Document ID: chunk:federal_register_of_legislation:F2024L00711:reg:8
Version: federal_register_of_legislation:F2024L00711
Segment Type: reg
Provision Reference: reg 8
Character Range: 26381–29049

8  Methodology, risk factors and indicators to be used for risk assessments and risk profile determinations

Requirement for plan and methodology
 (1) If the provider is required by this Part to carry out a risk assessment for a service, the provider must formulate in writing a plan, and a methodology, for carrying out the assessment that ensure that the risks mentioned in subsection 7(1) in relation to the service are accurately assessed.
 (2) The provider must ensure that the risk assessment is carried out in accordance with the plan and methodology.

        (3) The provider must ensure that a risk assessment is carried out by persons with the relevant skills, experience and expertise.

Forward-looking analyses of likely changes

        (4) As part of a risk assessment carried out as required by this Part, the provider must undertake a forward-looking analysis of:
 (a) likely changes to the internal and external environment in which the service operates or will operate, including likely changes in the functionality or purpose of, or the scale of, the service; and
 (b) the impact of those changes on the ability of the service to meet the object of this industry standard.
Note: For the object of this industry standard see section 4.

Matters to be taken into account
 (5) Without limiting subsection (1), the methodology for the conduct of a risk assessment must specify the principal matters to be taken into account in assessing relevant risks, which must include the following, so far as they are relevant to the service:
 (a) the predominant purpose of the service;
 (b) the functionality of the service, including the extent to which material posted on, distributed using or generated by the service will be available to end-users of the service in Australia;
 (c) the terms of use for the service;
 (d) the terms of arrangements under which the provider acquires content to be made available on the service;
 (e) the ages of end-users and likely end-users of the service;
 (f) the outcomes of the analysis conducted as required by subsection (4);
 (g) safety by design guidance and tools published or made available by a government agency or a foreign or international body;
 (h) the risk to the online safety of end-users in Australia in relation to material generated by artificial intelligence.
Note 1: Arrangements referred to in paragraph (d) may include provisions that, if complied with, will reduce the risk that class 1A material and class 1B material will be made available through the service.

            Note 2: Examples of agencies mentioned in paragraph (g) are the Commissioner and the Digital Trust & Safety Partnership.