Biggest liability I see is DMCA requests. So relays need a takedown request mechanism for DMCA requests.
This could be pretty straightforward with authorized keys who can send DMCA notices or a DMCA webform on the relay homepage.
But at least relays can't accidentally cache/store CP. I'm thinking of implementing an AI nudity filter for my next relay. I don't want to distribute CP.
What concerns me is misinformation laws. It is much harder to systematically screen for ideas and doing so undermines nostr ethos.