EU designates ChatGPT a search engine, subjecting it to strictest online-safety rules
The European Commission classified ChatGPT as a Very Large Online Search Engine under the Digital Services Act, the first such designation for an AI chatbot, and gave OpenAI until January to comply with new risk-assessment and audit rules.

The European Commission has designated ChatGPT a "Very Large Online Search Engine" under the European Union's Digital Services Act, the first time regulators have placed an AI chatbot in that category. The Aug. 31 decision, announced on the Commission's Digital Services Act newsroom, simultaneously classified Reddit and Roblox as "Very Large Online Platforms," pulling all three services into the law's strictest oversight tier.
The Commission's own registry of designated services shows ChatGPT reported an average of 159.1 million monthly active users across the EU over the six months ending in March 2026 — more than three times the 45-million-user threshold that triggers designation. Reddit reported 57.2 million monthly EU users and Roblox 46.6 million, according to the same registry. ChatGPT now sits in the search-engine category alongside Google Search and Bing, the only other services designated VLOSEs.
The Commission said ChatGPT qualifies as a search engine because the service can "engage with and respond to users' prompts and queries, including by searching the web," making it what regulators called a hybrid service. That reasoning extends a law written for conventional platforms to generative-AI tools that increasingly substitute for keyword search, and it comes as OpenAI has pushed ChatGPT further into web-search functions over the past year.
What the designation requires
Under the Digital Services Act, both Very Large Online Platforms and Very Large Online Search Engines must assess and mitigate "systemic risks" tied to their algorithms, including the spread of illegal content, harm to minors, threats to users' mental well-being, effects on fundamental rights, and risks to elections and public security. Designated services also face independent audits and must give vetted researchers access to their data. Companies have four months from notification, until January 2027, to come into compliance, the Commission said. Violations of the law can draw fines of up to 6% of a company's global annual revenue.
"These new designations mean that ChatGPT, Reddit and Roblox will now be held to a higher standard of scrutiny and accountability," said Henna Virkkunen, the Commission's executive vice-president for tech sovereignty, security and democracy.
OpenAI acknowledged the new obligations rather than contesting them. "ChatGPT search operates as a search service under the DSA, and we are preparing to meet the additional compliance requirements that come with this Very Large Online Search Engine designation," a company spokesperson told PYMNTS. Reddit and Roblox likewise said they had been preparing for the added scrutiny, according to the same report.
The ruling adds a second layer of EU regulation for OpenAI, which already answers to the bloc's separate AI Act rules governing general-purpose AI models. Reddit's and Roblox's designations mark a widening of the DSA's largest-platform category beyond traditional social networks and marketplaces to games and community-forum services with tens of millions of EU users, a shift Euronews noted extends Brussels' online-safety net further into everyday consumer apps.
The Commission will now supervise the three services directly, with power to open formal proceedings if it finds a company has failed to identify or address systemic risks once the compliance window closes in January. Neither OpenAI, Reddit nor Roblox has said whether it intends to challenge the designation, and no timeline has been set for the Commission's first risk-assessment reviews of the newly designated services.

SonicWall discloses third SMA1000 zero-day exploit chain of 2026

Anthropic reverses enterprise data retention policy after client backlash
Microsoft 365 Limps Back After Daylong Outage Tied to Authentication Failure
