European Commission Designates ChatGPT a Very Large Online Search Engine Under the DSA

On August 31, 2026, the European Commission designated ChatGPT as a VLOSE and Reddit and Roblox as VLOPs under the Digital Services Act. The compliance deadline is January 2027 — the first time a generative AI chat service has entered the DSA's top tier.

EU DSA OpenAI ChatGPT regulation policy

On August 31, 2026, the European Commission announced that it had designated ChatGPT a Very Large Online Search Engine (VLOSE) under the Digital Services Act (DSA)¹. The same announcement designated Reddit and Roblox as Very Large Online Platforms (VLOPs)¹.

The basis for designation is user numbers. All three services declared that they reach at least 45 million average monthly users in the EU, and thus meet the threshold for designation, the Commission says¹. Following notification of the designations, the services have four months, i.e. by January 2027, to comply with the additional obligations for VLOPs and VLOSEs¹. That brings the number of services designated by the Commission under the DSA to 28¹.

”Including by Searching the Web” Decided the Category

The most striking part of this designation is that ChatGPT landed on the search engine side rather than the platform side.

The Commission’s stated reasoning is that ChatGPT is an AI system that “can engage with and respond to users’ prompts and queries, including by searching the web,” and is therefore a hybrid service that qualifies as an online search engine under the DSA¹. The deciding factor was not the product category of a conversational AI assistant, but the part of its functionality that searches the web to answer.

By contrast, Reddit and Roblox both enable users to disseminate third-party content to the public, and so qualify as online platforms¹. Two entirely different characteristics, established in the same announcement on the same day.

It is worth noting that what was designated is the ChatGPT service, not OpenAI as a company. All three services were already subject to the DSA’s general obligations for online platforms and search engines before the designation¹. What is added now is the set of additional obligations imposed only on the largest operators. In other words, this is not a case of services previously outside the DSA being pulled in; it is the obligations of services already covered moving up a tier.

What Has to Be in Place by January 2027

The example the Commission gives is assessing and mitigating the systemic risks stemming from the service and its algorithmic systems¹. The risks specifically enumerated are the dissemination of illegal content, negative effects on minors, users’ physical and mental well-being, fundamental rights, electoral processes, and public security¹.

The wording looks abstract, but applied to an AI chat service the questions get quite concrete: the paths by which a web search reaches illegal material, use by minors, the effect generated answers have on the information environment around an election. In each case, the operator will be asked to explain these not as a question of model accuracy but as a question of service design and algorithms.

With the designations, the Commission gains investigative powers to assess the functionalities behind these services and, where applicable, any related system¹. Beyond receiving reports from the operator, this appears to create room for the Commission to go and examine how the functionality works. Engadget reports that VLOP/VLOSE designation comes with data sharing with the Commission and authorities, annual reviews by independent auditors, and researcher access to platform data in certain cases³.

According to the same article, Reddit commented that it is “committed to complying with the EU Digital Services Act” and has “been preparing to meet the VLOP requirements”³. As of the article’s update, no comment from OpenAI or Roblox was included³.

Supervision Is Split Between Brussels and National Authorities

Supervision and enforcement of the DSA is shared between the Commission and the Digital Services Coordinators in each member state¹.

Here, the Commission is competent to supervise DSA compliance, working with Ireland’s Coimisiún na Meán for ChatGPT and Reddit, and the Netherlands’ Authority for Consumers and Markets (ACM) for Roblox¹. Each is the coordinator for the country where the designated service is established¹. Because the country of establishment becomes the first point of contact, where a company incorporates in the EU carries directly into its supervisory relationship.

Executive Vice-President Henna Virkkunen (Tech Sovereignty, Security and Democracy) said in the announcement that the designations mean the three services “will now be held to a higher standard of scrutiny and accountability in the European Union, in line with their large impact on our citizens and society,” adding that the Commission will not hesitate to designate any platform that meets the threshold¹.

The AI Act and the DSA Bite in Different Places

EU regulation of AI tends to bring to mind the AI Act’s transparency obligations, but this DSA designation belongs to a separate framework. What Article 50 of the AI Act asks for is transparency about the AI system itself — disclosing that users are dealing with a chatbot, machine-readable marking of AI-generated content. Anthropic, for instance, signed the code of practice under that article and set out a plan to embed an imperceptible watermark in text Claude generates.

The DSA, by contrast, looks at how the service behaves as a channel through which information flows. That is why the object of risk assessment is written as “the service and algorithmic systems” rather than model output alone. For anyone offering an AI service in the EU, these two are not in a relationship where satisfying one satisfies the other.

That EU digital regulation does not stop at paper requirements is illustrated by the Dutch data protection authority’s roughly €825 million fine against Uber. What was at issue there was not algorithmic accuracy but the decision-making itself, made without a human in the loop. The DSA’s systemic risk assessment can be expected to demand a similar account of design and operations.

For companies shipping AI services into the EU, January 2027 marks the point by which compliance design needs revisiting. At minimum, a precedent now exists: a service may call itself an AI assistant, but if web search is among its functions, regulators may treat it as a search engine.