← Blog
Security & Compliance

September 1, 2026

ChatGPT Is Now an EU-Designated Search Engine: What the DSA Ruling Means

ChatGPT Is Now an EU-Designated Search Engine: What the DSA Ruling Means

On August 31, 2026, the European Commission designated ChatGPT a Very Large Online Search Engine (VLOSE) under the EU's Digital Services Act (DSA) — the first time any AI chatbot has received this classification. In the same announcement, Reddit and Roblox were designated Very Large Online Platforms (VLOPs), a related but distinct DSA category.

What the EU Actually Decided

The DSA is the EU's core framework for regulating digital intermediaries, marketplaces, and search engines. Under Article 24(2) of the DSA, companies must publicly report their average monthly active EU users every six months; once a service crosses 45 million average monthly active EU users, it can be designated a VLOP or VLOSE under Article 33, moving it into a stricter regulatory tier.

OpenAI reported that ChatGPT's search function had about 159 million average monthly active users in the EU, measured over the six months ending March 2026, well above the 45 million threshold. Reddit reported roughly 57.2 million monthly EU users, and Roblox about 48 million.

At the time of the announcement, none of the three companies — OpenAI, Reddit, or Roblox — had issued a public statement. European Commission Executive Vice-President Henna Virkkunen said: "These new designations mean that ChatGPT, Reddit and Roblox will now be held to a higher standard of scrutiny and accountability in the European Union, in line with their large impact on our citizens and society." She added: "We continue to watch the digital landscape closely and will not hesitate to designate any platform that meets the threshold for enhanced supervision under the Digital Services Act."

Is "Same Rules as Google" Accurate?

Largely, yes. Google Search and Microsoft Bing were already designated VLOSEs years earlier, in the DSA's original 2023 rollout. ChatGPT now sits in that exact same regulatory tier — not a separate or lighter one.

That said, regulators are treating the underlying risk somewhat differently even within the same category. Google Search returns a list of links and leaves the judgment to the user. ChatGPT synthesizes one confident answer, often with sources folded into the response or missing entirely. That shifts more interpretive responsibility onto the model itself, which is part of why a conversational AI search engine raises different questions than a list of blue links, even under the same VLOSE label.

What VLOSE Status Actually Requires

Once designated, a company has four months to comply with the DSA's obligations for very large services, putting ChatGPT's compliance deadline at around the end of 2026. Regulatory oversight falls to Ireland's Coimisiún na Meán for ChatGPT and Reddit (both have their EU operations based in Ireland), and to the Netherlands' Authority for Consumers and Markets (ACM) for Roblox.

The core obligations include:

  • Annual systemic risk assessments covering illegal content, protection of minors, mental and physical health effects, civic discourse and elections, and public security
  • Independent external audits
  • A dedicated internal compliance team
  • Data access for vetted researchers
  • A searchable, publicly accessible advertising library
  • At least one non-personalized content or results option for users
  • A working mechanism for users to report illegal content

The fines are real: up to 6% of a company's total global annual turnover, not just EU revenue, for non-compliance, plus additional daily fines of up to 5% of global average daily turnover for ignoring a formal Commission order. The Commission has already used this scale of penalty before, fining X (formerly Twitter) €120 million in December 2025 under the DSA.

What This Means If You're Relying on AI Search Visibility

This designation lands right as more businesses are shifting budget from traditional SEO toward answer engine optimization (AEO): making sure accurate information about your business is what gets retrieved and cited when someone asks ChatGPT, Perplexity, or Google's AI Overviews a question instead of typing a search query. With ChatGPT now under formal DSA transparency and audit obligations, how it surfaces, ranks, and cites information is going to face more scrutiny, not less.

That's a reasonable argument for taking source-citation and data accuracy more seriously if AI-driven discovery matters to your business, regardless of what the EU eventually finds in its audits. It's also a good moment to look at your own AI systems the same way, especially if you serve EU customers: can you explain why an AI agent gave the answer it gave, and is that answer grounded in something verifiable?

What This Means If You're Building AI Agents

This kind of regulatory attention isn't limited to consumer chatbots. Any business deploying custom AI agents that touch EU users should expect the bar for explainability and data grounding to keep rising, not necessarily because of direct DSA exposure, but because "the AI just said so" is becoming a weaker answer by the day, for regulators and customers alike.

This is exactly the argument for RAG knowledge agents over agents that rely on a model's unverified parametric memory: grounding an agent's answers in your own verified documents and data means you can actually point to where an answer came from, instead of trusting a black box. It's also part of why AI integration and consulting work increasingly includes questions about data governance and auditability up front, not as an afterthought once something goes wrong.

Frequently Asked Questions

What did the EU actually decide about ChatGPT?

On August 31, 2026, the European Commission designated ChatGPT a Very Large Online Search Engine (VLOSE) under the Digital Services Act, the first AI chatbot to receive this classification. Reddit and Roblox were designated Very Large Online Platforms in the same announcement.

Is ChatGPT really under the same rules as Google?

Yes. Google Search and Microsoft Bing were already designated VLOSEs under the DSA since 2023, and ChatGPT now falls under that same regulatory tier, not a separate one.

What triggered the designation?

The DSA designates a service a VLOP or VLOSE once it passes 45 million average monthly active EU users. OpenAI reported ChatGPT's search function had about 159 million average monthly active EU users, well above that threshold.

What fines can the EU impose?

Up to 6% of a company's total global annual turnover for non-compliance, with additional daily fines of up to 5% of global average daily turnover for ignoring a formal Commission order. The EU has already fined X (formerly Twitter) €120 million under the DSA in December 2025.

When does ChatGPT need to comply?

Designated companies get four months to comply with VLOSE/VLOP obligations, putting ChatGPT's deadline at around the end of 2026.

What does this mean for businesses using AI for search visibility?

It's a signal that transparency and source-citation in AI-driven answers are getting more regulatory attention, which is a good reason to prioritize verifiable, well-sourced content and, for AI agents you build yourself, grounding answers in real data rather than a model's unverified memory.

Building AI Systems That Can Explain Themselves

Whatever comes out of the EU's audits, the direction is clear: AI systems that synthesize answers rather than just listing sources are going to face more questions about where those answers come from. At AuraStag, we build custom AI agents, workflow automations, and RAG knowledge agents grounded in your own verified data, not a generic template bolted onto your business. If you want to talk through how your AI systems hold up to that kind of scrutiny, contact our team.