ChatGPT Designated Very Large Search Engine Under EU DSA

The European Commission formally designated ChatGPT as a Very Large Online Search Engine under the Digital Services Act on August 31, 2026, pulling OpenAI into a compliance regime previously occupied by search giants and dominant social platforms. Reddit and Roblox received simultaneous Very Large Online Platform designations. For engineers and ML practitioners, this is not an abstract policy story: the DSA's obligations land directly on system design decisions around content filtering, algorithmic transparency, and user-targeting logic — areas where AI infrastructure choices carry direct legal exposure.

The trigger threshold is 45 million average monthly users in the EU. Once a platform crosses that line, the DSA treats it as a systemic risk to society rather than an ordinary product, and the accountability framework shifts accordingly. All three newly designated services have until the end of December 2026 to comply.

What VLOP Designation Actually Requires

The DSA's obligations for Very Large platforms fall into several concrete categories. Ad targeting must exclude minors entirely and cannot use a person's sexual orientation, religion, ethnicity, or political beliefs as signals — a constraint that touches any personalisation layer downstream of user profiling. Recommendation algorithm transparency is mandatory: platforms must disclose how their ranking and surfacing logic works, which for a conversational AI system raises immediate questions about how response prioritisation and retrieval weighting are documented and audited. Risk mitigation must cover impacts on minors, user mental health, and the spread of illegal content.

The "Very Large Online Search Engine" classification applied to ChatGPT is notable because it treats a generative AI assistant under the same statutory category as traditional search infrastructure. That framing has technical implications: search engine obligations under the DSA include specific audit rights for researchers and regulators, and require annual independent risk assessments. OpenAI will need to produce documentation at a level of specificity that most AI product teams have not yet built into their release pipelines.

The Compliance Architecture Problem

Meeting DSA obligations requires instrumenting systems that most large language model deployments were not designed to expose. Recommendation algorithm transparency means an AI provider needs an auditable account of why the model surfaces one response over another — a question that current transformer architectures answer poorly by default. Content moderation pipelines must demonstrably reduce illegal content without over-suppression, and those pipelines must be tunable without degrading core model performance.

The challenge is compounded for OpenAI because ChatGPT operates as a general-purpose conversational interface rather than a narrowly scoped search tool, making categorical risk assessment harder to scope. This is precisely the kind of compliance pressure that incentivises architectural specificity over raw scaling, since a modular system with well-defined layers is far easier to audit and constrain than a monolithic deployment.

Designation Comparison

Regulatory Signal for AI Developers

EU executive vice-president Henna Virkkunen stated that the designations are meant to hold these services to "a higher standard of scrutiny and accountability… in line with their large impact on our citizens and society." That framing establishes that user scale alone — not narrow product category — is sufficient for AI systems to inherit the full VLOP/VLOSE compliance burden. Any LLM deployment that crosses the 45 million EU monthly active user threshold faces the same obligations regardless of whether it is positioned as a chatbot, a search engine, or a productivity tool.

For global AI infrastructure providers, this creates a structural incentive to instrument platforms for regulatory auditability from the outset rather than retrofitting compliance onto deployed systems — a problem directly connected to the autonomy and safety controls debate now playing out across the industry. The December 2026 deadline is tight enough that compliance work needs to be underway now, and the engineering scope — auditable recommendation logic, enforceable content filtering, population-level risk assessments — is substantial.