Beyond Hash Matching: AI-Based Detection of Previously Unidentified CSAM and its Legal Implications in the EU

원문 초록

The detection of previously unidentified Child Sexual Abuse Material (CSAM) remains a significant challenge for law enforcement authorities, online service providers, and child protection organizations, as traditional hash-matching technologies are primarily designed to identify previously verified material. This paper reviews and classifies existing AI-based technologies that could complement hash-based approaches and support the detection, analysis, and prioritization of potentially harmful content. The reviewed approaches are organized into three categories: real-time image and video analysis, image and video classification and tagging, and AI-based behavioral monitoring. A comparative analysis examines the capabilities, limitations, and potential integration of general-purpose computer vision platforms, content moderation services, and specialized CSAM detection tools within existing detection workflows. An experimental evaluation was conducted using Google Cloud Vision AI and Sightengine to investigate sexual-content classification and child-adult age estimation. The results highlight differences in classification taxonomies and outputs across providers, as well as significant limitations in age classification, particularly for adolescents. These findings highlight the importance of using AI-based assessments as complementary tools for analysis and prioritization, rather than as definitive determination of CSAM. Finally, the paper examines the relevant European Union regulatory framework, with particular attention to the EU AI Act, the General Data Protection Regulation (GDPR), fundamental rights, transparency, accountability, and human oversight. The legal analysis highlights how regulatory obligations and safeguards may differ depending on the deployment context, potentially creating inconsistencies across interconnected detection and reporting workflows.