The European Commission did not pass a new law. It did not wait for one either. On 31 August 2026 it took a category built for Google Search and Microsoft Bing, applied it to a chatbot, and pulled generative AI into Europe’s strictest tier of platform supervision.
ChatGPT is now a Very Large Online Search Engine under the Digital Services Act — the first AI chatbot ever placed in that bracket. Reddit and Roblox were designated Very Large Online Platforms the same day. All three now sit under direct Commission oversight, with four months to comply and fines of up to 6% of worldwide annual turnover waiting on the other side of failure.
“These new designations mean that ChatGPT, Reddit and Roblox will now be held to a higher standard of scrutiny and accountability in the European Union, in line with their large impact on our citizens and society,” said Henna Virkkunen, the Commission’s Executive Vice-President for Tech Sovereignty, Security and Democracy. “We continue to watch the digital landscape closely and will not hesitate to designate any platform that meets the threshold for enhanced supervision under the Digital Services Act.”
That second sentence is the one to underline. It is an open invitation, addressed to everyone building an AI answer engine in Europe.
The number that pulled the trigger
The DSA sets a single quantitative gate: 45 million average monthly recipients in the EU, roughly 10% of the bloc’s population. Cross it, and the strictest obligations attach automatically.
OpenAI’s own compliance disclosure put ChatGPT search at approximately 159.1 million average monthly active recipients in the EU across the six months ending 31 March 2026 — more than three times the threshold. Reddit reported no more than 57.2 million; Roblox estimated 46.6 million. The figures come from the companies, not the Commission. OpenAI’s was calculated solely for DSA purposes and covers ChatGPT’s search function specifically, not every use of the product.
OpenAI did not fight the label. “ChatGPT search operates as a search service under the DSA, and we are preparing to meet the additional compliance requirements that come with this Very Large Online Search Engine designation,” a company spokesperson said, framing the designation as evidence of how fast Europe has moved to new methods of search — ChatGPT now one of only three search services designated at this scale, alongside Google Search and Bing.
The compliance clock started on notification. The deadline is January 2027.
Capability, not popularity
The reasoning matters more than the ruling. The Commission did not designate ChatGPT because it is a big AI product. It designated ChatGPT because of what the product can do: the Commission described it as a hybrid service that qualifies as an online search engine because it responds to users’ prompts and queries, including by searching the web.
That is a functional test, and it is portable. Nothing in it is specific to OpenAI, to large language models, or to chat interfaces. Any service that takes a query, goes to the open web, and returns information from online sources falls inside the definition. Google’s Gemini, Anthropic’s Claude and Perplexity all perform exactly that function. The only thing standing between them and the same designation is the user count — and Virkkunen has now said in public that the Commission is watching.
Brussels has effectively demonstrated that it does not need AI-specific legislation to regulate AI-specific products. It can reach them through the platform law it already has.
What four obligations actually cost
The headline requirement is a systemic risk assessment, and for a generative system it is genuinely novel work. A conventional search engine mitigates risk by adjusting what it retrieves and ranks. ChatGPT synthesises. Its assessment has to cover hallucinations, fabricated citations, election misinformation, harmful advice, mental-health interactions and effects on minors — risks that emerge from generation itself, not from a ranked list of links. No established methodology exists, because no one has been required to produce one.
Second, an independent external audit at least once a year, with a duty to respond to the auditor’s recommendations. That means an audit-ready evidence trail: documented evaluations, versioned safety decisions, records a third party can inspect.
Third, data access. OpenAI must share data with the Commission and national authorities, and open platform data to vetted researchers studying systemic risk. This is the sleeper obligation. It converts independent scrutiny of ChatGPT’s real-world behaviour from something OpenAI grants into something researchers can legally demand.
Fourth, where applicable, a recommender option not based on profiling and a public ad repository — increasingly relevant now that ChatGPT carries ads.
Two regimes, one product
OpenAI now sits under two EU frameworks at once, and they do not overlap so much as stack. The AI Act governs the model layer: general-purpose AI risk management, training practices, transparency for AI-generated content. The DSA governs the distribution layer: how a service moves information at scale and what that does to users, elections and public security.
A single ChatGPT answer about a national election could implicate AI Act transparency rules and DSA systemic-risk duties simultaneously, assessed by different processes against different standards. OpenAI has four months to build a compliance function that speaks both languages.
What to watch
The January 2027 deadline, and the first systemic risk reports that follow it — the first time any company has had to formally document the societal risks of a generative system to a regulator with fining power.
Whether the Commission opens a formal proceeding. Designation is not a finding of wrongdoing, but enforcement is where the label gets tested. DSA fines have now reached roughly 870 million euros in total, including 550 million against AliExpress in July.
And the disclosures. Gemini, Claude and Perplexity all publish EU user numbers under the DSA’s baseline rules. The moment one of them prints a figure above 45 million, the template Virkkunen just built applies itself.
“We continue to watch the digital landscape closely and will not hesitate to designate any platform that meets the threshold for enhanced supervision under the Digital Services Act.”— Henna Virkkunen, Executive Vice-President, European Commission