A threshold has been crossed

The European Commission has designated ChatGPT a Very Large Online Search Engine, or VLOSE, under the Digital Services Act. The Commission says the service declared that it reaches at least 45 million average monthly users in the European Union, the threshold used for the DSA's largest services.

The label sounds like a judgment. It is better understood as a change in the rulebook. The DSA applies proportionately to online services, while its largest platforms and search engines carry additional obligations because their scale can create wider, systemic effects.

That distinction matters. A designation does not say that ChatGPT has done something unlawful. It says the Commission considers the service large enough that it must meet a more demanding set of duties.

The deadline is January, not tomorrow

The Commission says ChatGPT has four months after notification of the designation to comply with the additional VLOSE obligations. Its announcement puts that deadline in January 2027. This is a period for the company to prepare, document and put its systems into operation, not a retrospective verdict on the product.

The additional duties focus on systemic risks linked to a service and its algorithmic systems. The Commission names the dissemination of illegal content, negative effects on minors, physical and mental wellbeing, fundamental rights, electoral processes and public security among the areas companies must assess and mitigate.

A risk assessment is not meant to be a one-page assurance that a product is safe. The point is to identify meaningful ways a large service might cause or amplify harm, decide what measures are proportionate, and keep testing whether those measures work.

Why an AI product sits in a platform rule

The DSA was written for the online environment more broadly than generative AI. Its coverage includes services such as marketplaces, social networks, app stores and online platforms. The Commission's designation places ChatGPT within the DSA category for very large online search engines, rather than creating a bespoke AI category for it.

That does not make the DSA and the AI Act interchangeable. The DSA is concerned with online-service responsibilities and systemic risks at scale. The AI Act has its own framework, definitions and dates. A company working in Europe may need to satisfy both sets of rules in different ways.

For users, the immediate practical result is not a new button or a single prohibition. The value of the designation will depend on the quality of the assessments, the transparency of the mitigations and the Commission's supervision once the new duties apply.

Compliance is more than a content filter

A common mistake is to reduce platform regulation to removing bad material. The Commission's description is broader. It includes how a system may affect minors, wellbeing, rights, elections and public security. Those questions can involve model behaviour, product design, ranking or recommendation choices, reporting routes, transparency, access controls and how a service responds when evidence changes.

That is difficult work because the risks are not all equally measurable. A company can count some reports and test some controls, but it still has to make reasonable judgments about problems that change across languages, countries and use cases. Publishing a risk process does not make the uncertainty go away.

The useful test is concrete: can an outside reader see what risks were identified, what the service changed, what evidence supported the choice and where the limits remain? A large compliance programme without that clarity can still leave users guessing.

What is confirmed, what the Commission says, and what remains open

Confirmed: the European Commission published ChatGPT's VLOSE designation on 31 August 2026. It says the service declared at least 45 million average monthly EU users and that the additional obligations must be met within four months, by January 2027.

The Commission's position: the added DSA requirements will require assessment and mitigation of systemic risks connected to the service and its algorithmic systems. The Commission also describes the DSA as a proportional framework in which the biggest services carry extra responsibilities.

Open questions: the exact risk assessments OpenAI will publish, which mitigations it will choose, how those measures will work across languages and countries, how the Commission will evaluate them, and how the DSA obligations will interact in practice with the separate EU AI Act. The designation starts a compliance phase. It does not finish the regulatory conversation.

Sources

  1. European Commission — Commission designates ChatGPT, Reddit, Roblox under Digital Services ActPrimary Commission press release, 31 August 2026. Source for ChatGPT's VLOSE designation, the declared 45-million-user threshold, the four-month compliance period and the systemic-risk areas named by the Commission.
  2. European Commission — The Digital Services ActOfficial Commission overview. Used for the proportional structure of the DSA, the additional obligations for services above the 45-million-user threshold and the Commission's supervisory role.
  3. EUR-Lex — Regulation (EU) 2022/2065, Digital Services ActOfficial text of the Digital Services Act. Used as the primary legal reference; this article is explanatory reporting, not legal advice.