Australia’s eSafety Commissioner pulled no punches: the tools to stop sexual extortion online already exist, and the world’s largest tech companies aren’t using them. In a transparency report published Tuesday, the regulator pointed to «significant gaps» in how Apple, Meta, and Google detect and prevent child sexual exploitation. The news itself isn’t shocking – NGOs have been saying for years that moderation systems are reactive, not proactive. But the report marks a turning point because it shifts the burden of proof: this is no longer about developing the technology, it’s about deploying and activating it.

The central question is not whether Big Tech has the means – they do – but where detection actually runs. Every deployment choice brings a trade-off between effectiveness, privacy, and control. Apple, for instance, retreated from on‑device CSAM scanning after a backlash from those who saw it as a dangerous precedent for end‑to‑end encryption. Meta and Google analyze content primarily on their own servers, but that means hoarding unencrypted data in the cloud, with rising infrastructure costs and growing regulatory exposure.

The battle is (not just) legal, it’s architectural

Here lies a thread that touches anyone evaluating on‑prem or self‑hosted deployments for sensitive workloads. The Australian report doesn’t mandate a specific technology, but it raises the bar for accountability. If an organization processes minors’ data or at‑risk content – think school platforms, corporate messaging, hosted Exchange for law firms – the pressure to implement local detection models, under its own control, becomes a compliance argument, not merely a principled one.

The server‑side alternative obliges you to manage data flows that cross borders and jurisdictions, increasing the attack surface and GDPR constraints. On‑device or on‑premise processing shrinks the perimeter: suspicious content never leaves the device or the corporate cluster, metadata stays internal, and end‑to‑end encryption remains intact. That’s why local inference frameworks and quantized models – from specialized LLMs to more conventional classifiers – are gaining traction beyond the enthusiast niche: they offer a way to demonstrate due diligence without handing data to third parties.

Who wins and who loses

The ironic winners will be the providers of scanning‑without‑cloud solutions: chips with secure enclaves (Secure Enclave, Trusted Execution Environment), on‑device machine learning software, and orchestration platforms for self‑hosted models. The losers are architectures that banked on indiscriminate centralization as their operational advantage, because multiplying jurisdictions – much like the privacy‑first wave after GDPR – will fragment regulatory data centers and make a single global pipeline unsustainable.

The Australian move isn’t isolated: the UK’s Online Safety Bill and the EU’s Digital Services Act are building regulatory cages that, in practice, reward those able to process locally. It’s not an explicit obligation, but a second‑order consequence of requirements like «best efforts» detection and independent audits.

The companies under scrutiny will react cautiously, knowing that every technical decision today becomes a legal precedent tomorrow. But the era of «we don’t have the technology yet» is over. The question now is: are you actually willing to switch it on, and where?