Document ID: chunk:federal_register_of_legislation:F2024L00711:reg:7:p1
Version: federal_register_of_legislation:F2024L00711
Segment Type: reg
Provision Reference: reg 7 (pt 1/2)
Character Range: 22898–25674

7  Requirement to carry out risk assessments and determine risk profiles of relevant electronic services

Risk assessments to be carried out
 (1) The provider of a relevant electronic service must, at the times required by and in accordance with this Part, carry out an assessment of the risk that class 1A material or class 1B material:
 (a) will be generated or accessed by, or distributed by or to, end-users in Australia using the service; and
 (b) will be stored on the service.

Timing of risk assessments
 (2) If the provider of the service was providing the service before the commencement of this industry standard, the risk assessment must be carried out as soon as practicable after, but no later than 6 months after, the commencement of this industry standard.
 (3) Subsection (2) does not apply if a risk assessment that met the requirements of this Part had been carried out in respect of the service within 6 months before the commencement of this industry standard.
 (4) A person must not start to provide a relevant electronic service to an end-user in Australia unless a risk assessment of the service has been carried out in accordance with this Part within 6 months before the person started to provide the service.

        (5) The provider of a relevant electronic service must not make a material change to the service unless:
           (a) a risk assessment of the service, as proposed to be changed, has been carried out in accordance with this Part; or
           (b) the change will not increase the risk of class 1A material or class 1B material being accessed by, or distributed to, end-users in Australia using the service, or being stored on the service.

Certain services exempt from risk assessment requirements
 (6) Subsections (1) and (4) do not apply to any of the following:
 (a) an enterprise relevant electronic service;
 (b) a gaming service with limited communications functionality;
 (c) a pre-assessed relevant electronic service;
 (d) a relevant electronic service that is determined under subsection (9) to be a Tier 1 relevant electronic service.
Note: However, subsection (1) applies to a relevant electronic service mentioned in this subsection if the service is materially changed.

Risk profiles of relevant electronic services

        (7) The provider of a relevant electronic service that conducts a risk assessment of the service must, on completion of the assessment, determine, in accordance with subsection (8), what the risk profile of the service is.

        (8) The risk profile of a relevant electronic service is worked out as follows:
 (a) if the risk that class 1A material or class 1B material will be solicited or accessed by, or distributed to, end-users in Australia using the service, or will be stored on