The European Commission today designated ChatGPT a Very Large Online Search Engine, and Reddit and Roblox Very Large Online Platforms under the Digital Services Act (DSA). All three have until the end of December 2026 to comply. ChatGPT is the first generative AI chatbot anywhere to land in this category.
First, what the Digital Services Act (DSA) is
The Digital Services Act is the EU law that sets out how online services must handle illegal and harmful content. It came into force in November 2022 and has applied to every online service in the bloc since February 2024.
It works in two tiers. The lower tier applies to everyone: publish terms people can understand, give users a way to report illegal content, explain yourself when you take a post down, offer an appeal. The upper tier applies only to the biggest services and is much heavier. That is the tier these three just entered.
How a service ends up in the top tier
Entry is by numbers. Every platform and search engine operating in the EU has to publish its average monthly user count there and update it every six months. Once you cross 45 million users, the Commission can designate you.
OpenAI declared about 159 million monthly users for ChatGPT’s search function over the six months to March 2026. Reddit declared 57.2 million. Roblox declared roughly 48 million. That brings the number of companies now part of EU’s strict regulations to 28 services including Facebook, Instagram, TikTok, YouTube, X, Amazon, Google Search, Bing and Wikipedia.
Make tech-ish your favourite source
Star us on Google — you'll see more tech-ish in Top Stories and AI results.
A Very Large Online Platform hosts what users post for others to see, which is Reddit and Roblox. A Very Large Online Search Engine takes your question and goes looking for the answer, which is what the Commission decided ChatGPT does.
What the three actually have to do now
Before the end of December, each company has to produce a written assessment of the systemic risks its own product creates. Not a marketing document. An honest account of how their service or tool can spread illegal content, harm children, damage users’ mental or physical health, trample fundamental rights, distort an election or threaten public security.
Then it has to act on what it found. The law says that can go as far as changing how the product is designed or how its recommendations work, and each company has to run an internal compliance team to make sure it happens.
Once a year an independent auditor will check the whole exercise, and the company has to act on what the auditor says. Each also has to keep a public, searchable library of every advert it carries, showing who paid and who it was aimed at, open its data to vetted academic researchers so outsiders can measure the harms rather than take the company’s word, and offer at least one feed that is not sorted by a profile of you.
Why ChatGPT was difficult
It was never in doubt that Reddit and Roblox would be designated. They both host what users post.
ChatGPT however, was an argument, because the DSA was written before ChatGPT existed. The law knows about platforms and about search engines. But a chatbot is neither. The Commission could have waited for the AI Act to do the job. Instead it called ChatGPT a hybrid service and designated it as a search engine, because it responds to prompts and queries, including by searching the web.
That is right. While search handed you ten links and left the judgement with you, a chatbot gives you one answer in a confident voice, with the sources folded in or missing altogether. With search, you could see who ranked where, click through and disagree. So, the judgement moves from the reader to the model. If ranking was a risk worth auditing, a single answer needs to be thoroughly audited.
But this DSA designation doesn’t mean OpenAI and ChatGPT are regulated on what they may say. No, it means the EU is telling OpenAI to study what its product does to people at scale, write it down, fix problems it finds and show the working. That is a reasonable thing to ask of a service 159 million people talk to.
The Roblox problem
Roblox is a tough case, because most of the people at risk are children. As of July 2026, 170 lawsuits sat consolidated in a US federal case over child sexual exploitation on the platform, and Roblox settled with Alabama for 12.2 million dollars. The company now runs facial age estimation and sorts users into age bands before letting them chat. The EU designation means someone outside the company finally gets to test whether that works.
Reddit is here for a different reason. It is moderated by unpaid volunteers, and it has become the human-written layer many AI answers rest on, licensed to OpenAI and Google for exactly that purpose.
Fines
Non compliance with the EU designation means a maximum fine of 6% of global annual turnover. The Commission has already shown it will implement and demand that fine, as we covered in our piece on X (formerly Twitter)’s visibility filtering code where it fined X 120 million euros on 5 December 2025.
What it means outside Europe
These audits cover the EU. The concerns are the same everywhere, though, and safety engineering is expensive to build once and wasteful to build twice, so much of this will ship worldwide. Roblox rolled its age checks out globally rather than by region.
Join the discussion