The Hosting Certification Exemption

Sources only, no notice

Every source this assessment relies on is a public legal instrument or a public parliamentary record. No finding is adverse to any party: the assessment observes what instruments say and do not say. No notice was served before publication, and nothing in the document is a matter a party could correct from information this practice does not already hold.

The invitation stands in its place, and it does not expire. Any party who considers a passage misread - a provision, a submission, a report, or its own published material - is invited to say so at any time. Any correction received will be recorded, and where it bears on a finding it will be published, together with what the document said before it. The practice's notice protocol is unchanged and continues to apply to assessments carrying adverse findings about identifiable parties from register data.

What the claims rest on

Every claim carries a species, so a reader can see at a glance what kind of evidence it rests on. A quotation is the strongest; a nil return from a closed statutory list is next; a nil return from a document that does not purport to be exhaustive is weaker and is labelled at each use; an inference across provisions is stated as an inference at the point it is made. Three claims carry more than one species - C15, C26 and C30 each state one species for part of the claim and another for the rest - and the census counts each once, under the weaker of the two. And Quotation is the residual class: a claim is counted there when it is not marked as a nil return or an inference, not because the census has read it as a quotation.

Sources, with hashes

Pins are referenced, not moved. The archived blobs of the upstream rows live in the companion scoping case, whose manifest is the register of record. Its own SHA-256 is published here so the whole chain is checkable: 8cf52fa8687c3fb6a49065c912185193b712c427d20d44df5fc919cdffa93bd3 over 22 rows, of which the 12 below are relied on by this assessment. The remaining 10 were set aside as off-spine and carry no assertion in this document. Three further rows below, A-HCF-SP-1 to A-HCF-SP-3, are inherited from two other cases under convention 7; their blobs are held in those cases and each row states its origin, its capture and its re-verification.

How this was checked

How this record is verified

Verification chain: archival. Every source this assessment relies on was captured at retrieval and is pinned by SHA-256 in a register held by the practice. A reader can recompute any published source hash against the artefact and against the live source. Where the two differ, the source has changed since capture and the capture is what the assessment read.

What this assessment cannot establish

No report made under Part 2AA of the Security of Critical Infrastructure Act 2018 has been read, and none can be from public sources. This assessment compares what instruments require. It does not, and cannot, compare what is done. Every observation is as at the capture dates in the register above. A source that has changed since its capture has not made the observation wrong; it has made it historical, and this practice would record that.

Versions, with hashes

A revision does not replace its predecessor. Each superseded version's bytes are unchanged, its hash still resolves, and its file remains downloadable at its own address. Recompute any of them with shasum -a 256.

What changed in v1.2, and why

v1.2 withdraws four sentences that were false when written and rewrites the two recommendations and the claim that rested on them. No finding moves: the finding that the compellability question is confined to nine asset classes and does not reach the class holding government data, the reading of section 30AB(4), the Part 2AA substitution and the declaration route are untouched. Found by this practice on 17 September 2026, reading the pages the case had not read against the document's own falsifier; not by any external party. Versions 1.0 and 1.1 stand at their own hashes. The PDF's Corrections section, page 34, carries the same text.

What changed in v1.1, and why

v1.1 is an addition, not a correction. Nothing in v1.0 is withdrawn, corrected or qualified; no finding moves and no count moves. Two paragraphs of the explanatory memorandum to the Bill that inserted section 30AB enter the document. Both were found while v1.0 was drafted, deliberately excluded from it because a new claim goes through the audit rather than through the prose, and audited before insertion.

Assessment PDF

The attested assessment is the signed PDF. Its SHA-256 is published below.