Earlier quoted context omitted.
If they get 30 (?) hits then they review the data and then they refer it to law enforcement if the reviewers determine that they were CSAM images. It's not for a single collision and it's not immediately referred to law enforcement. There are still major risks and concerns with this model, but at least describe it correctly.
How do they review the data if your iCloud photos are E2E encrypted?
(i.e. They're encrypted in transfer and while stored, but Apple holds the keys: https://qr.ae/pGSHY8, https://manuals.info.apple.com/MANUALS/1000/MA1902/en_US/app... [search for 'iCloud'])