Document ID: chunk:federal_register_of_legislation:F2024L00710:reg:36:p1
Version: federal_register_of_legislation:F2024L00710
Segment Type: reg
Provision Reference: reg 36 (pt 1/2)
Character Range: 89314–92210

36  Commissioner may require compliance reports
 (1) This section applies to the following:
 (a) a Tier 1 designated internet service;
 (b) a Tier 2 designated internet service;
 (c) an end-user managed hosting service;
 (d) a high impact generative AI DIS;
 (e) a model distribution platform.

Minimum requirements—generally
 (2) The Commissioner may, by written notice given to the provider of a service, require the provider to give the Commissioner a report (a compliance report) for the most recent calendar year before the date of the notice (the reporting period) that:
 (a) specifies the steps that the provider has taken, including measures and controls the provider has implemented, to comply with applicable compliance measures in this Part;
 (b) includes confirmation from the provider that the steps, measures and controls are appropriate, including reasonable supporting details and evidence;
 (c) specifies the number of complaints made to the provider about the provider's compliance with this industry standard during the period specified in the notice; and
 (d) where applicable for the relevant designated internet service, such other details as specified in subsections (7) and (8).
 (3) However, the Commissioner may not request a report under this section in respect of a designated internet service:
 (a) at any time prior to the first anniversary of the commencement of this industry standard; and
 (b) without limiting paragraph (a), more than once in any 12 month period.
 (4) The notice under subsection (2) may require the report to be in a specified form.
 (5) The provider must comply with a notice under this section within 2 months after the notice under subsection (2) is given.
Note: See also section 37.
 (6) A compliance report may relate to 2 or more services.

Further minimum requirements —model distribution platform
 (7) Without limiting subsection (2), the provider of a model distribution platform must ensure that any report required by this section for a reporting period:
 (a) specifies:
 (i) the volume of child sexual exploitation material and pro-terror material identified by the provider in relation to the service in the reporting period, where it is technically feasible for the provider to identify such material; and
 (ii) the number of models identified by the provider to be in breach of the provider's terms of use relating to child sexual exploitation material or pro-terror material;
 (b) specifies the way in which the details and materials under paragraph (a) (if any) were identified; and
 (c) includes details of the action taken by the provider in the reporting period in respect of the details and materials identified in paragraph (a).
Example: For paragraph (b): identification through reports made to the provider, hashing or through other measures and controls implemented by the provider.

Further minimum requirements—Tier 1