Document ID: chunk:federal_register_of_legislation:F2024L00710:reg:8:p1
Version: federal_register_of_legislation:F2024L00710
Segment Type: reg
Provision Reference: reg 8 (pt 1/2)
Character Range: 33187–35984

8  Methodology, risk factors and indicators to be used for risk assessments and risk profile determinations

Requirement for plan and methodology
 (1) If the provider is required by this Part to carry out a risk assessment for a service, the provider must formulate in writing a plan, and a methodology, for carrying out the assessment that ensure that the risks mentioned in subsection 7(1) in relation to the service are accurately assessed.
 (2) The provider must ensure that the risk assessment is carried out in accordance with the plan and methodology.

        (3) The provider must ensure that a risk assessment is carried out by persons with the relevant skills, experience and expertise.

Forward-looking analyses of likely changes

        (4) As part of a risk assessment carried out as required by this Part, the provider must undertake a forward-looking analysis of:
 (a) likely changes to the internal and external environment in which the service operates or will operate, including likely changes in the functionality or purpose of, or the scale of, the service; and
 (b) the impact of those changes on the ability of the service to meet the object of this industry standard.
Note: For the object of this industry standard see section 4.

Matters to be taken into account
 (5) Without limiting subsection (1), the methodology for the conduct of a risk assessment must specify the principal matters to be taken into account in assessing relevant risks, which must include the following, so far as they are relevant to the service:
 (a) the predominant purpose of the service;
 (b) the functionality of the service, including whether the service enables end-users in Australia to post or share material;
 (c) the manner in which material is created or contributed to in connection with the service;
 (d) whether the service includes chat, messaging or other communications functionality;
 (e) the extent to which material posted on, generated by or distributed using the service will be available to end-users of the service in Australia;
 (f) the terms of use for the service;
 (g) the terms of arrangements under which the provider acquires content to be made available on the service;
 (h) the ages of end-users and likely end-users of the service;
 (i) the outcomes of the analysis conducted as required by subsection (4);
 (j) safety by design guidance and tools published or made available by a government agency or a foreign or international body;
 (k) the risk to the online safety of end-users in Australia in relation to material generated by artificial intelligence;
 (l) without limiting paragraph (k), the risk that any generative AI features of the service will be used to generate high impact materials;
 (m) where applicable, design features and controls deployed to