ChatGPT Becomes First AI Chatbot Regulated as a Search Engine: EU Designates It a VLOSE

The European Commission on Monday designated ChatGPT a “Very Large Online Search Engine” under the Digital Services Act — the first time a generative AI service has been placed in the bloc’s strictest tier of content regulation. Reddit and Roblox were designated Very Large Online Platforms in the same decision, after all three services declared that they reach at least 45 million monthly users in the EU. They now have four months to comply with the full set of additional obligations that applies to very large services.

The classification is more than bureaucratic housekeeping. It resolves, with a single stroke, a question that European regulators had been openly wrestling with for almost a year: does an AI chatbot with a live web-search function count as a search engine? Brussels has now answered yes.

What designation actually means

The DSA’s tiered system imposes progressively heavier duties as services grow. Crossing the 45-million-monthly-EU-user threshold — roughly ten percent of the bloc’s population — triggers the “very large” regime: systemic risk assessments, independent audits, transparency reporting, data access for vetted researchers, and direct supervision by the Commission itself, including investigative powers over the functionalities behind the service.

For the three newly designated services, the Commission spelled out the core obligations: assessing and mitigating risks of illegal content dissemination, limiting negative effects on minors and on users’ physical and mental wellbeing, and managing risks to fundamental rights, electoral processes, and public security.

What makes ChatGPT’s case unprecedented is the legal category it lands in. Roblox and Reddit qualify as “online platforms” — they enable users to disseminate third-party content to the public, the classic DSA paradigm. ChatGPT, by contrast, qualified as an online search engine. The Commission accepted that the service’s search functionality — which retrieves live information from the web — meets the DSA’s definition, with the chatbot’s declared EU reach reported at 159 million monthly average users.

A year in the making

Monday’s decision is the end of a road that began in October 2025, when OpenAI reported that ChatGPT’s search feature averaged 120.4 million monthly EU users over six months. That disclosure, made under the DSA’s transparency framework, far exceeded the 45-million threshold and put the Commission on the spot: assess, or explain why not.

The legal debate that followed was genuinely hard. The DSA was written for intermediary services — conduits, caches, hosts, search engines, marketplaces, social networks — categories that map poorly onto a conversational AI that generates its own answers. “A service such as ChatGPT does not seem to fit in either of the three main categories established under the DSA,” Joan Barata, a law professor at Católica University in Porto, told Tech Policy Press when the assessment began. He warned that designating it as a search engine “may still be problematic since only some specific features of ChatGPT can be strictly considered as search, unless we completely denaturalize the notion of this kind of service.”

The Commission’s counterargument, also laid out during the assessment period: an LLM “could potentially be in scope of the DSA if it is integrated into a service that is designated under the DSA.” ChatGPT’s web search is precisely such an integration — a retrieval layer over the generative model. That framing carried the day.

What OpenAI now has to do

The practical consequences are substantial. Under the VLOSE regime, OpenAI must conduct annual risk assessments examining ChatGPT’s design, algorithms, content moderation, and data practices — evaluating their impact on fundamental rights, civic discourse, electoral processes, and mental health. The assessments are also event-triggered: each time OpenAI deploys a new functionality likely to have a “critical impact” on systemic risks, a fresh assessment is required.

Mitigation may mean changing the product itself. “OpenAI may need to adapt ChatGPT’s systems, design, features, and functioning based on the assessed risks,” Laureline Lemoine of law firm AWO explained. Her warning from the assessment period now reads as prophetic: compliance “might lead to a slower deployment of new features in Europe.”

Perhaps the sharpest edge is Article 40 data access. The DSA grants vetted researchers the right to request data on systemic risks and mitigation measures — a right that does not exist under the AI Act. Natali Helberger, professor of information law at the University of Amsterdam, flagged the open question: could Article 40 requests extend “to access to training data or model weights if such access is necessary to identify systemic risk or assess mitigation measures”? Nobody knows yet, and the answer will shape AI regulation far beyond this case.

Two regimes, one chatbot

ChatGPT is now simultaneously subject to the AI Act — as a general-purpose AI model with systemic-risk obligations enforced by the EU AI Office — and to the DSA as a very large search engine. The overlap is a feature, not a bug, from Brussels’ perspective: the DSA broadens scrutiny from risks in the model itself to risks in its use, such as amplifying and disseminating illegal content.

“For an industry used to voluntary AI-safety frameworks and self-defined benchmarks,” Mathias Vermeulen, public policy director at AWO, observed, “the DSA’s legally binding due diligence regime might be a tough reality check. ‘Bias tests’ won’t be enough to pass compliance.”

The precedent effect is the real story. How Brussels classifies ChatGPT will shape the framework for every large-scale generative AI system serving Europe. Any assistant with web retrieval at scale — and that is now all of the frontier products — is a candidate for the same treatment. Four months from now, when the first compliance deadline lands, the industry will find out what search-engine obligations feel like when your search engine talks back.