EU Designates ChatGPT a “Very Large Online Search Engine” Under the DSA

Last updated: 3 September 2026. All figures below are sourced to primary publications and linked inline; where a number is self-reported by a company, that is stated explicitly.

The 60-second version

• On 31 August 2026, the European Commission formally designated ChatGPT a “Very Large Online Search Engine” (VLOSE) under the EU’s Digital Services Act — the first time an AI chatbot has been classified this way.
• The designation is triggered automatically once a service reports more than 45 million average monthly users in the EU. OpenAI’s own disclosure put ChatGPT at 159.1 million average monthly EU users over the six months to 31 March 2026.
• Reddit and Roblox were designated Very Large Online Platforms (VLOPs) the same day, on the same 45-million-user threshold.
• ChatGPT joins Google Search and Bing as only the third service ever designated a VLOSE, bringing the total number of services under the DSA’s strictest supervisory tier to 28.
• OpenAI has four months from formal notification to complete systemic risk assessments, appoint a compliance officer, submit to independent audits and open data access to EU regulators and vetted researchers. Non-compliance can cost up to 6% of global annual turnover.
• The exact compliance deadline is oddly hard to pin down — different Commission-linked sources put it anywhere from November 2026 to January 2027 — because the Commission has not published the formal notification date.

Key numbers

What the Commission actually did

On 31 August 2026, the European Commission designated ChatGPT, Reddit and Roblox under the Digital Services Act, the EU’s content-and-platform-accountability law. ChatGPT was classified as a Very Large Online Search Engine; Reddit and Roblox as Very Large Online Platforms. All three cleared the same bar: at least 45 million average monthly users in the EU, measured over six months and self-reported by the companies themselves.

OpenAI’s disclosure, cited in the Commission’s own materials, put ChatGPT’s EU reach at 159.1 million average monthly active users for the six months ending 31 March 2026 — self-reported, not independently audited, though that is the same category of figure the Commission has used for every VLOP/VLOSE designation since 2023. Reddit reported roughly 57.2 million monthly EU users and Roblox around 48 million, per Euronews’ reporting.

This is not the EU’s first attempt to regulate how AI systems reach European users — we covered the broader push in our earlier look at the DMA and DSA’s expanding reach over Big Tech. What is new here is the Commission stretching a law written for search engines and social networks over a conversational AI product, and doing so on the same legal footing as Google Search and Bing.

Why a chatbot counts as a “search engine”

The DSA defines an online search engine broadly: a service that allows users to input queries and returns results that help them find information across the web. The Commission’s reasoning, as reported by Search Engine Journal, is that ChatGPT qualifies as a search engine because it “responds to users’ prompts and queries, including by searching the web” — a description that covers ChatGPT’s browsing and citation features rather than its underlying language model as such.

That framing sidesteps a harder question: whether a generative chatbot is a “search engine” in the everyday sense at all. The Commission did not classify ChatGPT’s core chat, image generation or coding assistance under the DSA — only its search-adjacent behaviour of fetching and citing live web results. Digital Applied’s analysis notes that ChatGPT now sits in the same regulatory bracket as Google Search (around 364 million EU users) and Bing, despite ChatGPT’s user base being well under half Google’s — scale relative to the threshold, not to the market leader, is what triggers designation.

What “Very Large” status actually requires

VLOP and VLOSE status is the DSA’s heaviest compliance tier, reserved for platforms deemed capable of systemic harm at EU-wide scale. Once formally notified, a designated service must, within the compliance window:

• Conduct and publish an annual systemic risk assessment covering illegal content, harm to minors, mental and physical wellbeing, fundamental rights, electoral integrity and public security.
• Commission an independent external audit, paid for by the company, with a documented response to the auditors’ recommendations.
• Appoint a compliance officer with real authority and resources inside the organisation.
• Grant data access to the European Commission, EU national regulators and vetted independent researchers studying systemic risk.
• Publish transparency reports on risk assessment and mitigation measures, an obligation that applies to every designated VLOP and VLOSE.

For a company that has spent the past year managing its own security incidents in public — see our coverage of OpenAI’s Hugging Face breach report and its decision to pause its largest training run over cyber risk — audits and risk assessments are not novel territory internally. What changes is that they now have to be documented, externally audited and largely shared with an EU regulator, rather than handled as an internal judgement call.

The data-access clause is the one worth watching

Buried in the standard obligations is a provision that matters more for ChatGPT than it did for Reddit: vetted researchers gain a route to examine how the service selects and ranks the sources it cites. Digital Applied calls this “the first regulated route into how an AI assistant picks its sources” — a fair characterisation. Until now, which pages ChatGPT surfaces, links to or summarises has been entirely opaque outside OpenAI. The DSA does not force OpenAI to publish its ranking algorithm, but it creates a formal channel through which independent researchers can request the data needed to study it.

What most coverage is getting wrong

The initial headlines framed this largely as “ChatGPT is now regulated like Google” — true, but it undersells two things. First, the designation changes nothing about ChatGPT’s behaviour on day one. As Digital Applied puts it, “nothing about rankings or citations changes today”; the obligations phase in over the compliance window. Second, most coverage skipped past the fact that OpenAI is already carrying regulatory and legal exposure on several continents at once — from Brussels to Buenos Aires, where Perfil’s copyright lawsuit against OpenAI and Microsoft in Argentina is proceeding in a jurisdiction with no fair-use defence. Read together, this is less “one big EU story” and more a pattern: the cost of operating a consumer AI product at scale is rising on multiple fronts at once, not just in Europe.

It is also worth being precise about what the 45-million-user threshold does and does not mean. It is not a judgment that ChatGPT is uniquely risky — Reddit and Roblox cleared the identical bar the same day, for very different products. The threshold is a blunt, size-based trigger written into the DSA in 2022, before generative AI search existed in its current form; the Commission is applying an old rule to a new category of product, which is exactly why the “is a chatbot a search engine” question above is more interesting than most coverage has treated it.

Practical takeaways for people who build, publish or run software

• Publishers relying on AI referral traffic: the vetted-researcher data-access clause is the first formal mechanism that could make ChatGPT’s source-selection behaviour legible from the outside. Watch OpenAI’s transparency reports once they appear — they should be the most detailed public account yet of how ChatGPT decides what to cite.
• Teams building on the OpenAI API: the obligations attach to ChatGPT’s consumer-facing search behaviour, not the API directly, so this is unlikely to change API terms soon. But audit findings and risk-assessment disclosures are public documents worth monitoring for signals about data handling and reliability.
• Anyone building a consumer AI product with EU reach approaching the threshold: 45 million users is lower than it sounds once you’re counting across the whole EU. Perplexity, Microsoft Copilot and Google’s Gemini assistant look like plausible candidates for similar designation in future rounds — that is informed speculation, not confirmed by the Commission, but it is where the DSA’s own logic points.
• Anyone handling EU user data inside an AI product: these obligations sit alongside, not instead of, existing GDPR duties. It’s worth revisiting how your product collects, stores and learns from user data now, rather than waiting for a regulator to ask.

What we still don’t know

• The exact compliance deadline. The Commission has not published the date it formally notified OpenAI, so reporting on the four-month deadline diverges: some Commission-linked pages point to January 2027, a Romanian-language Commission page reportedly cites late December 2026, and other reports point to November or December 2026. Until the notification date is clarified, the real deadline is genuinely uncertain.
• Whether the designation covers ChatGPT’s full product or only its web-search feature. The legal reasoning focuses on ChatGPT’s ability to search the web — it is unclear from public materials how far audit and risk-assessment obligations extend into ChatGPT’s broader chat, coding and image-generation functionality.
• How OpenAI’s user numbers were verified, if at all. Like every VLOP/VLOSE designation before it, the 159.1 million figure is self-reported. The Commission can request an independent audit of that number, but there is no public confirmation it has done so here.
• Whether other AI assistants will be designated next. No formal process has been announced for reviewing Gemini, Copilot or other AI-search hybrids against the same threshold.

FAQ

Does this mean ChatGPT is banned or restricted in the EU?

No. VLOSE designation is a compliance category, not a restriction on the service. ChatGPT continues to operate in the EU as before; the designation adds audit, transparency and risk-assessment obligations that phase in over the coming months.

Will this change what ChatGPT shows EU users?

Not immediately, and not necessarily in a way users will notice directly. The obligations are mostly about documentation, external audits and regulator access rather than user-facing product changes — though risk mitigations that come out of the required assessments could eventually affect features.

Is ChatGPT the first AI chatbot to be classified as a search engine under EU law?

Yes, according to the Commission’s own announcement and multiple outlets covering it — this is the first time the DSA’s Very Large Online Search Engine category has been applied to a generative AI chatbot rather than a traditional search engine like Google Search or Bing.

What happens if OpenAI doesn’t comply?

The DSA allows fines of up to 6% of a company’s global annual turnover for non-compliance, alongside other enforcement measures the Commission has used against other designated platforms since 2023.

Sources

• European Commission — Commission designates ChatGPT, Reddit, Roblox under the Digital Services Act (primary)
• European Commission — List of designated VLOPs and VLOSEs (primary)
• European Commission — Daily News, 31 August 2026 (primary)
• Euronews — EU places ChatGPT, Reddit and Roblox under strictest digital safety rules
• Search Engine Journal — ChatGPT is now a Very Large Online Search Engine in the EU
• Winbuzzer — EU designates ChatGPT, tougher DSA search-engine scrutiny
• Digital Applied — The EU now puts ChatGPT in the same tier as Google Search

Please follow and like us: