EU classifies ChatGPT as search engine under strictest digital rules

The European Commission has placed ChatGPT, Reddit and Roblox under the toughest tier of its Digital Services Act, resolving a contentious debate over how to classify OpenAI's chatbot by declaring it a search engine. The decision, announced on Monday, brings three American services under direct Commission supervision and imposes obligations to assess and mitigate systemic risks including harms to minors, election integrity and public security.

The classification matters because the DSA treats platforms and search engines differently. A Very Large Online Platform, or VLOP, must assess risks related to content distribution, advertising and user manipulation. A Very Large Online Search Engine, or VLOSE, must evaluate how its ranking algorithms and result presentation shape access to information. By designating ChatGPT as a search engine rather than a platform, the Commission has decided that the service's primary function is directing users to information, not hosting their content. That distinction will shape what OpenAI must do to comply.

The search engine classification that divided Brussels

ChatGPT's potential designation has been watched closely in Brussels since OpenAI declared 120 million EU users last year. The question was straightforward in principle but awkward in practice: is a conversational AI that synthesises answers from training data a search engine, a content platform, or something the DSA's drafters never anticipated?

The DSA defines an online search engine as a service that allows users to input queries and returns results in any format, including links to third-party websites. OpenAI has been building search functionality into ChatGPT since late 2024, integrating live web results alongside generated text. The Commission's designation focuses on that search feature rather than the chatbot's broader conversational capabilities. OpenAI spokesperson Oscar Haines confirmed the company's reading: "ChatGPT search operates as a search service under the DSA, and we are preparing to meet the additional compliance requirements that come with this Very Large Online Search Engine designation."

The classification is not merely semantic. A VLOSE must conduct annual risk assessments covering how its algorithms may contribute to the dissemination of illegal content or the manipulation of search results. It must provide transparency about ranking parameters and allow researchers access to data. These obligations map reasonably well onto Google Search or Bing, where a user types a query and receives a ranked list of links. They map less neatly onto a service that generates a single synthesised paragraph, cites sources only intermittently, and can produce plausible falsehoods with no external link to verify.

Brussels has essentially decided that the search feature is dominant enough to bring the entire service under the VLOSE regime. Whether the compliance framework designed for link-based search engines can adequately address the risks of AI-generated answers is a question regulators and OpenAI will now have to work through together.

What the DSA's strictest tier demands

The DSA, which entered full force in February 2024, establishes a graduated system of obligations based on the size and reach of online services. The threshold for the strictest tier is 45 million monthly active users in the EU. Once the Commission designates a service as a VLOP or VLOSE, it has four months to comply with the full set of obligations, on pain of fines reaching 6 per cent of annual global revenue.

Those obligations include conducting annual systemic risk assessments, adopting risk mitigation measures, and submitting to independent audits. VLOPs must also provide an advertising repository, restrict targeted advertising to minors and refrain from using sensitive personal data for ad targeting. VLOSEs face analogous requirements calibrated to search: they must assess how ranking and recommendation algorithms may amplify harmful content and must offer at least one option for search results that is not based on profiling.

The regime also gives the Commission direct enforcement authority. For smaller platforms, national regulators hold the leash. For VLOPs and VLOSEs, Brussels supervises compliance itself, a structure designed to prevent large American companies from shopping for lenient regulators in smaller member states.

Reddit and Roblox join the VLOP list

Reddit, the discussion platform founded in 2005, reported 57.2 million EU users in July, comfortably above the 45-million threshold. Its designation as a VLOP subjects it to the full platform regime, covering content moderation, transparency reporting and advertising disclosure. Reddit spokesperson Jen Molina said the company was committed to complying with the designation. "We've been preparing to meet the VLOP requirements and look forward to coordinating with EU regulators while providing transparency for Reddit users."

Roblox, the gaming platform popular with children, reported 46.6 million EU users. Its designation raises particular questions about child safety, since the DSA's systemic risk provisions require VLOPs to assess and mitigate risks to minors. Joost Hagesteijn, Roblox's general manager for Europe, framed the designation as a positive: "We are proud to be the first gaming platform to reach this milestone in the EU. Safety is foundational to everything we do and we look forward to continuing our constructive engagement with the European Commission."

With these additions, 28 services now fall under the DSA's strictest regime. The list already included X, TikTok, YouTube, Facebook, Instagram, Amazon Marketplace and several others. The addition of a gaming platform and a discussion forum signals that the Commission is applying the law to services that may not fit the social media mould but reach enough European users to warrant the same scrutiny.

Dual regulation: the DSA meets the AI Act

ChatGPT is not arriving at the DSA unregulated. The Artificial Intelligence Act, which the European Parliament adopted in March 2024 and which is being phased in through 2026 and 2027, already imposes transparency and risk management obligations on general-purpose AI models such as GPT-4. OpenAI must document training data, publish summaries of copyrighted material used, and ensure adequate cybersecurity. The AI Act's provisions on systemic risks for the most powerful models add a second layer of oversight.

The overlap between the two regimes is not accidental. The DSA governs how a service operates in the market: what content it distributes, how it ranks results, what advertising it shows. The AI Act governs how the underlying model is built and deployed. A chatbot designated as a VLOSE will need to satisfy both sets of obligations simultaneously, and the two statutes were not drafted with each other's specifics in mind. The Commission will need to coordinate its own enforcement internally to avoid giving OpenAI contradictory instructions about what a risk assessment should contain.

For OpenAI, the practical burden is manageable in financial terms but significant in operational ones. The company must produce a systemic risk assessment covering its search algorithms, establish a compliance function answerable to the Commission, and submit to independent audits. It must also provide a mechanism for users and authorities to flag illegal content in search results, a requirement that sits uneasily with a product that generates text rather than linking to third-party pages.

The compliance clock starts now

The four-month compliance window gives the three companies until roughly the end of December 2026 to demonstrate that they meet the DSA's requirements. In practice, that means submitting systemic risk assessments, publishing transparency reports and establishing points of contact for the Commission and for users.

Enforcement will follow. The Commission has already opened proceedings against X for suspected breaches of the DSA and has sent information requests to several other VLOPs. The pattern suggests that designation is the beginning of scrutiny, not its end. Brussels has shown a willingness to test its powers against large American platforms, and ChatGPT's novel status as an AI-powered search engine makes it an obvious candidate for close inspection.

The bigger question is whether the DSA's framework, drafted before generative AI became a consumer product, proves adequate. Search engine regulation was designed for a world of blue links. Applying it to a system that writes its own answers, sometimes accurately and sometimes not, will test whether the law's general principles can handle a technology the drafters did not foresee.