Document ID: chunk:federal_register_of_legislation:F2024L00711:reg:37
Version: federal_register_of_legislation:F2024L00711
Segment Type: reg
Provision Reference: reg 37
Character Range: 72900–75200

37  Compliance and other certificates and reports required by Commissioner

Enterprise relevant electronic services
 (1) The Commissioner may, by written notice to the provider of an enterprise relevant electronic service, require the provider to certify that, except as specified in the certificate, the provider has complied with section 13 during the most recent calendar year before the date of the notice.

Other relevant electronic services
 (2) The Commissioner may, by written notice to the provider of either of the following:
 (a) a telephony relevant electronic service;
 (b) a Tier 2 relevant electronic service;
require the provider to give the Commissioner a report (a compliance report) for the most recent calendar year before the date of the notice (the reporting period).
 (3) A compliance report under subsection (2) must include the following:
 (a) for a telephony relevant electronic service—a description of the service's functionalities and features during the reporting period and an explanation why the service is properly characterised as a telephony relevant electronic service;
 (b) for a Tier 2 relevant electronic service—details of the most recent risk assessment, including about the plan and methodology required by subsection 8(1);
 (c) in any case:
 (i) details of the steps that the provider took during the reporting period to comply with the requirements of this Part; and
 (ii) an explanation why those steps were appropriate, having regard, among other things, to the features of the service during the reporting period; and
 (iii) a statement of the extent to which it was not, during the reporting period, technically feasible or reasonably practicable for the provider to detect or remove class 1A material or class 1B material from the service, and why.
 (4) A compliance report must provide justification for the conclusions in the report.
 (5) The Commissioner may, by written notice to the provider, require the compliance report to be in a specified form. The provider must comply with the requirement.
 (6) A compliance report may relate to 2 or more services.

Giving certificates and reports
 (7) A provider must comply with a notice under subsection (1) or (2) within 2 months after the notice is given to the provider.
Note: See also section 38.