Document ID: chunk:federal_register_of_legislation:F2024L00710:reg:21:p1
Version: federal_register_of_legislation:F2024L00710
Segment Type: reg
Provision Reference: reg 21 (pt 1/2)
Character Range: 62540–65486

21  Detecting and removing known pro-terror material
 (1) This section applies to the following:
 (a) a Tier 1 designated internet service;
 (b) an end-user managed hosting service;
 (c) a high impact generative AI DIS.
 (2) However, this section does not apply to a Tier 1 designated internet service predominantly used for making pornography available.

Minimum requirements—generally
 (3) The provider of a service must have and maintain appropriate systems, appropriate processes and appropriate technologies that detect and identify known pro-terror material that:
 (a) is being distributed by or to an end-user in Australia using the service;
 (b) is stored on the service; or
 (c) is being accessed by an end-user in Australia using the service.
Note 1: The technologies that the provider may use include hashing technologies and machine learning.
Note 2: For a high impact generative AI DIS, compliance with this subsection may require the provider to assess whether inputs into the service contain pro-terror material.
Note 3: See subsections (8) to (11) for the requirement to implement such systems, processes and technologies.
 (4) The provider of a service must remove known pro-terror material from the service as soon as practicable after the provider detects or identifies the material through a system or technology described in subsection (3).
 (5) Subsection (3) does not require a provider to have or implement a system or technology if:
 (a) it is not technically feasible or reasonably practicable for the provider to do so; or
 (b) to do so would require the provider to:
 (i) implement or build a systemic weakness, or a systemic vulnerability, into the service; or
 (ii) in relation to an end-to-end encrypted service—implement or build a new decryption capability into the service, or render methods of encryption used in the service less effective.
 (6) If, because of subsection (5), a provider does not have or implement any systems as described in subsection (3), the provider must take appropriate alternative action.
 (7) If, because of subsection (5), a provider does not have or implement any technologies as described in subsection (3) the provider must take appropriate alternative action.
Note: For appropriate see section 11.

Implementation of systems and technologies—Tier 1 designated internet services and high impact generative AI DIS
 (8) The provider of a Tier 1 designated internet service or high impact generative AI DIS must implement the systems, processes and technologies described in subsection (3) at all times.

Implementation of systems and technologies—end-user managed hosting service
 (9) The provider of an end-user managed hosting service must implement the systems, processes and technologies described in paragraph (3)(a) at all times.
 (10) The provider of an end-user managed hosting service must implement the systems, processes and technologies described in paragraphs (3)(b) and