The short, definitely not legal advice version is that it only becomes a crime if you have actual knowledge that there is CP on your server, and you fail to block access to it and make the legally mandated report.

The law was written with ISPs hosting email and websites for paying customers in mind, but it applies equally well to anonymous user-generated content, federation, and other scenarios we may not have even imagined yet. Being an inattentive server admin is a valid legal defense, though actually having to use it in court would be stressful and expensive.