EU puts ChatGPT under the DSA as a very large search engine

The European Commission has put ChatGPT in the same supervisory bucket as the EU’s largest search engines. On Monday, 31 August 2026, it designated ChatGPT as a Very Large Online Search Engine, or VLOSE, under the Digital Services Act. Reddit and Roblox were designated Very Large Online Platforms, or VLOPs, in the same decision.

The services declared that they reach at least 45 million average monthly users in the EU, the threshold for the strictest DSA regime. After notification they have four months, until January 2027, to meet the extra obligations.

This is the first time an AI chatbot has received VLOSE status. For Norwegian boards, CIOs and CISOs the point is operational: ChatGPT is no longer only an AI Act product. It is also a regulated search surface with systemic-risk duties, complaint handling and Commission supervision.

What the Commission actually did

The designation gives the Commission investigative powers over the functionalities behind the services and, where relevant, related systems. Supervision will be shared with national Digital Services Coordinators: Ireland’s Coimisiún na Meán for ChatGPT and Reddit, and the Netherlands Authority for Consumers and Markets for Roblox. OpenAI and Reddit are established in Ireland. Roblox is established in the Netherlands.

ChatGPT is described as a hybrid system. It answers prompts and can search the web. That is why it qualifies as an online search engine under the DSA, not as a generic chatbot and not as a content platform. Reddit and Roblox qualify as platforms because users can disseminate third-party content to the public.

The Commission notes that all three already fall under the general DSA duties for platforms and search engines. What is new is the enhanced regime. The EU has now designated 28 very large online platforms and search engines.

Henna Virkkunen, Executive Vice-President for Tech Sovereignty, Security and Democracy, said ChatGPT, Reddit and Roblox will now be held to a higher standard of scrutiny and accountability, in line with their impact on citizens and society. She added that the Commission will not hesitate to designate any service that meets the threshold.

What four months actually means

The extra duties named in the press release are to assess and mitigate systemic risks from the service and its algorithmic systems. The list is broad: illegal content, negative effects on minors, users’ physical and mental well-being, fundamental rights, electoral processes and public security.

VLOSE and VLOP status also triggers the existing DSA toolkit for very large actors: independent audits, more transparency on recommender systems, researcher data access, and stricter notice-and-action and appeal processes. Under ordinary DSA enforcement, serious breaches can lead to fines of up to six percent of global annual turnover. That penalty is not invented in Monday’s decision. It is the price already written into the law once the strictest category is switched on.

The deadline is January 2027, not “soon” and not “sometime next year”. Four months is short for a company that must document risk across search, answers, child protection and elections. It is shorter still for customers who need to know what changes in enterprise contracts, logging and age checks.

The numbers, and OpenAI’s reply

The Commission states the threshold, not ChatGPT’s exact EU user count. Politico, citing the companies’ own DSA filings, reports Reddit at 57.2 million EU users and Roblox at 46.6 million. Roblox sits just above the line. EU media citing OpenAI’s DSA reporting have put ChatGPT’s search function at about 159 million average monthly EU users in the six months to 31 March 2026. That is the company’s figure, not a Commission finding.

OpenAI spokesperson Oscar Haines told Politico that ChatGPT search operates as a search service under the DSA and that the company is preparing to meet the extra compliance requirements that come with VLOSE designation. Reddit said it has been preparing for VLOP duties. Roblox called the milestone a point of pride and pointed to safety work. None of those comments moves the deadline.

The Verge wrote that the companies have until the end of December 2026. The primary source is clearer: four months after notification, that is January 2027. Use that date in the board pack.

Two laws, not a substitute

ChatGPT is already in scope of the AI Act. The DSA now hits use and scale: search, the answer surface, recommendations, and risk to children, health, elections and public security. These are different statutes with different supervisory logics.

The AI Act asks what the model can do, how it was trained, and which risk class it sits in. The DSA asks what the service does to tens of millions of users, and whether systemic risk is mapped and mitigated. For a Norwegian organisation that uses ChatGPT as an internal search layer, case-handling aid or customer surface, vendor governance now has to cover both.

The designation is not a finding that ChatGPT broke the law. It is a finding that the service is large enough to face the same scrutiny as Google Search.

What Norwegian leaders should do now

Map where ChatGPT is actually used as search. That is not only chatgpt.com. It is browsing inside chat, answers with sources, custom GPTs against open data, and agents that fetch pages. If the answer replaces a result list, it is a search surface. Then DSA logic applies, including on enterprise seats.

Ask OpenAI, and any reseller, for a written plan to January 2027. What changes in logging, age assurance, content complaints, researcher access and risk reporting? What applies to ChatGPT Enterprise and the API, and what applies only to the consumer surface? Do not accept “this is an EU consumer issue”. Supervision hits the service, and the service hits you.

Put CISO and legal with procurement. The DSA risks the Commission lists are the same ones boards already own for platforms: illegal content, children, health, expression, elections and public security. If ChatGPT is used in customer service, HR, schools, health or public case handling, this is a board item, not an IT note.

Plan for more documentation, not less model power. VLOSE status gives the Commission a window into functionality. Customers may get more transparency, and more friction: new consents, stricter logs, changed retention, and human review where answers touch minors or political content.

Do not wait for Google, Microsoft or Anthropic to “surely get the same label”. The Commission says it will designate services that meet the threshold. Gemini, Copilot and Claude can follow if EU user counts justify it. The Norwegian job is a vendor matrix that can survive several AI surfaces being regulated as platform or search, not as neutral software.

The Financial Stability Board warned yesterday that frontier AI is now the most immediate cyber risk in finance. Today’s story is the European governance consequence of the same scale: when an AI service gets large enough, it is treated as public infrastructure. For a Norwegian board that is one question in two languages. Who owns the risk when the answer comes from a search engine that is also a model?

Sources and media

Primary source: European Commission, press release IP/26/1772, “Commission designates ChatGPT, Reddit, Roblox under Digital Services Act”, 31 August 2026: https://ec.europa.eu/commission/presscorner/detail/en/ip_26_1772

Commission PDF, updated 31 August 2026 at 17:00: https://ec.europa.eu/commission/presscorner/api/files/document/print/en/ip_26_1772/IP_26_1772_EN.pdf

Politico, “EU places ChatGPT, Reddit, Roblox under its strictest platform rules”, 31 August 2026: https://www.politico.eu/article/chatgpt-reddit-roblox-face-eus-strictest-platforms-regime/

The Verge, “ChatGPT to face tougher regulation in the EU”, 31 August 2026: https://www.theverge.com/ai-artificial-intelligence/986682/openai-chatgpt-eu-dsa

Euractiv, “OpenAI's ChatGPT falls under strictest EU online rules”, 31 August 2026: https://www.euractiv.com/news/openais-chatgpt-falls-under-strictest-eu-online-rules/

Thumbnail: OpenAI Image 2 / hogby.ai