Here’s a good primer on the legal requirements of running stuff like relays https://www.eff.org/deeplinks/2022/12/user-generated-content-and-fediverse-legal-primer
When it comes to CP: legally you there are steps you can take to absolve the operator of a lot of responsibility.
One of the things is to force anyone posting to the relay to agree to a terms of service. I haven’t seen a relay implement this in any way besides publishing the TOS as part of the relay metadata.
If law enforcement alerts you to content that should be taken down then you need to do that or face consequences in that jurisdiction. But that’s all reactive. That’s why it’s wise to publish real contact info in the metadata of the relay as to who is the admin so you can respond to requests.
Morally it’s a different story. There are no good content moderation tools for relays and none on the way that automate it in a way that would make it a hobbyist level time commitment to contain the issue on a moderately active relay.
It’s a challenge I’ve been thinking deeply about and hope to connect with nostr:npub1yye4qu6qrgcsejghnl36wl5kvecsel0kxr0ass8ewtqc8gjykxkssdhmd0 about at some point because I have some ideas that would make it lower effort on the relay operator side, but still cordon off relays that don’t block known sources of CP or other content that’s illegal or despicable.