P.K. SHARMA

Cyber security intelligence, AI governance, practitioner analysis

The EU designated ChatGPT under the Digital Services Act. It classified it as a search engine, not a platform.

Four months to comply, by January 2027, with fines up to 6% of worldwide turnover. And the clause that made it a search engine is about output formats, not search.

By Parminder Kumar Sharma · · 7 min read

A traditional wooden-handled office rubber stamp lying on a dark desk, its rubber face completely blank and unengraved, lit by a cool cyan rim light with the desk falling away to the left into near black.

On 31 August 2026 the European Commission designated ChatGPT under the Digital Services Act. It did not designate it as a platform. It designated it as a Very Large Online Search Engine.

Reddit and Roblox were designated the same day, as Very Large Online Platforms. ChatGPT was not put in that category, and the difference is the part of this story worth understanding.

The Commission's wording is unambiguous: "the Commission has designated ChatGPT as a Very Large Online Search Engine (VLOSE), as well as Reddit and Roblox as Very Large Online Platforms (VLOPs), under the Digital Services Act (DSA)".

The definition it was designated under, clause by clause

THE DEFINITION IT WAS DESIGNATED UNDER, CLAUSE BY CLAUSEDigital Services Act, Article 3(j). Quoted verbatim. The Commission published no reasoning, so this is a reading of the text.WHAT THE REGULATION SAYSHOW A CONVERSATIONAL ASSISTANT MEETS IT“an intermediary service”FITSFits. Not contested.“that allows users to input queries”FITSFits. A prompt is a query.“to perform searches of, in principle, allwebsites”STRAINSThe weakest fit. A model answers from weights andsearches selectively. It maintains no index of all sites.“a keyword, voice request, phrase or otherinput”FITSFits, because “or other input” is drafted broadlyenough to cover a conversational prompt.“returns results in any format”LOAD-BEARINGThis is the clause doing the work. It is what lets asynthesised prose answer count as search results.So the category is search engine, and the obligations arrive on the same clock either way.Four months from notification, which the Commission puts at January 2027. Fines up to 6% of total worldwide annual turnover, Article 74.Designation announced 31 August 2026. Reddit and Roblox were designated Very Large Online Platforms on the same day; ChatGPT was not.The threshold in every case is the same: at least 45 million average monthly users in the EU, which these services declared.This is the Digital Services Act, not the AI Act. Different instrument, different regulator posture, different deadline.
The right-hand column is a reading of the statutory text against the product, not a summary of the Commission’s reasoning, which was not published with the designation. It is set out this way because the interesting question for anyone else building a conversational product is not whether ChatGPT fits, but which clause they would be argued into next.
Article 3(j) of the Digital Services Act, quoted verbatim from the consolidated Regulation. The Commission published no reasoning alongside the designation, so the right-hand column is a reading of the statutory text rather than a summary of the Commission's own analysis.

What triggered it, and what happens now

The threshold is mechanical and it is the same for both categories. These services "declared that they reach at least 45 million average monthly users in the EU and thus meet the threshold for designation". That is a declaration by the service, not a Commission measurement.

The clock is four months from notification. The Commission puts the date plainly: "these services have four months, i.e. by January 2027, to comply with the additional DSA obligations for VLOPs and VLOSEs".

What those obligations cover is listed in the same sentence, and the list is broader than most summaries suggest. Providers must assess and mitigate "the systemic risks stemming from their service and algorithmic systems related to the dissemination of illegal content, the negative effects on minors, users' physical and mental well-being, fundamental rights, electoral processes and public security".

For a generative assistant, "systemic risks stemming from their algorithmic systems" is a very large sentence indeed.

The enforcement ceiling is in Article 74(1) of the Regulation: the Commission may impose fines "not exceeding 6% of its total worldwide annual turnover in the preceding financial year".

Why the category matters even though the deadline does not change

Read the Commission's sentence carefully and it applies "the additional DSA obligations for VLOPs and VLOSEs" to all three services together. So this is not a case where ChatGPT drew a lighter regime. The headline obligations and the January 2027 date are shared.

The category matters for a different reason: it establishes what kind of thing the Commission thinks a conversational assistant is.

The Digital Services Act defines an online search engine at Article 3(j) as "an intermediary service that allows users to input queries in order to perform searches of, in principle, all websites, or all websites in a particular language, on the basis of a query on any subject in the form of a keyword, voice request, phrase or other input, and returns results in any format in which information related to the requested content can be found".

That definition was drafted with Google and Bing in view. Applied to ChatGPT, most of it fits comfortably. A prompt is a query. "Or other input" is drafted broadly enough to cover conversational text without any strain at all.

Two clauses are doing real work.

The first is "perform searches of, in principle, all websites". A language model does not maintain an index of all websites. It answers from its weights, and searches the web selectively when it decides to. That is the weakest fit in the definition, and it is the one a provider would contest if it wanted to.

The second is the one that makes the designation work: "returns results in any format in which information related to the requested content can be found". A synthesised prose answer with no list of links is, on those words, results in a format. Five words carry the entire question of whether a chatbot is a search engine, and they were written before anybody needed them to.

This is not the AI Act, and the difference is not cosmetic

A good deal of the coverage has folded this into a general story about Europe regulating AI. It is worth separating, because the two instruments have different regulators, different obligations and different dates.

Two instruments that are being conflated

Digital Services ActAI Act
What it regulates hereThe service as an intermediary: systemic risk, minors, elections, illegal contentThe AI system and its provider, by risk tier
What happened on 31 August 2026ChatGPT designated a Very Large Online Search EngineNothing. This designation is not an AI Act action
The deadline that followsFour months, which the Commission states as January 2027Its own separate timetable, unaffected by this
Maximum fine6% of total worldwide annual turnover, Article 74A different penalty regime under its own articles
The designation of 31 August 2026 was made under the Digital Services Act only. Nothing in the Commission's announcement concerns the AI Act, and the obligations and deadline described in it are DSA obligations.

If you are briefing a board or a compliance function this week, the correction worth making is small and specific: the obligation that lands in January 2027 is a systemic risk assessment under the DSA, and it is owned by whoever owns online safety and platform compliance, not by whoever owns your AI Act readiness programme. In most organisations those are different people, and in several they do not currently talk.

Who this actually affects

Directly, three companies. Indirectly, everyone building a conversational product with European users, because the designation establishes a reading of Article 3(j) that other services will be measured against.

The question for a product team is no longer whether their assistant is a search engine in some intuitive sense. It is whether it "returns results in any format in which information related to the requested content can be found", which is a far easier test to meet, and whether they are approaching 45 million average monthly EU users, which is a number a growing product can reach without noticing.

There is a second-order point for anyone running retrieval-augmented systems internally. The Commission has treated the synthesis of an answer as the returning of results. That is a reasonable reading, and it is one that does not obviously stop at consumer products.

Take this with you

What to do before January 2027

  • Establish which function owns this. It is a Digital Services Act obligation, so it sits with platform and online safety compliance rather than with the AI Act programme. Getting that wrong costs you two of the four months.
  • Read Article 3(j) against your own product, not against ChatGPT. The load-bearing phrase is “returns results in any format in which information related to the requested content can be found”, and a synthesised answer appears to satisfy it.
  • Track your EU monthly active users against the 45 million threshold deliberately. Designation follows a declaration by the service, so this is a number you are expected to know and report, not one the Commission discovers.
  • Scope a systemic risk assessment covering algorithmic systems, minors, physical and mental well-being, fundamental rights, electoral processes and public security. That is the Commission’s own list, and for a generative product several of those are genuinely hard.
  • Do not assume the AI Act timetable covers you for this. Different instrument, different obligations, different deadline, and this designation does not move any AI Act date.

The position

The interesting thing here is not that Europe regulated an AI product. It is that it did so without needing the AI Act at all.

A definition written in 2022 for services that index the web has been applied to a system that does not index anything, and it fits because of a clause about output formats rather than a clause about search. That is regulation working the way it is supposed to when it is drafted around function rather than technology, and it is a warning to anyone who has been planning their compliance calendar exclusively around AI-specific law.

The rules that catch you first are frequently the ones that were not written about you.

Sources

  1. PrimaryCommission designates ChatGPT, Reddit, Roblox under Digital Services Act, 31 August 2026European Commissionaccessed 2026-09-02
  2. PrimaryRegulation (EU) 2022/2065, the Digital Services Act. Article 3(j) defines an online search engine; Article 74(1) sets the 6% fine ceilingEUR-Lexaccessed 2026-09-02

Share this briefing

Know someone who owns this problem? Send it to them.

Related briefings

The briefing, in your inbox

Practitioner analysis of cyber and AI security news. No vendor noise.

One email per briefing. Unsubscribe any time.