EU Designates ChatGPT, Reddit, and Roblox Under the DSA

The EU just put an AI chatbot in the same regulatory tier as Google Search and Facebook. On August 31, 2026, the European Commission designated OpenAI's ChatGPT as a Very Large Online Search Engine (VLOSE) and Reddit and Roblox as Very Large Online Platforms (VLOPs) under the Digital Services Act (DSA). All three now have roughly four months — into January 2027 — to meet the DSA's heaviest set of obligations.

"We have designated ChatGPT as a Very Large Online Search Engine and Reddit and Roblox as Very Large Online Platforms under the Digital Services Act," the Commission said. "They now have four months to comply with additional DSA obligations." Commission Executive Vice-President Henna Virkkunen added that the services "indicated that they reach at least 45M average monthly users in the EU and thus meet the threshold for designation."

This is the first time an AI chatbot has been designated under the DSA, and the search-engine classification — rather than "platform" — is the detail worth understanding.

TL;DR — what people are asking

Why ChatGPT is a "search engine" here

The DSA splits very large services into two designations. Very Large Online Platforms host and distribute user content — the category already covering Facebook, Instagram, TikTok, YouTube, X, and now Reddit and Roblox. Very Large Online Search Engines let users query and retrieve information from across the web — previously just Google Search and Bing.

ChatGPT landed in the VLOSE bucket because of its built-in web search feature: when ChatGPT retrieves and summarizes live web results in response to a query, it is functionally acting as a search intermediary. That classification matters because VLOSE obligations focus on things like search-result manipulation, ranking transparency, and the systemic risks of how information is retrieved and presented — a closer fit to what a retrieval-augmented chatbot actually does than the content-hosting rules written for social platforms.

It also sets a precedent. Perplexity, Google's AI Mode, and any other assistant with a search feature and 45M+ EU users are now looking at the same category. Germany's ZAK regulator already ruled Google AI Overviews and Perplexity subject to national media law in July; the DSA designation is the EU-level version of the same "AI answers are a regulated information service" logic.

The 45-million-user threshold

Designation under the DSA is mechanical: report at least 45 million average monthly users in the EU — roughly 10% of the bloc's population — and the additional obligations attach. The three services' self-reported figures:

Roblox is only just over the line, which is why it took until now. ChatGPT is more than 3x the threshold — a reminder of how quickly it became mainstream infrastructure in Europe, not a niche tool.

What the four-month clock actually requires

Once designated, a VLOP or VLOSE must stand up a specific compliance stack. The headline items:

• Systemic risk assessments — at least annually, covering illegal content, effects on fundamental rights, civic discourse and elections, and (for services minors use) physical and mental well-being. Assessments must be documented and shared with the Commission.
• Risk mitigation — concrete measures tied to each identified risk, subject to Commission review.
• Protection of minors — no ads based on profiling of minors, age-appropriate design, and safety-by-default settings. This is the sharpest edge for Roblox, whose user base skews young.
• Transparency — public transparency reports, a searchable ad repository showing who paid for each ad and how it was targeted, and statements of reasons for every content-moderation action, filed to the EU's public DSA Transparency Database.
• Recommender-system transparency — plain-language explanation of the main ranking parameters and at least one feed option not based on profiling.
• Researcher data access — vetted academic researchers can request access to platform data to study systemic risks. This is one of the few parts of the DSA that arguably helps the AI research community.
• Independent audits — an external annual audit of DSA compliance, paid for by the company.

The Commission — not national regulators — supervises designated services directly, and funds that supervision through a supervisory fee levied on the companies.

Penalties, and the enforcement track record

The DSA allows fines of up to 6% of total worldwide annual turnover, periodic penalty payments for ongoing non-compliance, and, as a last resort for repeated serious breaches, a court-ordered temporary restriction of access to the service in the EU. The Commission has open DSA proceedings against X, Meta, TikTok, and AliExpress, so the enforcement apparatus is already running — this is not a paper regime.

For OpenAI specifically, the timing compounds: the DSA's ad-transparency and recommender obligations land the same week the company expanded ChatGPT Ads self-serve buying into Europe and reported a $1 billion annualized ad run rate. Building an EU ad business and building an EU ad repository are now the same project.

DSA vs. the EU AI Act — not the same thing

A common confusion: this designation is under the Digital Services Act, which governs online intermediaries, content moderation, and platform accountability. It is separate from the EU AI Act, which regulates AI systems by risk tier and imposes transparency and documentation duties on model providers. OpenAI is now subject to both in the EU — the AI Act as a general-purpose AI model provider, the DSA as the operator of a very large search service.

explainx.ai's complete guide to AI regulation in 2026 walks through how the frameworks stack, and what changes after EU AI Act enforcement covers the AI Act side in depth. The short version: EU digital law now reaches AI products from two directions at once.

What this means for what you build

If you operate an AI product with a search or retrieval feature and EU ambitions, treat the 45M-user line as a design constraint you plan for early, not a surprise. Practical implications:

• Instrument EU user counts now. Designation is triggered by your own reported numbers; you want an accurate figure and a compliance plan ready before you cross the line, not a scramble afterward.
• Recommender and ranking transparency is a product requirement. A non-profiling feed or answer mode, and a plain-language explanation of ranking signals, become mandatory at scale.
• Moderation actions need machine-readable reasons. Every takedown or restriction on the EU surface needs a structured statement of reasons — build that into the moderation pipeline, not on top of it.
• Researcher data access cuts both ways. It is an obligation, but vetted-researcher access to platform data on systemic risks is also a channel for independent study of how these systems behave — useful if you build evaluation or safety tooling.

For API customers and downstream builders, the obligations sit with the operator, not you — but expect the consumer ChatGPT surface in the EU to get more labeled ads, more visible feed controls, published transparency data, and potentially more conservative moderation as OpenAI tunes for the January deadline.

Related reading

• FSB names frontier AI cyber risk the top G20 financial-stability threat (Aug 31, 2026)
• ChatGPT Ads hits a $1B run rate — and expands into Europe
• AI regulation in 2026: EU AI Act, US policy, and what builders must know
• What changes after EU AI Act enforcement
• Germany's ZAK rules Google AI Overviews and Perplexity subject to media law
• ChatGPT for teens: the safety study and study mode
• France and the UK move on under-15/16 social media age verification
• G7 Evian 2026 AI summit: outcomes on trusted partners and child safety
• AI is eating the web: collective memory and search decay
• Official: European Commission — Digital Services Act · DSA Transparency Database

Details reflect the European Commission's August 31, 2026 designation announcement and statements from Commission officials. User figures are self-reported by the designated services; compliance deadlines, obligations, and enforcement actions may evolve — verify current status via the Commission's DSA pages.