Document ID: chunk:federal_register_of_legislation:F2024L00710:reg:20
Version: federal_register_of_legislation:F2024L00710
Segment Type: reg
Provision Reference: reg 20
Character Range: 59892–62540

20  Detecting and removing known child sexual abuse material
 (1) This section applies to the following:
 (a) a Tier 1 designated internet service;
 (b) an end-user managed hosting service;
 (c) a high impact generative AI DIS.

Minimum requirements—generally
 (2) The provider of a service must implement appropriate systems, appropriate processes and appropriate technologies to:
 (a) detect and identify known child sexual abuse material that:
 (i) is stored on the service; or
 (ii) is accessible by an end-user in Australia using the service; or
 (iii) is being or has been accessed or distributed in Australia using the service; and
 (b) remove known child sexual abuse material from the service as soon as practicable after the provider becomes aware of it.
Note 1: The technologies that the provider may use include hashing technologies and machine learning.
Note 2: For a high impact generative AI DIS, compliance with this subsection may require the provider to assess whether inputs into the service contain child sexual abuse material.
 (3) Subsection (2) does not require a provider to use a system or technology if:
 (a) it is not technically feasible or reasonably practicable for the provider to do so; or
 (b) to do so would require the provider to:
 (i) implement or build a systemic weakness, or a systemic vulnerability, into the service;
 (ii) in relation to an end-to-end encrypted service—implement or build a new decryption capability into the service, or render methods of encryption used in the service less effective.
 (4) If, because of subsection (3), a provider does not implement any systems as described in subsection (2) the provider must take appropriate alternative action.
 (5) If, because of subsection (3), a provider does not implement any technologies as described in subsection (2) the provider must take appropriate alternative action.
Note: For appropriate see section 11.
 (6) This section does not affect the operation of section 22.
Note: This section does not prevent a provider from complying with legal obligations to preserve evidence of offences.

Further minimum requirements —Tier 1 designated internet services
 (7) Without limiting subsection (2) to (6), the provider of a Tier 1 designated internet service must ensure that the service uses systems, processes and technologies that:
 (a) prevent end-users from distributing known child sexual abuse material through the service; and
 (b) identify phrases or words commonly linked to child sexual abuse material and linked activity to enable the provider to deter and reduce the incidence of such material and linked activity on the service.