The designation
The European Commission designated ChatGPT a Very Large Online Search Engine (VLOSE) on August 31, 2026, the first time an AI chatbot has been placed in that category under the Digital Services Act (DSA), the European Union's law governing online platforms. In the same announcement, Reddit and Roblox were newly designated as Very Large Online Platforms (VLOPs), the DSA's equivalent category for platforms rather than search tools.
The threshold for either designation is 45 million average monthly users across the European Union, measured over a six-month window. ChatGPT cleared it easily: OpenAI reported 159.1 million average monthly EU users for the six months ending March 31, 2026, roughly three and a half times the cutoff. Reddit came in at about 57.2 million and Roblox at about 46.6 million, both closer to the line but still over it.
Why a chatbot counts as a search engine
The VLOSE category was written with services like Google Search and Bing in mind, not conversational AI. The European Commission's reasoning is that ChatGPT functions as a hybrid: it answers direct queries and can search the live web to do so, which is enough to meet the DSA's definition of an online search engine regardless of the conversational interface wrapped around it. That distinction matters because VLOSE and VLOP status come with the DSA's strictest tier of obligations, previously reserved for services like Google Search and major social platforms.
What OpenAI now has to do
Designated services get four months from formal notification to meet the enhanced obligations, which puts OpenAI's compliance deadline around January 2027. The requirements include:
- Systemic risk assessments covering illegal content, risks to minors, effects on users' mental and physical well-being, fundamental rights, elections, and public security
- Independent annual audits of how well the service manages those risks
- Data-sharing with the European Commission and national regulators on request
- Structured data access for approved outside researchers
- Public transparency reports every six months
- An internal, independent compliance function reporting on DSA adherence
According to Heise Online, the Commission has also flagged specific risk areas it intends to scrutinize for ChatGPT going forward, including deepfake pornography, the use of AI in influencing security-relevant corporate decisions, and the emerging category of "independently acting models", meaning AI agents that take actions on a user's behalf with less direct human oversight at each step.
Who actually enforces this
The DSA splits enforcement by obligation type. The European Commission itself has exclusive oversight of the enhanced VLOP and VLOSE duties described above, while day-to-day regulatory coordination for OpenAI runs through Ireland's Coimisiún na Meán, reflecting OpenAI's EU presence there. Reddit and Roblox are coordinated instead through the Dutch Authority for Consumers and Markets (ACM).
EU Vice-President Henna Virkkunen framed the move as a matter of scale rather than a punishment for wrongdoing, saying the three services "will now be held to a higher standard of scrutiny and accountability in the European Union, in line with their large impact on our citizens and society," according to Heise Online.
That framing is worth taking seriously: as Winbuzzer noted, a VLOSE or VLOP designation is a legal classification that triggers new compliance duties once a usage threshold is crossed. It is not a finding that ChatGPT has broken any law or caused specific harm. OpenAI has not been fined or sanctioned here; it has been reclassified into a heavier regulatory tier because of its user count.
What it means in practice
For everyday users in the EU, the practical effects will arrive gradually rather than immediately. Expect more visible transparency disclosures from OpenAI about how ChatGPT ranks or generates responses, a formal channel for flagging illegal content, and eventually published risk-assessment summaries covering things like effects on minors and election-related misuse. For businesses building on OpenAI's API or products, the compliance function and researcher-data-access requirements mean more scrutiny of the platform is coming, though the API itself is not directly regulated the same way the consumer-facing ChatGPT product is. For OpenAI, the January 2027 deadline sets a concrete clock: expect the company to publish its first systemic risk assessment and begin six-monthly transparency reporting before then, likely alongside similar moves from Reddit and Roblox on the same timeline. Watching whether OpenAI meets that deadline, and what its first risk assessment actually says, is the next milestone worth tracking in this story.
