On August 31 the European Commission designated ChatGPT as a Very Large Online Search Engine under the Digital Services Act (DSA). It is the first time a generative AI chat service anywhere has been placed in this category. Reddit and Roblox were designated as Very Large Online Platforms on the same day, and all three services must meet the heaviest set of obligations by January 2027.
Why a Chatbot Was Treated as a Search Engine
The DSA has two elevated categories: Very Large Online Platforms (VLOPs) and Very Large Online Search Engines (VLOSEs). The first was written with social feeds in mind, where users create and share posts. The second was written for services like Google Search and Microsoft Bing, which retrieve and return information in response to a query. Generative AI chatbots did not exist when the law was drafted, and ChatGPT fits neither category cleanly.
The Commission treated ChatGPT as a hybrid service, then weighted the fact that it responds to user queries by actively searching the web, and placed it on the search engine side. That makes ChatGPT the third service ever designated a VLOSE, after Google Search and Microsoft Bing.
Search results are a ranked list of links, and a user can see for themselves which site landed where. A chatbot returns a single answer with multiple sources dissolved into it. Once the act of judgment shifts from the reader to the model, how that answer is produced ought to be verifiable from the outside. That reasoning sits behind the classification.
The User Numbers That Triggered It
The elevated tiers of the DSA turn on a single figure: whether a service reaches 45 million average monthly users in the EU, roughly one in 10 people in the bloc.
For the six-month period ending March 31, 2026, OpenAI declared approximately 159.1 million average monthly EU users, about 32 percent above the roughly 120.4 million it had previously reported. Reddit declared 57.2 million and Roblox approximately 46.6 million, both comfortably over the line. With these three additions, 28 services now sit in the DSA's strictest tier.
Roblox is the first gaming platform to enter that tier. Because its audience skews toward children and teenagers, the provisions aimed at minors, such as risk assessments covering mental and physical well-being and the ban on profiling-based advertising directed at children, land squarely on its core user base.
What Must Happen by January 2027
Four months after notification, meaning by January 2027, each designated service must produce a written assessment of the systemic risks its own product creates. The exercise covers how its service and algorithmic systems can contribute to the dissemination of illegal content, negative effects on minors, users' physical and mental well-being, fundamental rights, electoral processes and public security.
Assessment alone is not enough. Identified risks must be addressed, extending where necessary to changes in product design or recommender algorithms. From there the obligations continue: annual audits by independent third parties, an internal compliance function, a searchable public repository of every advertisement carried, and data access for regulators and vetted researchers.
The European Commission supervises compliance, working with Ireland's digital services coordinator, Coimisiún na Meán, for ChatGPT and Reddit, and with the Netherlands' Authority for Consumers and Markets (ACM) for Roblox.
OpenAI has signalled it will work inside the framework. A company spokesperson said ChatGPT operates as a search service under the DSA and that the company is preparing to meet the additional compliance requirements that come with the designation.
The Penalties and the Enforcement Record So Far
Failure to meet the obligations exposes a company to fines of up to 6 percent of global annual turnover. The faster a company's revenue grows, the heavier a percentage-based penalty becomes.
The Commission has already used that power. Fines under the DSA now total approximately 870 million euros (about 160 billion yen). The largest to date is the 550 million euros (about 100 billion yen) imposed on AliExpress in July over inadequate handling of counterfeit product risks. Temu was fined 200 million euros (about 37 billion yen) in May for comparable failings, and X was fined 120 million euros (about 22 billion yen) in December 2025 over misleading verification practices and transparency shortcomings.
※1 EUR = 185 JPY (as of September 1, 2026)
Contesting a designation has proven difficult in practice. Amazon and Zalando both asked the EU General Court to annul their VLOP designations and both were turned down. Amazon argued the regime infringed its freedom to conduct a business; the court accepted that the obligations carry real costs but held them justified in light of the regulatory aims. Zalando has said it will appeal to the Court of Justice.
Henna Virkkunen, executive vice-president of the Commission for tech sovereignty, security and democracy, said the three services will now be held to a higher standard of scrutiny and accountability commensurate with their impact on society, and that the Commission will not hesitate to designate any platform that meets the threshold.
Summary
What this designation confirms is that the EU is not waiting for AI-specific legislation before bringing consumer-facing AI services under supervision. The DSA was written before ChatGPT existed, and the Commission has reached an AI service using the text as it stands. Whether the risk assessments due in January 2027 carry real substance or amount to a paper exercise, and how far the audit mechanism works when applied to AI, will get its first answer then.
