the technologies and accompanying measures meet the requirements of this regulation. that includes the use of end-to-end encryption technology , which is an important tool to guarantee the security and confidentiality of the communications of users , including those of children. when executing the detection order , providers should take all available safeguard measures to ensure that the technologies employed by them cannot be used by them or their employees for purposes other than compliance with this regulation , nor by third parties , and thus to avoid undermining the security and confidentiality of the communications of users. ### (26) the measures taken by providers of hosting services and providers of publicly available interpersonal communications services to execute detection orders addressed to them should remain strictly limited to what is specified in this regulation and in the detection orders issued in accordance with this regulation. in order to ensure the effectiveness of those measures , allow for tailored solutions , remain technologically neutral , and avoid circumvention of the detection obligations , those measures should be taken regardless of the technologies used by the providers concerned in connection to the provision of their services. therefore , this regulation leaves to the provider concerned the choice of the technologies to be operated to comply effectively with detection orders and should not be understood as incentivising or disincentivising the use of any given technology , provided that the technologies and accompanying measures meet the requirements of this regulation. that includes the use of end-to-end encryption technology , which is an important tool to guarantee the security and confidentiality of the communications of users , including those of children. nothing in this regulation should therefore be interpreted as making end-to-end encryption impossible , in particular considering that technologies that allow the effective detection of online child sexual abuse in end-to-end encrypted communications already exist , and make it possible to balance all the fundamental rights at stake. these rights include on one hand the right to physical and mental integrity of children (article 3 of the eu charter of fundamental rights (the ‘charter’)) , the prohibition of torture and inhuman and degrading treatment (article 4 charter) , their right to such protection and care as is necessary for their well-being (article 24 charter) , their right to respect for their private and family life (article 7 eu charter) as well as to protection of their personal data (article 8 charter). the rights also include , on the other hand , the right to respect for private and family life (article 7 charter) , to protection of personal data (article 8 charter) , and the freedom of expression (article 11 charter) of the other users of the online services concerned. finally , the rights at stake also include the freedom to conduct a business (article 16 charter) of the online service providers that fall within the scope of the proposal. the commission should in cooperation with the eu centre consider making available effective detection of online child sexual abuse in end-to-end encrypted communications tools. when executing the detection order , providers should take all available safeguard measures to ensure that the technologies employed by them cannot be used by them or their employees for purposes other than compliance with this regulation , nor by third parties , and thus to avoid undermining the security and confidentiality of the communications of users.


### (31) the rules of this regulation should not be understood as affecting the requirements regarding removal orders set out in regulation (eu) …/… [on a single market for digital services (digital services act) and amending directive 2000/31/ec]. ### (31) the rules of this regulation should not be understood as affecting the requirements regarding removal orders set out in regulation (eu) 2022/2065.


### (34) considering that acquiring , possessing , knowingly obtaining access and transmitting child sexual abuse material constitute criminal offences under directive 2011/93/eu , it is necessary to exempt providers of relevant information society services from criminal liability when they are involved in such activities , insofar as their activities remain strictly limited to what is needed for the purpose of complying with their obligations under this regulation and they act in good faith. ### (34) in order to allow for an efficient reporting system and considering that acquiring , possessing , knowingly obtaining access and transmitting child sexual abuse material constitute criminal offences under directive 2011/93/eu , it is necessary to exempt providers of relevant information society services from criminal liability when they are involved in such activities , including taking voluntary measures , insofar as their activities remain strictly limited to what is needed for the purpose of complying with their obligations under this regulation and they act in good faith.


### (40) in order to facilitate smooth and efficient communications by electronic means , including , where relevant , by acknowledging the receipt of such communications , relating to matters covered by this regulation , providers of relevant information society services should be required to designate a single point of contact and to publish relevant information relating to that point of contact , including the languages to be used in such communications. in contrast to the provider’s legal representative , the point of contact should serve operational purposes and should not be required to have a physical location. suitable conditions should be set in relation to the languages of communication to be specified , so as to ensure that smooth communication is not unreasonably complicated. for providers subject to the obligation to establish a compliance function and nominate compliance officers in accordance with regulation (eu) …/… [on a single market for digital services (digital services act) and amending directive 2000/31/ec] , one of these compliance officers may be designated as the point of contact under this regulation , in order to facilitate coherent implementation of the obligations arising from both frameworks. ### (40) in order to facilitate smooth and efficient communications by electronic means , including , where relevant , by acknowledging the receipt of such communications , relating to matters covered by this regulation , providers of relevant information society services should be required to designate a single point of contact and to publish relevant information relating to that point of contact , including the languages to be used in such communications. in contrast to the provider’s legal representative , the point of contact should serve operational purposes and should not be required to have a physical location. suitable conditions should be set in relation to the languages of communication to be specified , so as to ensure that smooth communication is not unreasonably complicated. for providers subject to the obligation to establish a compliance function and nominate compliance officers in accordance with regulation (eu) 2022/2065 , one of these compliance officers may be designated as the point of contact under this regulation , in order to facilitate coherent implementation of the obligations arising from both frameworks.


### (42) where relevant and convenient , subject to the choice of the provider of relevant information society services and the need to meet the applicable legal requirements in this respect , it should be possible for those providers to designate a single point of contact and a single legal representative for the purposes of regulation (eu) …/… [on a single market for digital services (digital services act) and amending directive 2000/31/ec] and this regulation. ### (42) where relevant and convenient , subject to the choice of the provider of relevant information society services and the need to meet the applicable legal requirements in this respect , it should be possible for those providers to designate a single point of contact and a single legal representative for the purposes of regulation (eu) 2022/2065 and this regulation.


### (70) longstanding union support for both inhope and its member hotlines recognises that hotlines are in the frontline in the fight against online child sexual abuse. the eu centre should leverage the network of hotlines and encourage that they work together effectively with the coordinating authorities , providers of relevant information society services and law enforcement authorities of the member states. the hotlines’ expertise and experience is an invaluable source of information on the early identification of common threats and solutions , as well as on regional and national differences across the union. ### (70) longstanding union support for both inhope and its member hotlines recognises that hotlines are in the frontline in the fight against online child sexual abuse. the eu centre should leverage the network of hotlines , concluding , when necessary , strategic and/or operational cooperation agreements with them and encourage that they cooperate and coordinate effectively with the coordinating authorities , providers of relevant information society services and law enforcement authorities of the member states. the hotlines’ expertise and experience is an invaluable source of information on the early identification of common threats and solutions , as well as on regional and national differences across the union.


### (70) longstanding union support for both inhope and its member hotlines recognises that hotlines are in the frontline in the fight against online child sexual abuse. the eu centre should leverage the network of hotlines and encourage that they work together effectively with the coordinating authorities , providers of relevant information society services and law enforcement authorities of the member states. the hotlines’ expertise and experience is an invaluable source of information on the early identification of common threats and solutions , as well as on regional and national differences across the union. ### (70) longstanding union support for both inhope and its member hotlines recognises that hotlines are in the frontline in the fight against online child sexual abuse. the eu centre should leverage the network of hotlines and encourage that they work together effectively with the coordinating authorities , providers of relevant information society services and law enforcement authorities of the member states. the hotlines’ expertise and experience is an invaluable source of information on the early identification of common threats and solutions , as well as on regional and national differences across the union. their experience and expertise shall help the eu centre and coordinating authorities to design appropriate prevention techniques and awareness campaigns on online grooming and dissemination of csam online.


### this regulation lays down uniform rules to address the misuse of relevant information society services for online child sexual abuse in the internal market. ### this regulation lays down uniform rules to prevent and address the misuse of relevant information society services for online child sexual abuse and ensure the smooth functioning of a digital single market.


### obligations on providers of hosting services and providers of interpersonal communication services to detect and report online child sexual abuse; ### obligations on relevant providers of hosting services and relevant providers of interpersonal communication services that allow the dissemination and sharing of images and videos to detect and report online child sexual abuse;


### directive 2000/31/ec and regulation (eu) …/… [on a single market for digital services (digital services act) and amending directive 2000/31/ec]; ### directive 2000/31/ec and regulation (eu) 2022/2065;


### ‘hosting service’ means an information society service as defined in article 2 , point (f) , third indent , of regulation (eu) …/… [on a single market for digital services (digital services act) and amending directive 2000/31/ec]; ### ‘hosting service’ means an information society service as defined in article 2 , point (f) , third indent , of regulation (eu) …/… [on a single market for digital services (digital services act) and amending directive 2000/31/ec]; in so far they allow the dissemination and sharing of images and videos;


### ‘hosting service’ means an information society service as defined in article 2 , point (f) , third indent , of regulation (eu) …/… [on a single market for digital services (digital services act) and amending directive 2000/31/ec]; ### ‘hosting service’ means an information society service as defined in article 3 , point (g) , third indent , of regulation (eu) 2022/2065;


### ‘interpersonal communications service’ means a publicly available service as defined in article 2 , point 5 , of directive (eu) 2018/1972 , including services which enable direct interpersonal and interactive exchange of information merely as a minor ancillary feature that is intrinsically linked to another service; ### ‘interpersonal communications service’ means a publicly available service as defined in article 2 , point 5 , of directive (eu) 2018/1972 , including services which enable direct interpersonal and interactive exchange of information merely as a minor ancillary feature that is intrinsically linked to another service in so far they allow the dissemination and sharing of images and videos;


### ‘software application’ means a digital product or service as defined in article 2 , point 13 , of regulation (eu) …/… [on contestable and fair markets in the digital sector (digital markets act)]; ### ‘software application’ means a digital product or service as defined in article 2 , point 15 , of regulation (eu) 2022/1925;


### ‘software application store’ means a service as defined in article 2 , point 12 , of regulation (eu) …/… [on contestable and fair markets in the digital sector (digital markets act)]; ### ‘software application store’ means a service as defined in article 2 , point 14 , of regulation (eu) 2022/1925;


### ‘child user’ means a natural person who uses a relevant information society service and who is a natural person below the age of 17 years; ### ‘child user’ means a natural person who uses a relevant information society service and who is a natural person below the age of 18 years;


### ‘recommender system’ means the system as defined in article 2 , point (o) , of regulation (eu) …/… [on a single market for digital services (digital services act) and amending directive 2000/31/ec]; ### ‘recommender system’ means the system as defined in article 3 , point (s) , of regulation (eu) 2022/2065;


### ‘content moderation’ means the activities as defined in article 2 , point (p) , of regulation (eu) …/… [on a single market for digital services (digital services act) and amending directive 2000/31/ec]; ### ‘content moderation’ means the activities as defined in article 3 , point (t) , of regulation (eu) 2022/2065;


### ‘terms and conditions’ means terms and conditions as defined in article 2 , point (q) , of regulation (eu) …/… [on a single market for digital services (digital services act) and amending directive 2000/31/ec]; ### ‘terms and conditions’ means terms and conditions as defined in article 3 , point (u) , of regulation (eu) 2022/2065;


### — functionalities enabling age verification; ### — functionalities enabling age assessing measures;


### the provider may request the eu centre to perform an analysis of representative , anonymized data samples to identify potential online child sexual abuse , to support the risk assessment. ### the provider may request the eu centre to perform an analysis of representative , anonymized data samples to identify potential online child sexual abuse , to support the risk assessment. this request cannot serve the purpose of evading any of the provider’s obligations set up in this regulation. the eu centre shall perfom the analysis in a timely manner.


### the costs incurred by the eu centre for the performance of such an analysis shall be borne by the requesting provider. however , the eu centre shall bear those costs where the provider is a micro , small or medium-sized enterprise , provided the request is reasonably necessary to support the risk assessment. ### the costs incurred by the eu centre for the performance of such an analysis shall be borne by the requesting provider. however , the eu centre shall bear those costs where the provider is a micro , small or medium-sized enterprise.


### initiating or adjusting cooperation , in accordance with competition law , with other providers of hosting services or providers of interpersonal communication services , public authorities , civil society organisations or , where applicable , entities awarded the status of trusted flaggers in accordance with article 19 of regulation (eu) …/… [on a single market for digital services (digital services act) and amending directive 2000/31/ec] . ### initiating or adjusting cooperation , in accordance with competition law , with other providers of hosting services or providers of interpersonal communication services , public authorities , civil society organisations or , where applicable , entities awarded the status of trusted flaggers in accordance with article 19 of regulation (eu) 2022/2065.


### 3. providers of interpersonal communications services that have identified , pursuant to the risk assessment conducted or updated in accordance with article 3 , a risk of use of their services for the purpose of the solicitation of children , shall take the necessary age verification and age assessment measures to reliably identify child users on their services , enabling them to take the mitigation measures. ### 3. providers of interpersonal communications services that have identified , pursuant to the risk assessment conducted or updated in accordance with article 3 , a risk of use of their services for the purpose of the solicitation of children , shall take the necessary age verification and age assessment measures to reliably identify child users on their services , enabling them to take the mitigation measures and to put in place effective measure to block the access of children to websites that fall under an age-restriction applicable under national law.


### 3. providers of interpersonal communications services that have identified , pursuant to the risk assessment conducted or updated in accordance with article 3 , a risk of use of their services for the purpose of the solicitation of children , shall take the necessary age verification and age assessment measures to reliably identify child users on their services , enabling them to take the mitigation measures. ### 3. providers of interpersonal communications services that have identified , pursuant to the risk assessment conducted or updated in accordance with article 3 , a risk of use of their services for the purpose of the solicitation of children , shall take the necessary age assessment measures to reliably identify child users on their services , enabling them to take the mitigation measures. the age assessement tools shall be able to verify the age in an efficient , privacy-preserving and secure manner.


### 5. the commission , in cooperation with coordinating authorities and the eu centre and after having conducted a public consultation , may issue guidelines on the application of paragraphs 1 , 2 , 3 and 4 , having due regard in particular to relevant technological developments and in the manners in which the services covered by those provisions are offered and used. ### 5. the commission , in cooperation with coordinating authorities and the eu centre and after having conducted a public consultation , shall issue guidelines on the application of paragraphs 1 , 2 , 3 and 4 , having due regard in particular to relevant technological developments and in the manners in which the services covered by those provisions are offered and used.


### take reasonable measures to prevent child users from accessing the software applications in relation to which they have identified a significant risk of use of the service concerned for the purpose of the solicitation of children; ### take reasonable and effective measures to prevent child users from accessing the software applications in relation to which they have identified a significant risk of use of the service concerned for the purpose of the solicitation of children leading to an online child sex abuse;


### take the necessary age verification and age assessment measures to reliably identify child users on their services , enabling them to take the measures referred to in point (b). ### take the necessary age assessment measures to reliably identify child users on their services in an effective , privacy-preserving and secure manner , enabling them to take the measures referred to in point (b).


### 1. the coordinating authority of establishment shall have the power to request the competent judicial authority of the member state that designated it or another independent administrative authority of that member state to issue a detection order requiring a provider of hosting services or a provider of interpersonal communications services under the jurisdiction of that member state to take the measures specified in article 10 to detect online child sexual abuse on a specific service. ### 1. as a last resort , the coordinating authority of establishment shall have the power to request the competent judicial authority of the member state that designated it to issue a detection order , limited in time , requiring a provider of hosting services or a provider of interpersonal communications services under the jurisdiction of that member state to take the measures specified in article 10 to detect online child sexual abuse on a specific service.


### the coordinating authority of establishment shall , before requesting the issuance of a detection order , carry out the investigations and assessments necessary to determine whether the conditions of paragraph 4 have been met. ### before requesting the issuance of a detection oder , the coordinating authority of establishment shall carry out the investigations and assessments necessary to determine whether all conditions of paragraph 4 have been met.


### where the coordinating authority of establishment takes the preliminary view that the conditions of paragraph 4 have been met , it shall: ### where the coordinating authority of establishment takes the preliminary view that the conditions of paragraph 4 have been met and the measures envisaged in the detection order are proportionate , it shall:


### submit the draft request to the provider and the eu centre; ### submit the draft request to the concerned provider and the eu centre;


### invite the eu centre to provide its opinion on the draft request , within a time period of four weeks from the date of receiving the draft request. ### invite the eu centre to provide its opinion on the draft request , within a time period of two weeks from the date of receiving the draft request.


### where , having regard to the implementation plan of the provider and the opinion of the data protection authority , that coordinating authority continues to be of the view that the conditions of paragraph 4 have met , it shall submit the request for the issuance of the detection , adjusted where appropriate , to the competent judicial authority or independent administrative authority. it shall attach the implementation plan of the provider and the opinions of the eu centre and the data protection authority to that request. ### where , having regard to the implementation plan of the provider and the opinion of the data protection authority , that coordinating authority continues to be of the view that the conditions of paragraph 4 have met , it shall submit the request for the issuance of the detection order , adjusted where appropriate , to the competent judicial authority. it shall attach the implementation plan of the provider and the opinions of the eu centre and the data protection authority to that request.


### the coordinating authority of establishment shall request the issuance of the detection order , and the competent judicial authority or independent administrative authority shall issue the detection order where it considers that the following conditions are met: ### the coordinating authority of establishment shall request the issuance of the detection order , and the competent judicial authority shall issue the detection order where it considers that the following conditions are met:


### as regards the second subparagraph , point (d) , where that coordinating authority substantially deviates from the opinion of the eu centre , it shall inform the eu centre and the commission thereof , specifying the points at which it deviated and the main reasons for the deviation. ### as regards the second subparagraph , point (d) , where that coordinating authority substantially deviates from the opinion of the eu centre , it shall inform the eu centre and the commission thereof , specifying in detail the points at which it deviated and the main reasons for the deviation.


### it is likely that , despite any mitigation measures that the provider may have taken or will take , the service is used , to an appreciable extent , for the dissemination of new child sexual abuse material; ### it is likely that , despite any mitigation measures that the provider may have taken or will take , the service is used , to an appreciable extent , for the dissemination of new child sexual abuse material , including live stream and live transmission;


### the coordinating authority of establishment when requesting the issuance of detection orders , and the competent judicial or independent administrative authority when issuing the detection order , shall target and specify it in such a manner that the negative consequences referred to in paragraph 4 , first subparagraph , point (b) , remain limited to what is strictly necessary to effectively address the significant risk referred to in point (a) thereof. ### the coordinating authority of establishment when requesting the issuance of detection orders , and the competent judicial when issuing the detection order , shall target and specify it in such a manner that the negative consequences referred to in paragraph 4 , first subparagraph , point (b) , remain limited to what is strictly necessary to effectively address the significant risk referred to in point (a) thereof.


### the competent judicial authority or independent administrative authority shall specify in the detection order the period during which it applies , indicating the start date and the end date. ### the competent judicial authority shall specify in the detection order the period during which it applies , indicating the start date and the end date.


### 1. the competent judicial authority or independent administrative authority shall issue the detection orders referred to in article 7 using the template set out in annex i. detection orders shall include: ### 1. the competent judicial authority shall issue the detection orders referred to in article 7 using the template set out in annex i. detection orders shall include:


### identification details of the competent judicial authority or the independent administrative authority issuing the detection order and authentication of the detection order by that judicial or independent administrative authority; ### identification details of the competent judicial authority issuing the detection order and authentication of the detection order by that judicial authority;


### the date , time stamp and electronic signature of the judicial or independent administrative authority issuing the detection order; ### the date , time stamp and electronic signature of the judicial issuing the detection order;


### the competent judicial authority or independent administrative authority issuing the detection order shall address it to the main establishment of the provider or , where applicable , to its legal representative designated in accordance with article 24. ### the competent judicial authority issuing the detection order shall address it to the main establishment of the provider or , where applicable , to its legal representative designated in accordance with article 24.


### 1. providers of hosting services and providers of interpersonal communications services that have received a detection order , as well as users affected by the measures taken to execute it , shall have a right to effective redress. that right shall include the right to challenge the detection order before the courts of the member state of the competent judicial authority or independent administrative authority that issued the detection order. ### 1. providers of hosting services and providers of interpersonal communications services that have received a detection order , as well as users affected by the measures taken to execute it , shall have a right to effective redress. that right shall include the right to challenge the detection order before the courts of the member state of the competent judicial authority that issued the detection order.


### when the detection order becomes final , the competent judicial authority or independent administrative authority that issued the detection order shall , without undue delay , transmit a copy thereof to the coordinating authority of establishment. the coordinating authority of establishment shall then , without undue delay , transmit a copy thereof to all other coordinating authorities through the system established in accordance with article 39(2). ### when the detection order becomes final , the competent judicial authority that issued the detection order shall , without undue delay , transmit a copy thereof to the coordinating authority of establishment. the coordinating authority of establishment shall then , without undue delay , transmit a copy thereof to all other coordinating authorities through the system established in accordance with article 39(2).


### (67) given its central position resulting from the performance of its primary tasks under this regulation and the information and expertise it can gather in connection thereto , the eu centre should also contribute to the achievement of the objectives of this regulation by serving as a hub for knowledge , expertise and research on matters related to the prevention and combating of online child sexual abuse. in this connection , the eu centre should cooperate with relevant stakeholders from both within and outside the union and allow member states to benefit from the knowledge and expertise gathered , including best practices and lessons learned. ### (67) given its central position resulting from the performance of its primary tasks under this regulation and the information and expertise it can gather in connection thereto , the eu centre should also contribute to the achievement of the objectives of this regulation by serving as a hub for knowledge , expertise and research on matters related to the prevention and combating of online child sexual abuse. the eu center should contribute to the creation of adequate prevention strategies and awareness campaigns on online grooming and dissemination of csam , targeting children , parents and educators across the union. in this connection , the eu centre should cooperate with relevant stakeholders from both within and outside the union and allow member states to benefit from the knowledge and expertise gathered , including best practices and lessons learned.


### (12) for reasons of consistency and technological neutrality , the term ‘child sexual abuse material’ should for the purpose of this regulation be defined as referring to any type of material constituting child pornography or pornographic performance within the meaning of directive 2011/93/eu , which is capable of being disseminated through the use of hosting or interpersonal communication services. at present , such material typically consists of images or videos , without it however being excluded that it takes other forms , especially in view of future technological developments. ### (12) for reasons of consistency and technological neutrality , the term ‘child sexual abuse material’ should for the purpose of this regulation be defined as referring to any type of material constituting child pornography or pornographic performance within the meaning of directive 2011/93/eu , which is capable of being disseminated through the use of hosting or interpersonal communication services. at present , such material typically consists of images or videos , without it however being excluded that it takes other forms , especially in view of future technological developments. close attention should be paid to the development of new technologies and platforms , such as the metaverse. in such platforms child sexual abuse material might be generated and exchanged or child sexual abuse perpetrated through the use of avatars or any other form of virtual identities.


### (35) the dissemination of child sexual abuse material is a criminal offence that affects the rights of the victims depicted. victims should therefore have the right to obtain , upon request , from the eu centre yet via the coordinating authorities , relevant information if known child sexual abuse material depicting them is reported by providers of hosting services or providers of publicly available interpersonal communications services in accordance with this regulation. ### (35) the dissemination of child sexual abuse material is a criminal offence that affects the rights of the victims depicted. victims have the right to be forgotten , i.e. the right to request the deletion of child sexual abuse material depicting them. victims should also have the right to obtain , upon request , from the eu centre yet via the coordinating authorities , relevant information if known child sexual abuse material depicting them is reported by providers of hosting services or providers of publicly available interpersonal communications services in accordance with this regulation.


### (58) in particular , in order to facilitate the cooperation needed for the proper functioning of the mechanisms set up by this regulation , the eu centre should establish and maintain the necessary information-sharing systems. when establishing and maintaining such systems , the eu centre should cooperate with the european union agency for law enforcement cooperation (‘europol’) and national authorities to build on existing systems and best practices , where relevant. ### (58) in particular , in order to facilitate the cooperation needed for the proper functioning of the mechanisms set up by this regulation , the eu centre should establish and maintain the necessary information-sharing systems. when establishing and maintaining such systems , the eu centre should cooperate with the european union agency for law enforcement cooperation (‘europol’) , national hotlines and national authorities to build on existing systems and best practices , where relevant.


### (60) in the interest of legal certainty and effectiveness , the tasks of the eu centre should be listed in a clear and comprehensive manner. with a view to ensuring the proper implementation of this regulation , those tasks should relate in particular to the facilitation of the detection , reporting and blocking obligations imposed on providers of hosting services , providers of publicly available interpersonal communications services and providers of internet access services. however , for that same reason , the eu centre should also be charged with certain other tasks , notably those relating to the implementation of the risk assessment and mitigation obligations of providers of relevant information society services , the removal of or disabling of access to child sexual abuse material by providers of hosting services , the provision of assistance to coordinating authorities , as well as the generation and sharing of knowledge and expertise related to online child sexual abuse. ### (60) in the interest of legal certainty and effectiveness , the tasks of the eu centre should be listed in a clear and comprehensive manner. with a view to ensuring the proper implementation of this regulation , those tasks should relate in particular to the facilitation of the detection , reporting and blocking obligations imposed on providers of hosting services , providers of publicly available interpersonal communications services and providers of internet access services. however , for that same reason , the eu centre should also be charged with certain other tasks , notably those relating to the implementation of the risk assessment and mitigation obligations of providers of relevant information society services , the removal of or disabling of access to child sexual abuse material by providers of hosting services , the provision of assistance to coordinating authorities , as well as the creation of prevention strategies , generation and sharing of knowledge and expertise related to online child sexual abuse.


### (73) to ensure its proper functioning , the necessary rules should be laid down regarding the eu centre’s organisation. in the interest of consistency , those rules should be in line with the common approach of the european parliament , the council and the commission on decentralised agencies. ### (73) to ensure its proper functioning , the necessary rules should be laid down regarding the eu centre’s organisation. in the interest of consistency , those rules should be in line with the common approach of the european parliament , the council and the commission on decentralised agencies. in order to complete its tasks , the eu centre and coordinating authorities should have the necessary funds , human resources , investigative powers and technical capabilities to seriously and effectively pursue and investigate complaints and potential offenders , including appropriate training to build capacity in the judiciary and police units and to develop new high-tech capabilities to address the challenges of analysing vast amounts of child abuse imagery , including material hidden on the ‘dark web’.


### (74) in view of the need for technical expertise in order to perform its tasks , in particular the task of providing a list of technologies that can be used for detection , the eu centre should have a technology committee composed of experts with advisory function. the technology committee may , in particular , provide expertise to support the work of the eu centre , within the scope of its mandate , with respect to matters related to detection of online child sexual abuse , to support the eu centre in contributing to a high level of technical standards and safeguards in detection technology. ### (74) in view of the need for technical expertise in order to perform its tasks , in particular the task of providing a list of technologies that can be used for detection , the eu centre should stay consistently updated on technological developments that might lead to the creation of different or unconventional platforms , such as the metaverse , on which child sexual abuse might be perpetrated or child sexual abuse material be generated or exchanged; it should therefore have a technology committee composed of experts with advisory function. the technology committee may , in particular , provide expertise to support the work of the eu centre , within the scope of its mandate , with respect to matters related to detection of online child sexual abuse , to support the eu centre in contributing to a high level of technical standards and safeguards in detection technology.


### (74) in view of the need for technical expertise in order to perform its tasks , in particular the task of providing a list of technologies that can be used for detection , the eu centre should have a technology committee composed of experts with advisory function. the technology committee may , in particular , provide expertise to support the work of the eu centre , within the scope of its mandate , with respect to matters related to detection of online child sexual abuse , to support the eu centre in contributing to a high level of technical standards and safeguards in detection technology. ### (74) in view of the need for technical expertise in order to perform its tasks , in particular the task of providing a list of technologies that can be used for detection , the eu centre should have a technology committee composed of experts with advisory function. the technology committee may , in particular , provide expertise to support the work of the eu centre , within the scope of its mandate , with respect to matters related to prevention and detection of online child sexual abuse , to support the eu centre in contributing to a high level of technical standards and safeguards in detection technology.


### (76) in the interest of good governance and drawing on the statistics and information gathered and transparency reporting mechanisms provided for in this regulation , the commission should carry out an evaluation of this regulation within five years of the date of its entry into force , and every five years thereafter. ### (76) in the interest of good governance and drawing on the statistics and information gathered and transparency reporting mechanisms provided for in this regulation , the commission should carry out an evaluation of this regulation within three years of the date of its entry into force , and every three years thereafter.


### the coordinating authority shall be responsible for all matters related to application and enforcement of this regulation in the member state concerned , unless that member state has assigned certain specific tasks or sectors to other competent authorities. ### the coordinating authority shall be responsible for all matters related to application and enforcement of this regulation in the member state concerned , unless that member state has assigned certain specific tasks or sectors to other competent authorities. the coordinating authority shall also be responsible for the coordination and adaptation of prevention techniques , elaborated by the eu centre. the coordinating authority shall generate recommendations and good practices on improving digital literacy and skills amongst the population trough the realization of awareness campaigns on a national level , targeting in particular parents and children on the detection and prevention of child sexual abuse online.


### 2. coordinating authorities shall provide child-friendly mechanisms to submit a complaint under this article and adopt a child-sensitive approach when handling complaints submitted by children , taking due account of the child's age , maturity , views , needs and concerns. ### 2. coordinating authorities shall also provide children with the necessary tools to recognize suspicious behavior and potentially dangerous content online and easily submit a complaint under this article. coordinating authorities shall examine every complaint and adopt a child-sensitive approach taking into account the specificities of all elements of the complaint (website or interpersonal communication service , child’s age , specific concern).


### 3. where necessary for the performance of its tasks under this regulation , the eu centre shall carry out , participate in or encourage research , surveys and studies , either on its own initiative or , where appropriate and compatible with its priorities and its annual work programme , at the request of the european parliament , the council or the commission. ### 3. where necessary for the performance of its tasks under this regulation , the eu centre shall carry out , participate in or encourage research , surveys and studies , either on its own initiative or , where appropriate and compatible with its priorities and its annual work programme , at the request of the european parliament , the council or the commission. the collected knowledge (resulting from research , surveys and studies) shall serve as a tool to elaborate prevention techniques on child sexual abuse online to be adapted and implemented by coordinating authorities in each member state.


### 4. the eu centre shall provide the information referred to in paragraph 2 and the information resulting from the research , surveys and studies referred to in paragraph 3 , including its analysis thereof , and its opinions on matters related to the prevention and combating of online child sexual abuse to other union institutions , bodies , offices and agencies , coordinating authorities , other competent authorities and other public authorities of the member states , either on its own initiative or at request of the relevant authority. where appropriate , the eu centre shall make such information publicly available. ### 4. the eu centre shall provide the information referred to in paragraph 2 and the information resulting from the research , surveys and studies referred to in paragraph 3 , including its analysis thereof , and its opinions on matters related to the prevention and combating of online child sexual abuse to other union institutions , bodies , offices and agencies , coordinating authorities , hotlines , other competent authorities and other public authorities of the member states , either on its own initiative or at request of the relevant authority. where appropriate , the eu centre shall make such information publicly available.


### 5. the eu centre shall develop a communication strategy and promote dialogue with civil society organisations and providers of hosting or interpersonal communication services to raise public awareness of online child sexual abuse and measures to prevent and combat such abuse. ### 5. the eu centre shall develop prevention techniques on the detection of suspicious content and behavior online and shall communicate it to coordinating authorities of each member state , so they could adapt and initiate measures to improve digital literacy and raise awareness amongst parents and educators of the existing digital tools to insure a safe digital environment for children. the eu centre shall also establish a communication strategy and promote dialogue with civil society organisations and providers of hosting or interpersonal communication services to raise public awareness and improve and continuously adapt prevention techniques on grooming and online child sexual abuse.


### a. whereas the functioning of the digital single market should be improved by reinforcing legal certainty for providers of artificial intelligence (ai) , and reinforcing users’ trust by strengthening safeguards to ensure the rule of law and fundamental rights; ### a. whereas the functioning of the digital single market should be improved by reinforcing legal certainty for providers of artificial intelligence (ai) , and reinforcing users' trust in artificial intelligence and its use by the police and judicial authorities in criminal matters;


### a. whereas digital technologies in general and artificial intelligence (ai) in particular bring with them extraordinary promise; whereas ai is one of the strategic technologies of the 21st century , generating substantial benefits in efficiency , accuracy , and convenience , and thus bringing positive change to the european economy; whereas ai should not be seen as an end in itself , but as a tool for serving people , with the ultimate aim of increasing human well-being; ### a. whereas digital technologies in general and the proliferation of data processing and analytics enabled by artificial intelligence (ai) in particular bring with them extraordinary promise; whereas ai development has made a big leap forward in recent years which makes it one of the strategic technologies of the 21st century , generating substantial benefits in efficiency , accuracy , and convenience , and thus bringing positive change to the european economy and society; whereas ai should not be seen as an end in itself , but as a tool for serving people , with the ultimate aim of increasing human well-being , human capabilities and safety;


### a. whereas digital technologies in general and artificial intelligence (ai) in particular bring with them extraordinary promise; whereas ai is one of the strategic technologies of the 21st century , generating substantial benefits in efficiency , accuracy , and convenience , and thus bringing positive change to the european economy; whereas ai should not be seen as an end in itself , but as a tool for serving people , with the ultimate aim of increasing human well-being; ### a. whereas digital technologies in general and artificial intelligence (ai) in particular bring with them extraordinary promise but also a number of critical issues in view of their ethical implications , not to mention their potential impact on several fundamental freedoms; whereas ai is one of the strategic technologies of the 21st century and can generate substantial benefits in efficiency , accuracy , and convenience , thus bringing positive change to european society and europe's economy; whereas ai should not be seen as an end in itself , but as a tool for serving people , with the ultimate aim of increasing human well-being;


### a. whereas the right to fair trial is a fundamental right which also applies to enforcement of the law; ### a. whereas the right to fair trial is a fundamental right which also applies to enforcement of the law and taking into account that ai-based technologies could also have an impact on different human rights;


### a. whereas the right to fair trial is a fundamental right which also applies to enforcement of the law; ### a. whereas the right to fair trial is a fundamental right which must be upheld in all circumstances , in particular in the context of the use of ai;


### 1. considers that ai used by police and judicial authorities has to be categorised as high-risk , given that the role of these authorities is to defend the public interest; considers that the eu should take the lead in laying down basic rules on the development and use of ai to ensure the same high level of consumer protection across the eu; ### 1. considers that there is an urgent need for a common european regulatory framework for ai in the internal market going beyond the scrutiny by the court of justice of the european union of national and union legislation in the areas of law enforcement and public security; considers furthermore that such a common union regulatory framework should classify ai used by police and judicial authorities in criminal matters as a high-risk application that requires detailed regulation on a union level;


### 1. considers that ai used by police and judicial authorities has to be categorised as high-risk , given that the role of these authorities is to defend the public interest; considers that the eu should take the lead in laying down basic rules on the development and use of ai to ensure the same high level of consumer protection across the eu; ### 1. considers that ai used by police and judicial authorities has to be categorised as high-risk , given that the role of these authorities is to defend the public interest; considers that the eu should take the lead in laying down basic rules on the development and use of ai to ensure the same high level of consumer protection across the eu while encouraging innovation and minimising regulatory burdens on businesses , especially smes;