If you don't want to moderate, don't let others sign up to your instance. That deals with pretty much all your legal issues.

For US-based people, register for DMCA notifications. This means if someone posts copyright infringing content, you get a message about it instead of your hosting provider, and you get to remove that content instead of your hosting provider removing your account.

Check about GDPR compliance. Part of that is fully deleting user content in a timely fashion when they ask. I've heard that Lemmy might not be good about that, but I'm not sure. If you have any EU users, you'll need to comply.

If you want to run a large instance, you'll need to have a plan regarding CSAM.

If you do moderate, use The Bad Space or shared block lists to defederate from the the most problematic instances. I'm not sure whether they've really made it to this general corner of the fediverse, though.