Child Sexual Abuse Material (CSAM): Service providers are required to report any CSAM on their servers to the CyberTipline operated by the National Center for Missing and Exploited Children (NCMEC), a private, nonprofit organization established by the U.S. Congress, and can be criminally prosecuted for knowingly facilitating its distribution. NCMEC shares those reports with law enforcement. However, you are not required to affirmatively monitor your instance for CSAM.
By my understanding, you don’t have to setup proactive monitoring for CSAM being federated in, but if you specifically spot CSAM or it is reported to you then you are legally obligated to report it