The European Union has brought ChatGPT, Reddit and Roblox into the strictest tier of its Digital Services Act, widening Brussels’ direct oversight of some of the technology industry’s fastest-growing consumer services and establishing an important regulatory marker for conversational artificial intelligence. The European Commission announced on August 31 that ChatGPT had been designated a Very Large Online Search Engine, or VLOSE, while Reddit and Roblox had been designated Very Large Online Platforms, known as VLOPs.

The classifications were triggered by scale rather than by a finding of misconduct. Under the DSA, online platforms and search engines reaching at least 45 million average monthly recipients in the European Union can be designated as very large services and become subject to additional requirements reflecting their potential societal impact. The Commission said ChatGPT, Reddit and Roblox had each declared user numbers at or above that threshold. The three services were already covered by general DSA obligations applicable to their respective categories, but the new designations add a substantially more demanding layer of supervision.

The treatment of ChatGPT is the most consequential element for the broader technology industry because it applies a major platform-regulation framework to an AI system whose interface differs materially from a traditional search engine. The Commission described ChatGPT as a hybrid service because it can engage with and respond to users’ prompts and queries, including by searching the web. On that basis, Brussels concluded that the service qualifies as an online search engine under the DSA.

That functional interpretation could have implications beyond OpenAI. AI assistants are increasingly incorporating real-time web retrieval, source discovery and information-ranking functions into conversational interfaces. The Commission’s approach indicates that the regulatory classification of such products may depend less on whether they display a familiar list of links and more on what happens behind the interface. AI products that retrieve and organize information from the open web could therefore face scrutiny under digital-services rules alongside obligations arising from the EU’s separate AI regulatory framework.

OpenAI’s own DSA disclosure illustrates the scale behind the Commission’s decision. The company has reported approximately 159.1 million average monthly active recipients in the European Union for ChatGPT search during the six-month period ending March 31, 2026. OpenAI cautions that the figure was calculated specifically for DSA compliance and refers to ChatGPT’s online search features rather than serving as a conventional measure of the entire ChatGPT user base. Even with those qualifications, the disclosed figure puts the search function substantially above the EU’s 45 million threshold.

Reddit and Roblox enter the same enhanced supervisory tier through a different legal category. Reddit is built around user-created discussions, posts and communities, while Roblox allows users to create, publish, play and interact within experiences developed by other users. Because both services enable third-party material to be disseminated publicly, the Commission considers them online platforms under the DSA. Their designation as VLOPs subjects those content ecosystems to the enhanced obligations reserved for services large enough to create systemic risks across the European market.

The companies now face a four-month period following notification in which to comply with the additional VLOP and VLOSE obligations. The DSA requires designated services to identify, analyze and assess systemic risks connected to the design, functioning and use of their products. The Commission specifically highlighted risks involving the spread of illegal content, effects on minors, users’ physical and mental well-being, fundamental rights, electoral processes and public security.

Those assessments are intended to lead to concrete mitigation rather than remain primarily reporting exercises. Depending on the identified risks, the DSA can require large services to change product design, functionality, content-management processes or algorithmic systems. The Commission’s guidance notes that mitigation can include changes to recommender systems and additional internal resources for identifying and addressing systemic risks. For companies operating complex AI or user-generated-content services, those requirements can directly affect product development and engineering decisions.

Very large services must also establish internal compliance structures and undergo independent audits at least annually. They are expected to respond to audit recommendations and provide regulators with evidence showing how identified risks are being addressed. That requirement introduces a recurring external review process into businesses that frequently modify recommendation models, ranking systems, safety policies and product interfaces. The operational burden is particularly relevant for AI services, where underlying models and retrieval systems can be updated rapidly and where changes in product capability may alter the risk profile regulators expect companies to assess.

Data access is another significant element. VLOPs and VLOSEs must share relevant data with the European Commission and national authorities for compliance monitoring, while vetted researchers can obtain access to certain data when their work contributes to identifying and understanding systemic risks in the EU. The rules are designed to give regulators and qualified independent researchers greater visibility into services whose scale and algorithmic complexity can otherwise make outside assessment difficult.

The DSA also contains transparency requirements concerning advertising, recommendation systems and content-moderation decisions. Designated very large services can be required to maintain publicly accessible advertising repositories, and services using recommender systems must provide an option that is not based on profiling where the relevant DSA provisions apply. The rules complement broader restrictions under the regulation, including protections against certain targeted advertising practices involving minors or sensitive personal information.

For ChatGPT, the new obligations raise questions that are different from those associated with conventional social-media feeds. Regulators may increasingly focus on how search retrieval, source selection, generated answers, safety systems and other algorithmic components interact when users request information. Because generative AI produces synthesized responses rather than merely displaying existing web pages, assessing risks involving illegal information, fundamental rights or information integrity may require regulators and providers to develop compliance methods that were not central to earlier generations of search and social platforms.

Reddit faces a more established set of platform-governance questions, including how community moderation, recommendation systems and user-generated content operate at scale. Its forum structure distributes substantial moderation responsibility across individual communities while the company operates sitewide rules, safety systems and recommendation technology. Enhanced DSA oversight places greater emphasis on documenting how those layers work together and whether they adequately mitigate risks associated with a service reaching tens of millions of European users.

Roblox presents another distinct compliance profile because of its concentration of younger users and its combination of gaming, social interaction and user-created virtual experiences. Protection of minors is explicitly among the systemic-risk categories the Commission requires designated services to assess. For an immersive platform, that can involve questions surrounding content exposure, communication tools, recommendation systems, age-appropriate design and interactions among users. The DSA does not prescribe one universal product configuration, but the VLOP framework increases the expectation that Roblox can demonstrate how it identifies and mitigates risks systematically.

The designations also strengthen the Commission’s direct supervisory role. Brussels will be able to deploy DSA investigative tools when necessary to assess whether the companies are meeting their obligations, including requests for information and scrutiny of relevant data and algorithms. The Commission said it will cooperate with Ireland’s Coimisiún na Meán for ChatGPT and Reddit and with the Netherlands’ Authority for Consumers and Markets for Roblox, reflecting the locations of the designated services’ European establishments.

That institutional structure is one of the defining characteristics of the DSA’s regime for the largest technology platforms. While national Digital Services Coordinators supervise many services established within their jurisdictions, the European Commission plays a central role in supervising and enforcing the special obligations imposed on VLOPs and VLOSEs. The arrangement gives Brussels greater ability to examine technology systems with EU-wide reach rather than leaving oversight solely to individual member states.

The financial consequences of non-compliance can be substantial. Under the DSA, a final non-compliance decision can lead to a fine of as much as 6% of a provider’s global annual turnover, with the level determined by factors including the nature, gravity, recurrence and duration of an infringement. The Commission also has powers to demand information, conduct investigations and impose other measures under the regulation. Those enforcement provisions do not mean penalties are automatic following designation; the August 31 decisions establish regulatory status rather than determine that OpenAI, Reddit or Roblox has violated the law.

The distinction is important as investors and technology companies assess the immediate effect. Designation itself is fundamentally a consequence of crossing the DSA’s scale threshold. It means the companies are now considered important enough to warrant enhanced risk governance and direct oversight. Any determination of non-compliance would require a separate supervisory or enforcement process in which the Commission would examine evidence and provide the company concerned an opportunity to respond.

For the technology sector, the broader significance lies in the expansion of regulatory expectations as product categories converge. Search engines increasingly provide generated answers, social networks incorporate AI assistants, and gaming platforms operate social and creator economies that resemble large content networks. The DSA classifications announced August 31 demonstrate that the EU intends to apply its framework according to the functions and reach of a service even when new technologies do not fit neatly into older product categories.

ChatGPT’s designation is therefore likely to be watched closely by developers of competing AI assistants. If conversational systems integrate web search and grow beyond the EU’s user threshold, they may confront the same question of whether their information-retrieval capabilities make them online search engines for DSA purposes. That could turn systemic-risk reporting, independent auditing, regulator access and transparency mechanisms into core operating requirements for large-scale consumer AI products in Europe.

The decision also underscores the growing overlap between product engineering and technology regulation. Compliance with the enhanced DSA regime can reach beyond legal policies into recommendation design, model and system documentation, moderation controls, research access and internal governance. For OpenAI, Reddit and Roblox, changes made to algorithms or user experiences will increasingly need to be considered not only in terms of engagement and safety performance but also through the lens of documented systemic-risk management.

The Commission said the new additions bring the number of designated very large online platforms and search engines under the DSA to 28. The inclusion of three prominent U.S.-based services broadens a group that already encompasses major search, social-media, marketplace and technology platforms. It also reinforces the EU’s policy of imposing additional responsibilities once digital services reach a scale Brussels considers capable of materially influencing European consumers and society.

The coming compliance period will provide the first indication of how that framework is adapted to the three markedly different services. For Reddit and Roblox, the process will extend established platform-safety and transparency requirements into larger-scale oversight. For ChatGPT, the regulatory experiment is more novel: the EU is applying its highest search-engine supervision tier to a conversational AI system whose outputs combine generated content and web retrieval. How regulators interpret those obligations in practice could shape not only OpenAI’s European operations but the compliance architecture of the wider AI search industry.