EU Designates ChatGPT as a Very Large Online Search Engine Under DSA

What happened

The European Commission has designated ChatGPT as a Very Large Online Search Engine (VLOSE) under the Digital Services Act — the first time an AI chatbot has received this designation. In the same decision, the Commission designated Reddit and Roblox as Very Large Online Platforms (VLOPs).

The designation rests on the services’ own declarations that they reach at least 45 million average monthly users in the EU, the DSA’s threshold for VLOP/VLOSE status. OpenAI reported to the Commission that ChatGPT search averaged roughly 159.1 million monthly users in the EU over the six months ending March 31, 2026 — more than three times the threshold. That figure is self-reported by OpenAI; the Commission evaluated it during its review rather than measuring it independently.

Designated services must comply with the DSA’s extended obligations by January 2027. The central requirement is to assess and mitigate systemic risks stemming from the service and its algorithmic systems, covering illegal content, effects on minors, users’ physical and mental well-being, fundamental rights, electoral processes and public security. Beyond that assessment, designated services must undergo independent annual audits, share data with regulators and vetted researchers, offer a content-recommendation option not based on profiling, and maintain a public repository of advertisements, a set of obligations also described in a second outlet’s account of the decision. Non-compliance can bring fines of up to 6% of a company’s global annual turnover.

Rather than classify ChatGPT as a standard platform, the Commission treated it as a hybrid service that qualifies as a search engine, because it draws results to user queries from the internet the way a search engine does, according to Search Engine Journal’s reporting on the decision. The designation brings the total number of services designated as VLOPs or VLOSEs under the DSA to 28.

European Commission Executive Vice-President for Tech Sovereignty Henna Virkkunen said the designations mean “ChatGPT, Reddit and Roblox will now be held to a higher standard of scrutiny and accountability in the European Union, in line with their large impact on our citizens and society”. An OpenAI spokesperson said “ChatGPT search operates as a search service under the DSA, and we are preparing to meet the additional compliance requirements that come with this Very Large Online Search Engine designation”.

What this means (and what it does not)

The designation puts ChatGPT under the same regulatory tier the EU has applied to Google Search and Bing since 2023, extending the DSA’s systemic-risk framework to an AI chatbot for the first time. For the Commission, it is a chance to be the first regulator to bind a major AI consumer product to formal risk-assessment and audit rules. For Google and Microsoft, whose search engines have carried these obligations for three years, it produces a level playing field in which a fast-growing rival now shoulders the same compliance load. OpenAI’s own framing — a spokesperson describing preparation to meet requirements rather than any disruption — casts the transition as routine rather than forced. Child-safety and digital-rights groups gain a public benchmark to hold OpenAI to, since the obligations explicitly name minors’ well-being and mental health among the risks to be assessed.

What the designation does not establish is what changes for ChatGPT users. The obligations require risk assessments, audits and data access — none of that specifies a concrete product change, such as age verification or new content restrictions for minors. Nor does the hybrid service classification indicate whether ChatGPT’s obligations differ meaningfully from a standard VLOP’s, or whether the distinction is largely procedural. And one EU decision does not indicate whether other regulators will apply the same framework to AI chatbots.

What we still do not know

It is not established which of the newly triggered obligations — risk assessment, audits, regulator and researcher data access, a non-profiling recommender option, an ad repository — ChatGPT already satisfies through existing safety measures versus what OpenAI must newly build. Whether the protection of minors obligation will produce visible product changes, such as age verification, or remain a reporting exercise, is also unclear. No source found reconciles the four months from notification timeline some outlets cite with the Commission’s own by January 2027 deadline, so the exact compliance date is not settled. How compliance costs might affect ChatGPT’s EU pricing or feature availability is not addressed in any source found. And beyond the single spokesperson line, OpenAI has not issued a detailed public statement on what specific child-safety or content-moderation mechanisms it will build for the EU market.