Document ID: chunk:federal_register_of_legislation:F2024L00710:reg:7:p1
Version: federal_register_of_legislation:F2024L00710
Segment Type: reg
Provision Reference: reg 7 (pt 1/2)
Character Range: 28944–31834

7  Requirement to carry out risk assessments and determine risk profiles of designated internet services

Risk assessments to be carried out

        (1) The provider of a designated internet service must, at the times required by and in accordance with this Part, carry out an assessment of the risk that class 1A material or class 1B material:
           (a) will be generated or accessed by, or distributed by or to, end-users in Australia using the service; and
           (b) will be stored on the service.

Timing of risk assessments

        (2) If the provider of the service was providing the service before the commencement of this industry standard, the risk assessment must be carried out as soon as practicable after, but no later than 6 months after, the commencement of this industry standard.

        (3) Subsection (2) does not apply if a risk assessment that met the requirements of this Part had been carried out in respect of the service within 6 months before the commencement of this industry standard.

        (4) A person must not start to provide a designated internet service to an end-user in Australia unless a risk assessment of the service has been carried out in accordance with this Part within 6 months before the person started to provide the service.

        (5) The provider of a designated internet service must not make a material change to the service unless:
           (a) a risk assessment of the service, as proposed to be changed, has been carried out in accordance with this Part; or
           (b) the change will not increase the risk of class 1A material or class 1B material being accessed or generated by, or distributed to, end-users in Australia using the service, or being stored on the service.
Note: See also sections 33 and 34.

Certain services exempt from risk assessment requirements

        (6) Subsections (1) and (4) do not apply to any of the following:
           (a) a pre-assessed general purpose DIS;
           (b) a pre-assessed classified DIS;
           (c) an end-user managed hosting service;
           (d) an enterprise DIS;
           (e) a high impact DIS;
           (f) a high impact generative AI DIS;
           (g) a model distribution platform;
           (h) a designated internet service that is determined under subsection (9) to be a Tier 1 designated internet service.
Note: However, subsection (1) applies to a designated internet service mentioned in this subsection (6) if the service is materially changed.

Risk profiles of designated internet services

        (7) The provider of a designated internet service that conducts a risk assessment of the service must, on completion of the assessment, determine, in accordance with subsection (8), what the risk profile of the service is.

        (8) The risk profile of a designated internet service is worked out as follows:

Item  If the risk