EU Designates ChatGPT a Very Large Online Platform After Reaching 45 Million Users

Key Takeaways

• The European Commission has officially designated OpenAI’s ChatGPT as a Very Large Online Search Engine (VLOSE) under the Digital Services Act (DSA).
• This classification follows ChatGPT reporting over 45 million average monthly users within the EU, triggering enhanced regulatory oversight.
• Reddit and Roblox have also been categorized as Very Large Online Platforms (VLOPs) due to similar user numbers, bringing the total number of designated entities to 28.
• These platforms now face stringent new obligations, including systemic risk assessments and independent audits, with a compliance deadline of January 2027.

EU Designates ChatGPT, Reddit, and Roblox as “Very Large” Platforms Under Digital Services Act

Brussels, Belgium – The European Commission has officially classified OpenAI’s popular artificial intelligence chatbot, ChatGPT, as a Very Large Online Search Engine (VLOSE) under the Digital Services Act (DSA). This significant designation, announced on Monday, follows ChatGPT’s disclosure of reaching at least 45 million average monthly users across the European Union, a threshold that mandates heightened regulatory scrutiny.

In parallel decisions, the Commission also designated social media giant Reddit and online gaming platform Roblox as Very Large Online Platforms (VLOPs). These additions bring the total count of services under enhanced DSA supervision to 28, underscoring the EU’s expanding regulatory reach over influential digital services.

Enhanced Scrutiny for High-Impact Digital Services

The DSA stipulates that any online platform or search engine exceeding 45 million monthly active users in the EU — approximately 10% of the bloc’s population — automatically triggers a classification as “very large.” While ChatGPT, Reddit, and Roblox were already subject to the DSA’s general provisions for online services, their new designations impose a substantially more rigorous set of responsibilities.

Following notification, these entities are now required to conduct comprehensive assessments and implement mitigation strategies for systemic risks stemming from their services and algorithmic systems. They have a four-month window to comply, with a deadline set for the end of January 2027.

These mandatory risk evaluations must encompass a broad spectrum of potential harms, including the proliferation of illegal content, adverse impacts on minors, threats to users’ physical and mental well-being, infringements on fundamental rights, interference with electoral processes, and risks to public security.

Beyond internal risk reports, the newly designated platforms will also be subjected to independent annual audits and must provide vetted researchers with access to their data. This provision aims to offer external specialists unprecedented insight into the operational behavior of these systems at a European scale.

ChatGPT’s Unique Classification as a Search Engine

The European Commission’s decision to classify ChatGPT as a VLOSE is particularly noteworthy, marking a precedent for conversational AI. As detailed in the European Commission’s official decision, the chatbot’s ability to respond to prompts and queries, including by drawing information from the web, led regulators to categorize it as a hybrid service that fulfills the function of an online search engine.

This classification places ChatGPT alongside traditional search engines, obligating it to adhere to duties concerning ranking transparency, independent audits, and data access for both regulators and approved researchers. For cybersecurity professionals and teams monitoring AI-driven influence operations, this signifies that a conversational AI system retrieving web-scale answers for millions of European citizens is now considered critical search infrastructure under EU law.

Reddit and Roblox Face Content and Child Safety Obligations

Reddit and Roblox received their VLOP designations because their core functionalities enable users to disseminate third-party content widely. Reddit operates as a discussion platform organized into topic-based communities, while Roblox offers an immersive environment where users can publish and engage with games created by others.

Both models inherently present significant challenges related to content moderation and child safety. Consequently, the new risk assessment requirements will now extend to their recommendation systems, in addition to the user-generated material hosted on their platforms.

Supervision and Enforcement

The European Commission now possesses investigative authority over the functionalities and related systems of these designated services. Supervision will be a collaborative effort with national Digital Services Coordinators. Ireland’s Coimisiún na Meán will oversee ChatGPT and Reddit, while the Netherlands Authority for Consumers and Markets will be responsible for Roblox.

Non-compliance with the DSA’s enhanced obligations carries severe penalties, including fines that can reach up to 6% of a company’s global annual turnover.

Henna Virkkunen, Executive Vice-President for Tech Sovereignty, Security and Democracy, emphasized that ChatGPT, Reddit, and Roblox will be held to a higher standard of scrutiny and accountability, commensurate with their societal impact. She reiterated the Commission’s commitment to continuously monitor the digital landscape and to designate any platform that meets the established user thresholds without hesitation.

For cybersecurity teams, this development signals that conversational AI with live search capabilities, large online forums, and user-generated gaming environments are no longer on the periphery of Europe’s platform regulatory framework. They are now firmly within its scope, with a clear deadline for compliance by January 2027.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.