EU Designates ChatGPT as a Very Large Online Search Engine Under the DSA

The European Union has spent the past two years building the world's most aggressive regulatory framework for the internet, and on Aug 31 it took a step that extends that framework into the heart of the artificial intelligence boom. The European Commission designated OpenAI's ChatGPT as a Very Large Online Search Engine under the Digital Services Act, the first time a conversational AI chatbot has been placed in the DSA's strictest regulatory tier, and it simultaneously named Reddit and Roblox as Very Large Online Platforms. The designations, announced by the Commission on Aug 31 and reported by Euractiv, PYMNTS and The Next Web, put ChatGPT under the same regime as the largest social networks and search engines, with obligations to assess systemic risks, submit to independent audits and open data to researchers.

The decision resolves a question that regulators around the world have been circling for years: when an AI chatbot replaces the functions of a search engine, at what point does it become one in the eyes of the law? The Commission's answer, that ChatGPT is a hybrid online search engine because it can surface information in response to queries, is the first formal classification of its kind, and it will shape how every other jurisdiction, from Washington to London to Tokyo, treats conversational AI as a platform.

Key Facts

The European Commission announced on Aug 31 that it had designated ChatGPT as a Very Large Online Search Engine, with OpenAI Ireland Ltd as the responsible legal entity, as noted by The Next Web on Aug 31, and Reddit and Roblox as Very Large Online Platforms, with the services' EU user bases triggering the designations. The DSA's threshold for the largest tier is 45 million average monthly users in the EU, and the Commission's published figures put ChatGPT at 159.1 million average monthly EU users, Reddit at 57.2 million and Roblox at approximately 46.6 million. PYMNTS reported on Aug 31 that the designations bring the total number of services subject to the DSA's strictest obligations to 28.

The practical obligations are substantial. Under the DSA, designated services must identify and mitigate systemic risks, which for a chatbot includes the spread of illegal content, the manipulation of users through AI-generated material, and the amplification of harmful information. The Commission's announcement, reported by Euractiv on Aug 31, gives the three companies four months, by January 2027, to run systemic-risk assessments, submit to independent audits, provide researcher access to data, and put in place the transparency mechanisms the DSA requires. Non-compliance carries fines of up to 6% of a company's global annual turnover, a scale of penalty that has made the DSA the most consequential internet law outside China.

The Commission named EU Executive Vice President Henna Virkkunen as the lead overseeing the designations, with Ireland's Coimisiún na Meán, the country's media regulator, responsible for supervising OpenAI as its EU establishment, and the Netherlands' ACM overseeing Reddit. The choice of national regulators reflects the DSA's structure, in which the country where a platform has its main EU establishment leads enforcement, and it means OpenAI, which is registered in Ireland, will face its most direct supervision from the Irish regulator that has also handled its data-protection matters for years.

Analysis

The bigger picture here is that the Commission has made a deliberate legal choice to treat ChatGPT as a search engine rather than as a novel category of its own, and that choice is more consequential than it first appears. What this really means is that the EU is refusing to let AI services argue that they are too new to fit existing rules; by classifying ChatGPT under the DSA's search-engine category, it forces OpenAI to comply with a mature, well-understood regulatory regime whose obligations, risk assessments, audits and data access, were written for platforms that have been operating for a decade. The legal framing matters because a chatbot that is a search engine must follow search-engine rules, including rules that govern how it ranks and presents information, which is precisely the area where AI chatbots have raised the most concern, from misinformation to the opaque way they surface sources.

The Next Web reported on Aug 31 that OpenAI Ireland Ltd is the responsible legal entity for ChatGPT under the DSA.

The user-number arithmetic is the hidden driver of the decision. At 159.1 million average monthly EU users, ChatGPT is not marginally above the 45 million threshold, it is more than three times over it, which makes the designation nearly impossible to contest on factual grounds. That scale also reveals the uncomfortable reality for OpenAI: the company has grown so large in Europe that it has graduated, whether it likes it or not, into the same regulatory tier as the platforms it once positioned itself against. The practical consequence is that OpenAI will now have to build the kind of compliance machinery, legal teams, risk-assessment processes and audit trails, that Google, Meta and TikTok have spent years and billions of dollars constructing, and that cost will compound at a moment when the company is also navigating national AI regulations and the AI Act's own requirements.

The competitive and political consequences are equally significant. The EU has now claimed authority over the most prominent AI company in the world at the platform level, on top of the AI Act's product-level rules, and the designations of Reddit and Roblox show that the Commission is expanding the DSA's reach across the internet economy, from AI assistants to user-generated content to gaming worlds. For OpenAI, the immediate challenge is practical: it must produce systemic-risk assessments within four months, open data to researchers in ways that could expose how its models generate and rank information, and submit to audits, all while fighting legal battles over copyright and facing scrutiny from other regulators. For rivals, the designation creates a compliance template, since any future chatbot that crosses the 45 million-user threshold in the EU will inherit the same obligations, and it gives European competitors, which are already building with DSA compliance in mind, a structural advantage over U.S. entrants that have to retrofit.

Why It Matters

For European users, the designation means the AI assistant many of them use every day will be subject to the strongest transparency and safety rules in the world, with requirements to report on how it surfaces information, mitigate election manipulation and give researchers a window into its systems. For OpenAI, it adds a new layer of regulatory cost and legal exposure to an already crowded agenda, and it raises the stakes of any future decisions about where and how ChatGPT operates in Europe. For the global AI industry, the decision is the clearest statement yet that regulators intend to govern AI services through existing platform law, not just new AI-specific statutes, and it sets a precedent that other jurisdictions are likely to follow. And for the broader debate over AI safety, it marks the moment when the largest chatbot in the world became legally accountable for what it recommends and how it ranks information, not just for what it generates.

PYMNTS reported on Aug 31 that the designations bring the total number of DSA-regulated services to 28.

Next Up

In the coming four months, watch how OpenAI responds to the systemic-risk assessment requirement, which will be the first major test of whether a frontier AI company can meet DSA obligations in practice, and whether it challenges the search-engine classification in court, a route that would set up a landmark case over the legal nature of chatbots. Also monitor the parallel designations of Reddit and Roblox, which will show how the Commission applies the same framework to very different services, and whether other AI chatbots, including Google's Gemini and Meta's assistants, face the same classification as their EU user bases grow. The longer-term question is whether the DSA, an internet-era law, can genuinely govern the risks of AI systems whose behavior is far harder to predict than a traditional platform's, or whether the search-engine box the Commission has built for ChatGPT will need to be redesigned once the next generation of agents arrives.