EU Designates ChatGPT Under the Digital Services Act

The European Union has pulled a generative-AI product into the heart of its online-platform rulebook for the first time. On August 31, 2026, the European Commission formally designated ChatGPT as a Very Large Online Search Engine (VLOSE) under the Digital Services Act (DSA), and named Reddit and Roblox as Very Large Online Platforms (VLOPs). The designations trigger the DSA’s most stringent tier of obligations and mark a notable expansion of the regime beyond the social networks, marketplaces and search engines it was written for.

What was designated, and why

The DSA reserves its heaviest duties for services that reach at least 45 million average monthly active recipients in the EU — roughly a tenth of the bloc’s population. All three newly designated services cleared that bar by their own declarations. According to the figures cited in the designation, ChatGPT reported 159.1 million average monthly active users in the EU, Reddit 57.2 million, and Roblox 46.6 million — a combined declared reach of about 262.9 million monthly users.

The categorization of ChatGPT as a search engine rather than a platform is the technically significant choice. The Commission treated ChatGPT’s ability to surface and synthesize information in response to user queries as functionally analogous to search, placing it in the VLOSE bucket alongside general-purpose search engines. Reddit and Roblox, as user-content and user-interaction services, fall under the VLOP label. The distinction matters because VLOSE and VLOP obligations, while overlapping heavily, are tailored to the different risks each kind of service poses.

What the obligations actually require

Designation is not a fine or a finding of wrongdoing; it is the start of a compliance regime. Under the DSA’s enhanced tier, designated services must, among other duties:

• Assess and mitigate “systemic risks” their service poses — including risks to fundamental rights, civic discourse, public security, and the protection of minors and mental health.
• Submit to independent annual audits of their risk-management practices.
• Provide transparency into recommender systems and, where applicable, offer users options not based on profiling.
• Give researchers and regulators data access to study systemic risks.
• Maintain mechanisms for users to flag illegal content and to contest moderation decisions.

The enhanced duties take effect four months after notification of the designation — meaning the newly named services must be in compliance by roughly the end of December 2026. Failure to comply can ultimately expose a company to fines of up to 6% of worldwide annual turnover, the DSA’s headline penalty ceiling, along with the possibility of enhanced supervision or, in extreme cases, service restrictions in the EU.

Why designating an AI assistant is novel

The DSA was drafted with feeds, marketplaces and search results in mind. Applying it to a conversational AI system forces several unsettled questions into the open. A generative model does not “rank” pre-existing content the way a search engine returns links; it synthesizes responses, which complicates concepts like recommender-system transparency and content provenance that the DSA assumes. Obligations around illegal content and user redress were built for hosted material posted by third parties, not for text a model generates on the fly.

The Commission’s decision to slot ChatGPT under the search-engine category is its attempt to fit the new technology into the existing framework, but it will be tested. Expect disputes over how “systemic risk assessment” applies to a model’s outputs, how independent audits evaluate a system whose behavior is probabilistic, and how much training and interaction data OpenAI must expose to vetted researchers.

Part of a widening European posture

The designation does not stand alone. Europe has spent 2026 building out a dense regulatory apparatus around AI and large platforms in parallel. The AI Act has moved into its enforcement phase for general-purpose AI models, with the Commission pressing on GPAI obligations covering transparency, copyright and systemic-risk documentation. On the competition side, Brussels has been aggressive with the Digital Markets Act, including a €890 million DMA fine against Google. The DSA designation adds a third front — content and systemic-risk governance — to a stack that already touches how frontier models are built, how gatekeepers behave, and now how AI assistants must manage societal risk.

For OpenAI specifically, the move arrives as the company is broadening ChatGPT’s footprint well beyond a chat box — from testing advertising inside the product to rolling out teen-specific experiences. Each of those expansions maps directly onto DSA concerns: advertising transparency, recommender design, and the protection of minors are exactly the areas the enhanced regime scrutinizes most closely.

What it means

The designation is best read as the moment AI assistants stopped being treated as experimental software and started being treated as public infrastructure. Three implications stand out.

First, compliance is now a scale tax that favors incumbents. Systemic-risk assessments, independent audits, researcher data access and recommender transparency are expensive, lawyer-heavy obligations. OpenAI can staff them; a smaller European or open-source AI provider approaching the 45-million threshold faces a steeper relative cost. Rules meant to constrain the largest players can, in practice, entrench them by raising the price of getting big.

Second, the “is it search?” question will echo across the industry. By classifying ChatGPT as a search engine, the Commission has planted a definition that other regulators, litigants and competitors will cite. If an AI assistant is a search engine for the DSA, arguments will follow about what it is for copyright, liability, advertising and antitrust. The categorization is a foothold, and everyone touching AI-mediated information retrieval — Google’s AI overviews, Perplexity, and others — will watch how it is enforced.

Third, the clock, not the label, is the real story. The obligations bite by the end of December 2026, and the 6%-of-turnover penalty gives them teeth. The near-term question is operational: whether OpenAI can stand up EU-specific risk-mitigation, audit, and data-access machinery for a probabilistic system in roughly four months, and what its first DSA risk assessment concedes about harms like misinformation and minor safety.

What to watch next: how OpenAI’s first systemic-risk assessment characterizes its own model’s failure modes; whether the search-engine classification survives the inevitable legal challenge; and whether Brussels uses this designation as a template to pull the next tier of AI assistants — and their smaller challengers — into the same regime as their user numbers climb.