The European Commission has formally designated OpenAI's ChatGPT as a Very Large Online Search Engine and both Reddit and Roblox as Very Large Online Platforms under the Digital Services Act, extending the EU's toughest regulatory regime to generative AI search for the first time. The decision, announced on Monday, brings the total number of services subject to enhanced supervision to 28.
The three companies cross the statutory threshold of 45 million average monthly users in the European Union. That figure, set out in the DSA, triggers a cascade of obligations that go well beyond the baseline rules applying to smaller platforms. ChatGPT, Reddit and Roblox now have until the end of January 2027 to put in place the required risk assessments, mitigation measures, transparency reporting and independent audits.
What the designations actually mean
A Very Large Online Platform (VLOP) or Very Large Online Search Engine (VLOSE) designation is not merely a label. It subjects the service to the full weight of the DSA's systemic risk framework. The companies must assess and mitigate risks stemming from their services and algorithmic systems across six domains: dissemination of illegal content, negative effects on minors, impacts on users' physical and mental well-being, threats to fundamental rights, interference with electoral processes, and risks to public security.
In addition, the Commission gains investigative powers to examine the functionalities behind these services and any related systems. That includes the right to request internal documents, conduct interviews and carry out on-site inspections. Failure to comply can attract fines of up to 6% of global annual turnover and, in extreme cases, a temporary ban from the EU market.
ChatGPT enters uncharted regulatory territory
The inclusion of ChatGPT is the most consequential element of Monday's decision. Until now, the VLOSE category has been occupied exclusively by traditional search engines, Google Search and Microsoft Bing. ChatGPT's designation reflects the Commission's view that the service operates as a search service within the meaning of the DSA, a position OpenAI does not dispute. An OpenAI spokesperson told PYMNTS that the company is preparing to meet the additional compliance requirements and noted that the designation illustrates Europe's rapid adoption of new search methods.
This creates a novel regulatory challenge. Traditional search engines index and rank existing web pages. Generative AI search produces synthesized answers drawn from training data and, increasingly, live retrieval. The systemic risk methodology developed for indexing services may not map neatly onto a system that can hallucinate, amplify bias or be manipulated through prompt injection. The Commission's investigative powers will be tested as it seeks to understand the functionalities behind ChatGPT's responses.
Reddit and Roblox bring community and gaming into scope
Reddit's designation as a VLOP was widely anticipated. The platform's 45 million-plus EU users are concentrated in highly active, topic-specific communities where content moderation is largely delegated to volunteer moderators. The DSA will require Reddit to demonstrate that its governance model, including the relationship between paid staff and volunteer moderators, adequately mitigates systemic risks. A Reddit spokesperson said the company has been preparing for VLOP requirements and looks forward to coordinating with EU regulators while providing transparency for users.
Roblox's designation is more unusual. It becomes the first gaming platform to reach the VLOP threshold, a milestone the company described as driven by its developer community and backed by a commitment to a safe, civil and age-appropriate experience. Roblox highlighted its pioneering age-check systems for chat and content and default protections for younger players. The platform's user-generated content model, combined with a predominantly young user base, makes the DSA's requirements on minors' protection and mental well-being particularly salient.
The compliance clock starts now
The January 2027 deadline gives the three companies roughly five months to complete their first systemic risk assessments, publish transparency reports, appoint compliance officers and establish independent audit mechanisms. They must also set up a dedicated DSA compliance function and provide the Commission with access to data needed for supervision. For ChatGPT, the most complex task may be designing a risk assessment methodology that captures the unique failure modes of generative AI, hallucination, sycophancy, jailbreaking, within the DSA's six risk categories.
The Commission has indicated it will not wait for the deadline to begin engagement. Henna Virkkunen, the executive vice president for tech sovereignty, security and democracy, said the EU will continue to watch the digital landscape closely and will not hesitate to designate any platform that meets the threshold. Her statement signals that further designations are likely, particularly as new services scale rapidly in the EU market.
A regulatory framework built for scale
The DSA's tiered approach, baseline obligations for all intermediary services, enhanced obligations for VLOPs and VLOSEs, was designed to focus regulatory resources where the societal impact is greatest. The 45 million user threshold captures roughly 10% of the EU population. When the legislation was negotiated in 2021 and 2022, the primary targets were the established giants: Google, Meta, Amazon, Apple, Microsoft. The fact that a generative AI service, a community forum and a gaming platform have now crossed the line demonstrates how quickly the digital landscape has shifted.
It also raises questions about the threshold itself. Several services with significant EU reach, Discord, Telegram, Pinterest, Snapchat, remain below the 45 million mark or have not yet been designated. The Commission's willingness to designate new categories of service suggests it is monitoring the market actively, but the process relies on self-reporting of user numbers and Commission verification. That creates a lag between a service reaching the threshold and formal designation.
Global implications of a European rulebook
The DSA has extraterritorial effect: it applies to any service offering its services in the EU, regardless of where the company is incorporated. That means OpenAI, Reddit and Roblox, all US-headquartered, must build compliance systems that satisfy European regulators. In practice, many of the required changes, such as transparency reporting and risk assessments, will be implemented globally because maintaining separate product versions for the EU is technically and financially impractical.
This dynamic, often called the Brussels effect, has already shaped global content moderation practices, algorithmic transparency and advertising disclosures. The extension to generative AI search may accelerate the development of industry standards for AI safety and accountability, as companies seek to demonstrate compliance not only to the Commission but to regulators in the UK, Canada, Australia and elsewhere who are watching the DSA experiment closely.
Enforcement will define the regime's credibility
Designation is only the first step. The DSA's credibility depends on enforcement. The Commission has opened formal proceedings against X, Meta, TikTok and AliExpress since the regime became fully applicable, but no final infringement decisions have yet been published. The first fines, when they arrive, will signal how seriously the Commission treats procedural failures versus substantive risk mitigation. For the newly designated services, the Commission's approach to the first round of risk assessments, due in early 2027, will set the benchmark.
OpenAI, Reddit and Roblox have all signalled willingness to cooperate. That is the rational posture: the cost of non-compliance far exceeds the cost of engagement. But the technical and organisational challenge is substantial. Each company must now translate the DSA's abstract risk categories into concrete metrics, monitoring systems and mitigation measures for services that were not designed with regulatory auditability in mind.
People mentioned
-
OpenAI spokesperson
Organisations
European Commission · OpenAI · Reddit · Roblox · Microsoft · Google
