I used to work as in-house counsel at a machine learning company and we had exactly the system you describe set up: a standard set of procedures for immediate r

I used to work as in-house counsel at a machine learning company and we had exactly the system you describe set up: a standard set of procedures for immediate reporting of child pornography found in image batches sent to us by customers, NCMEC notification, quarantining and isolated storage of the data, and offering counseling for affected employees. It didn't happen often, thankfully, but was pretty eye-opening about what's out there.