I suppose a lot of it comes down to how nsfw is handled. If there are no means to access it on the home instance, then what you’re doing is probably A-OK.

It was the decision of the original Admin but it has made life easier (as in the CSAM spam attacks - we don’t need to figure out if it’s real or not, if it’s porn, it’s gone) and will make complying with the OSA simpler. I suspect there’s a way to navigate those waters but I am focused on our own needs to get this boxed off and then I’ll have a ponder on that topic. We’ve been discussing this with DGR for a while now and that is the main hurdle we’ve struggled with.

The only problem I can see would be other federated instances that may feed poorly filtered or flat out unfiltered/untagged nsfw into yours.

It’s like porn spam - it gets flagged up quickly and dealt with. One bonus of federation is that if it is removed from the home instance it is gone for us too, so it often gets sorted before we even realise there’s a problem.

I imagine that’s going to be a decent chunk of the risk assessment, given that federation with others is the main point of lemmy as a whole.

The OSA document we’ll post is 50% risk assessment, 50% mitigation - the law accepts that, in spite of your best efforts, shit happens, the more important thing is what processes and systems are in place to deal with it quickly and efficiently when it does.