ChatGPT is now regulated in Europe as a search engine. The European Commission announced on Monday that it has designated OpenAI's chatbot as a Very Large Online Search Engine under the Digital Services Act, alongside Reddit and Roblox as Very Large Online Platforms. It is the first time a general-purpose AI assistant has been pulled into the DSA's top tier, and the legal category chosen to do it is the most revealing part of the decision.
According to the Commission's announcement of 31 August, all three services declared that they reach at least 45 million average monthly users in the Union, the threshold that triggers designation. The numbers behind that declaration are not marginal. OpenAI reported approximately 159.1 million average monthly EU users of ChatGPT's search function for the six-month period ending 31 March 2026. Reddit reported 57.2 million. Roblox came in at roughly 48 million.
Henna Virkkunen, the Commission's Executive Vice-President for Technological Sovereignty, Security and Democracy, said the designations mean the three services "will now be held to a higher standard of scrutiny and accountability in the European Union, in line with their large impact on our citizens and society."
The DSA was drafted for intermediaries: services that transmit, host or rank other people's content. It has two heavyweight categories, platforms and search engines, and a system that generates its own prose answers does not sit comfortably in either. The Commission's route around that was to attach the designation to what ChatGPT does when it goes out and retrieves material from the open web, and to count the users of that function.
That is a defensible reading of a law written before the product existed. It is also a narrow one. The obligations now bite on the part of ChatGPT that behaves like a search engine — surfacing and ranking third-party sources — rather than on the model's generative output as such. Anyone expecting Monday's decision to make the DSA a general-purpose AI statute should read it again. Brussels has not stretched the rulebook to cover generation. It has found the one seam in the product where the existing rulebook already fits.
Designation is not a fine or a finding of wrongdoing. It moves a service into a supervisory regime run directly by the Commission rather than by a national coordinator, and it starts a clock.
Within four months, the three services must produce annual systemic risk assessments covering the dissemination of illegal content, negative effects on minors, users' physical and mental wellbeing, fundamental rights, electoral processes and public security — and then show what they are doing to mitigate what they find. They come under independent auditing. They have to give regulators and vetted researchers access to data. They pick up transparency reporting obligations and exposure to the DSA's crisis response mechanism. And they become liable, in the last instance, to penalties of up to six per cent of global annual turnover.
For Reddit and Roblox, this is a well-trodden path with about forty other designated services already on it. For OpenAI, it means that the risk assessment it files early next year will be the first document in which an AI company formally tells a European regulator what its assistant does to elections and to children.
Two of the three designations point at the same problem from different directions. Roblox is a game platform whose user base skews heavily towards children. Reddit is an open forum with a long-running argument about age assurance. ChatGPT sits in a third category again: a service adults built for adults that teenagers have adopted anyway, and one where the harms regulators are most worried about are conversational rather than content-based.
The DSA's minors provisions were written with feeds and recommender systems in mind. Applying them to a system whose entire interface is a text box is going to require the Commission to say what a systemic risk to a minor looks like when there is no algorithmic feed to audit. That determination, when it comes, will matter more than the designation itself.
Europe has spent two years arguing about whether AI should be governed through the AI Act, which regulates models and their providers, or through the platform rules, which regulate services and their effects. Monday's decision does not settle that argument, but it does show the Commission's instinct: use the instrument that is already in force, already staffed, and already has a supervision team, rather than wait for the newer one to mature.
That instinct has a cost. Fitting a chatbot into a category built for search engines produces a regime that covers part of the product and not the rest, and invites exactly the boundary litigation that Brussels usually says it wants to avoid. It also hands OpenAI a genuine question of interpretation about which of its obligations attach to which function, at a moment when the company has four months to answer.
The bigger point is jurisdictional. A service used by roughly one in three people in the European Union is now supervised from Brussels, on European terms, on a timetable Brussels set. Whatever one thinks of the DSA, that is the mechanism working as designed — and it happened without a single new law being passed.
